Re: [RFC PATCH ghak32 V2 02/13] audit: check children and threading before allowing containerid

2018-04-18 Thread Paul Moore
On Fri, Mar 16, 2018 at 5:00 AM, Richard Guy Briggs wrote: > Check if a task has existing children or co-threads and refuse to set > the container ID if either are present. Failure to check this could > permit games where a child scratches its parent's back to work around > inheritance and double

[RFC PATCH ghak32 V2 02/13] audit: check children and threading before allowing containerid

2018-03-16 Thread Richard Guy Briggs
Check if a task has existing children or co-threads and refuse to set the container ID if either are present. Failure to check this could permit games where a child scratches its parent's back to work around inheritance and double-setting policy. Signed-off-by: Richard Guy Briggs --- kernel/aud