signals: cleanup security_task_kill() usage/implementation

Every implementation of ->task_kill() does nothing when the signal comes from
the kernel.  This is correct, but means that check_kill_permission() should
call security_task_kill() only for SI_FROMUSER() case, and we can remove the
same check from ->task_kill() implementations.

(sadly, check_kill_permission() is the last user of signal->session/__session
 but we can't s/task_session_nr/task_session/ here).

NOTE: Eric W.  Biederman pointed out cap_task_kill() should die, and I think
he is very right.

Signed-off-by: Oleg Nesterov <oleg@tv-sign.ru>
Cc: "Eric W. Biederman" <ebiederm@xmission.com>
Cc: Serge Hallyn <serue@us.ibm.com>
Cc: Roland McGrath <roland@redhat.com>
Cc: Casey Schaufler <casey@schaufler-ca.com>
Cc: David Quigley <dpquigl@tycho.nsa.gov>
Cc: Eric Paris <eparis@redhat.com>
Cc: Harald Welte <laforge@gnumonks.org>
Cc: Pavel Emelyanov <xemul@openvz.org>
Cc: Stephen Smalley <sds@tycho.nsa.gov>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

2 files changed, 0 insertions, 12 deletions

diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
index 85a220465a8f..1b50a6ebc55f 100644
--- a/security/selinux/hooks.c
+++ b/security/selinux/hooks.c
@@ -3286,9 +3286,6 @@ static int selinux_task_kill(struct task_struct *p, struct siginfo *info,
         if (rc)
                 return rc;
 
-        if (info != SEND_SIG_NOINFO && (is_si_special(info) || SI_FROMKERNEL(info)))
-                return 0;
-
         if (!sig)
                 perm = PROCESS__SIGNULL; /* null signal; existence test */
         else
diff --git a/security/smack/smack_lsm.c b/security/smack/smack_lsm.c
index fe0ae1bf1650..b5c8f9237008 100644
--- a/security/smack/smack_lsm.c
+++ b/security/smack/smack_lsm.c
@@ -1131,15 +1131,6 @@ static int smack_task_kill(struct task_struct *p, struct siginfo *info,
                            int sig, u32 secid)
 {
         /*
-         * Special cases where signals really ought to go through
-         * in spite of policy. Stephen Smalley suggests it may
-         * make sense to change the caller so that it doesn't
-         * bother with the LSM hook in these cases.
-         */
-        if (info != SEND_SIG_NOINFO &&
-            (is_si_special(info) || SI_FROMKERNEL(info)))
-                return 0;
-        /*
          * Sending a signal requires that the sender
          * can write the receiver.
          */