linux-kernel - Re: Allow signaling a process by all its thread ids?

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20090521235428.53b71862@lxorguk.ukuu.org.uk>
Date:	Thu, 21 May 2009 23:54:28 +0100
From:	Alan Cox <alan@...rguk.ukuu.org.uk>
To:	Simon Holm Thøgersen <odie@...aau.dk>
Cc:	linux-kernel <linux-kernel@...r.kernel.org>,
	Michael Kerrisk <mtk.manpages@...glemail.com>,
	Jean-Paul Calderone <exarkun@...stedmatrix.com>
Subject: Re: Allow signaling a process by all its thread ids?

> It may be that POSIX is weakly worded enough that either allowing or
> disallowing this behavior is valid.  I think that allowing it is a
> violation of POSIX, but I can find no single, explicit, direct statement
> in POSIX to back this up.

If there was a specific explicit statement it might be an argument to add
a separate poxix_kill(), but the existing kill(2) interface the kernel
has is API, its been that way forever and you need *very* strong reasons
to make such changes that might break things.

You need to show that
- The current API breaks stuff
- The current API is absolutely invalid in posix
- Changing it improves the functionality and power of the kernel
- Changing it doesn't break existing applications

> There is at least one other argument to disallow this behavior even if
> it is not technically illegal.  Consider the traditional, widespread
> convention of pid files.  This behavior drastically reduces their
> utility, as it greatly increases the chance of PID collisions, a case in
> which it is difficult to automatically (that is, without human
> intervention) recognize that a pid file no longer corresponds to a
> running process which created it.  This is the case in which I
> encountered the behavior - when it repeatedly caused services not to
> restart because they encountered a thread of another process and
> misinterpreted it to mean the service was already running.

Either your pid files are secure, or they are not. If collisions can
occur by accident I can cause them deliberately. If I can cause them
deliberately your system is insecure and you need to fix it.

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/