3 files changed, 14 insertions, 25 deletions

diff --git a/kernel/signal.c b/kernel/signal.c
index f9a52c721274..91d57f89f5a5 100644
--- a/kernel/signal.c
+++ b/kernel/signal.c
@@ -533,22 +533,23 @@ static int rm_from_queue(unsigned long mask, struct sigpending *s)
 static int check_kill_permission(int sig, struct siginfo *info,
                                  struct task_struct *t)
 {
-        int error = -EINVAL;
+        int error;
+
         if (!valid_signal(sig))
-                return error;
+                return -EINVAL;
 
-        if (info == SEND_SIG_NOINFO || (!is_si_special(info) && SI_FROMUSER(info))) {
-                error = audit_signal_info(sig, t); /* Let audit system see the signal */
-                if (error)
-                        return error;
-                error = -EPERM;
-                if (((sig != SIGCONT) ||
-                        (task_session_nr(current) != task_session_nr(t)))
-                    && (current->euid ^ t->suid) && (current->euid ^ t->uid)
-                    && (current->uid ^ t->suid) && (current->uid ^ t->uid)
-                    && !capable(CAP_KILL))
+        if (info != SEND_SIG_NOINFO && (is_si_special(info) || SI_FROMKERNEL(info)))
+                return 0;
+
+        error = audit_signal_info(sig, t); /* Let audit system see the signal */
+        if (error)
                 return error;
-        }
+
+        if (((sig != SIGCONT) || (task_session_nr(current) != task_session_nr(t)))
+            && (current->euid ^ t->suid) && (current->euid ^ t->uid)
+            && (current->uid ^ t->suid) && (current->uid ^ t->uid)
+            && !capable(CAP_KILL))
+                return -EPERM;
 
         return security_task_kill(t, info, sig, 0);
 }
diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
index 85a220465a8f..1b50a6ebc55f 100644
--- a/security/selinux/hooks.c
+++ b/security/selinux/hooks.c
@@ -3286,9 +3286,6 @@ static int selinux_task_kill(struct task_struct *p, struct siginfo *info,
         if (rc)
                 return rc;
 
-        if (info != SEND_SIG_NOINFO && (is_si_special(info) || SI_FROMKERNEL(info)))
-                return 0;
-
         if (!sig)
                 perm = PROCESS__SIGNULL; /* null signal; existence test */
         else
diff --git a/security/smack/smack_lsm.c b/security/smack/smack_lsm.c
index fe0ae1bf1650..b5c8f9237008 100644
--- a/security/smack/smack_lsm.c
+++ b/security/smack/smack_lsm.c
@@ -1131,15 +1131,6 @@ static int smack_task_kill(struct task_struct *p, struct siginfo *info,
                            int sig, u32 secid)
 {
         /*
-         * Special cases where signals really ought to go through
-         * in spite of policy. Stephen Smalley suggests it may
-         * make sense to change the caller so that it doesn't
-         * bother with the LSM hook in these cases.
-         */
-        if (info != SEND_SIG_NOINFO &&
-            (is_si_special(info) || SI_FROMKERNEL(info)))
-                return 0;
-        /*
          * Sending a signal requires that the sender
          * can write the receiver.
          */