signal: Always deliver the kernel's SIGKILL and SIGSTOP to a pid name…

…space init [ Upstream commit 3597dfe ] Instead of playing whack-a-mole and changing SEND_SIG_PRIV to SEND_SIG_FORCED throughout the kernel to ensure a pid namespace init gets signals sent by the kernel, stop allowing a pid namespace init to ignore SIGKILL or SIGSTOP sent by the kernel. A pid namespace init is only supposed to be able to ignore signals sent from itself and children with SIG_DFL. Fixes: 921cf9f ("signals: protect cinit from unblocked SIG_DFL signals") Reviewed-by: Thomas Gleixner <[email protected]> Signed-off-by: "Eric W. Biederman" <[email protected]> Signed-off-by: Sasha Levin <[email protected]> Signed-off-by: Greg Kroah-Hartman <[email protected]>
coreos · Nov 13, 2018 · cd08520 · cd08520
1 parent cfc8a57
commit cd08520
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/kernel/signal.c b/kernel/signal.c
@@ -1035,7 +1035,7 @@ static int __send_signal(int sig, struct siginfo *info, struct task_struct *t,
 
 	result = TRACE_SIGNAL_IGNORED;
 	if (!prepare_signal(sig, t,
-			from_ancestor_ns || (info == SEND_SIG_FORCED)))
+			from_ancestor_ns || (info == SEND_SIG_PRIV) || (info == SEND_SIG_FORCED)))
 		goto ret;
 
 	pending = (type != PIDTYPE_PID) ? &t->signal->shared_pending : &t->pending;