On Wed, Jan 3, 2018 at 12:08 PM, Casey Schaufler <casey@xxxxxxxxxxxxxxxx> wrote: > On 1/3/2018 11:44 AM, Matthew Garrett wrote: >> If we want to be able to do something conditional on the LSM context >> that a process is going to be executed under, *before* commit_creds() >> is called, is there an existing way to do so? I can rework this so we >> use the task secid for all running processes and the cred secid for >> the not-yet-running child process, but I don't know if that's >> sufficient to avoid problems in future. > > It's possible that converting all the existing calls of > security_task_getsecid() to security_cred_getsecid() is the > safe approach. No one is using the task blob today, and this > would disambiguate the situation. Ok. Should we be looking at creds or real_creds?
