lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Date: Sun, 29 Mar 2009 05:10:22 +0100 From: Al Viro <viro@...IV.linux.org.uk> To: Oleg Nesterov <oleg@...hat.com> Cc: Hugh Dickins <hugh@...itas.com>, Linus Torvalds <torvalds@...ux-foundation.org>, Andrew Morton <akpm@...ux-foundation.org>, Joe Malicki <jmalicki@...acarta.com>, Michael Itz <mitz@...acarta.com>, Kenneth Baker <bakerk@...acarta.com>, Chris Wright <chrisw@...s-sol.org>, David Howells <dhowells@...hat.com>, Alexey Dobriyan <adobriyan@...il.com>, Greg Kroah-Hartman <gregkh@...e.de>, linux-fsdevel@...r.kernel.org, linux-kernel@...r.kernel.org Subject: Re: Q: check_unsafe_exec() races (Was: [PATCH 2/4] fix setuid sometimes doesn't) On Sun, Mar 29, 2009 at 01:53:43AM +0100, Oleg Nesterov wrote: > Can't find the patch which introduced check_unsafe_exec(), so > I am asking here. > > How it is supposed to work? > > Let's suppose we have two threads T1 and T2. T1 exits, and calls > exit_fs(). > > exit_fs: > > tsk->fs = NULL; > // WINDOW > put_fs_struct(fs); > > Now, if T2 does exec() and check_unsafe_exec() happens in the WINDOW > above, we set LSM_UNSAFE_SHARE. > > Or we can race with sub-thread doing clone(CLONE_FS|CLONE_THREAD), > the new thread is not visible in ->thread_group, buy copy_fs() > can already increment fs->count. Frankly, I don't think we really care. Note that having several sub-threads and doing execve() in one of them will kill the rest, so you really want to do some kind of synchronization to get something similar to reasonable behaviour anyway. > Another question. Why do we check sighand->count? We always unshare > ->sighand on exec, see de_thread(). Correct. That check can and should go. -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@...r.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
Powered by blists - more mailing lists