linux-kernel - setns() && PR_SET_CHILD

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20170123164420.GA2145@redhat.com>
Date:   Mon, 23 Jan 2017 17:44:20 +0100
From:   Oleg Nesterov <oleg@...hat.com>
To:     Pavel Tikhomirov <ptikhomirov@...tuozzo.com>,
        "Eric W. Biederman" <ebiederm@...ssion.com>,
        Lennart Poettering <lennart@...ttering.net>,
        Kay Sievers <kay.sievers@...y.org>
Cc:     Ingo Molnar <mingo@...hat.com>,
        Peter Zijlstra <peterz@...radead.org>,
        Andrew Morton <akpm@...ux-foundation.org>,
        Cyrill Gorcunov <gorcunov@...nvz.org>,
        John Stultz <john.stultz@...aro.org>,
        Thomas Gleixner <tglx@...utronix.de>,
        Nicolas Pitre <nicolas.pitre@...aro.org>,
        Michal Hocko <mhocko@...e.com>,
        Stanislav Kinsburskiy <skinsbursky@...tuozzo.com>,
        Mateusz Guzik <mguzik@...hat.com>,
        linux-kernel@...r.kernel.org,
        Pavel Emelyanov <xemul@...tuozzo.com>,
        Konstantin Khorenko <khorenko@...tuozzo.com>
Subject: setns() && PR_SET_CHILD_SUBREAPER

And this discussion reminds me again that I do not understand how setns()
and PR_SET_CHILD_SUBREAPER should play together... Add cc's.

Suppose we have a process P in the root namespace and another namespace X.

P does setns() and enters the X namespace.
P forks a child C.

C forks a grandchild G.
C exits.

The question is, where should we reparent the grandchild G? In the normal
case it will be reparented to X->child_reaper and this looks correct.

But lets suppose that P runs with the ->has_child_subreaper bit set. In
this case it will be reparented to P's sub-reaper or a global init, and
given that P can't control its ->has_child_subreaper flag this does not
look right to me.

I can make a simple patch but perhaps I missed something or we actually
want this (imo strange) behaviour?

Oleg.