support signal allowed for childs peers only

Bug #1712288 reported by Mikhail Kurinnoi
6
This bug affects 1 person
Affects Status Importance Assigned to Milestone
AppArmor
New
Undecided
Unassigned

Bug Description

For now, we could use "signal" for peer or allow it for all. Is it possible to add for "signal" one more build-in variable @{childs}? Or in another way allow "signal" for childs processes only.

For example:
signal (send) set=(kill,term) peer="@{childs}",

will allow send signal to all childs processes only.

Revision history for this message
Seth Arnold (seth-arnold) wrote :

Hi Mikhail, I like it.

Would you expect children of children to be included in this list?

If all the children will inherit the same profile, you could get something similar by using

signal (send) set=(kill,term) peer=@{profile_name},

Of course unrelated processes started within the same profile will still be able to signal each other, but this might be useful enough anyway.

Thanks

Revision history for this message
Mikhail Kurinnoi (viewizard) wrote :

Hi,

yes, I expect children of children to be included in this list too. By "children" I mean new process that run under the current, child or another profile.

The idea is - allow parent send signal to any children or children of children, but deny send signal to process with same peer started by another process. So, we could have 3 options:
1) signal to any processes;
2) signal to children processes only;
3) signal to specific peer only.

For example, I have qgit profile. qgit have configurable option for editor and diff programs (qgit should be able send signal "term" to them). The best solution could be signal to children processes only, but we don't have such option, so, since I use another profiles for editor and diff programs, I forced to use list of signal by peer that could be used as editor or diff programs... and allow qgit terminate any instance of editor or diff programs.

To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.