linux-kernel - Re: [PATCH] posix-timers: Prevent broadcast signals

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <87bme48w1l.fsf@xmission.com>
Date:   Fri, 27 Apr 2018 11:16:06 -0500
From:   ebiederm@...ssion.com (Eric W. Biederman)
To:     Sebastian Andrzej Siewior <bigeasy@...utronix.de>
Cc:     linux-kernel@...r.kernel.org, Thomas Gleixner <tglx@...utronix.de>
Subject: Re: [PATCH] posix-timers: Prevent broadcast signals

Sebastian Andrzej Siewior <bigeasy@...utronix.de> writes:

> From: Thomas Gleixner <tglx@...utronix.de>
>
> Posix timers should not send broadcast signals and kernel only
> signals. Prevent it.

You are not adding prevention of ``broadcast'' signals by preventing
sig_kernel_only and sig_kernel_coredump so your change description does
not make sense.

Second we are sending the signal to ourselves.  It may be silly to use
a timer to send SIGKILL or SIGSTOP but I can imagine some reasons.

For signals that might coredump if you setup a handler they won't
coredump so preventing those seems even sillier.

So what is the reason for changing which signals posix timers send?

If SIGEV_THREAD_ID is specificied I can understand not wanting
to send signals that could affect more than just a thread.

if SIGEV_THREAD is specified I can understand not wanting signals
that will do more than wake up the thread.  I presume glibc precreates
the thread.

Neither of those cases should apply to everything passing through
good_sigevent.  So your code is wrong if those are your justification.

Further the kernel is perfectly capable of delivering all types of
signal through send_sigqueue so there is no techincal reason for
preventing these signals.

Eric

> Signed-off-by: Thomas Gleixner <tglx@...utronix.de>
> Signed-off-by: Sebastian Andrzej Siewior <bigeasy@...utronix.de>
> ---
>  kernel/time/posix-timers.c | 4 +++-
>  1 file changed, 3 insertions(+), 1 deletion(-)
>
> diff --git a/kernel/time/posix-timers.c b/kernel/time/posix-timers.c
> index b6899b5060bd..4c4cbebb0d71 100644
> --- a/kernel/time/posix-timers.c
> +++ b/kernel/time/posix-timers.c
> @@ -435,6 +435,7 @@ static enum hrtimer_restart posix_timer_fn(struct hrtimer *timer)
>  static struct pid *good_sigevent(sigevent_t * event)
>  {
>  	struct task_struct *rtn = current->group_leader;
> +	int sig = event->sigev_signo;
>  
>  	switch (event->sigev_notify) {
>  	case SIGEV_SIGNAL | SIGEV_THREAD_ID:
> @@ -444,7 +445,8 @@ static struct pid *good_sigevent(sigevent_t * event)
>  		/* FALLTHRU */
>  	case SIGEV_SIGNAL:
>  	case SIGEV_THREAD:
> -		if (event->sigev_signo <= 0 || event->sigev_signo > SIGRTMAX)
> +		if (sig <= 0 || sig > SIGRTMAX ||
> +		    sig_kernel_only(sig) || sig_kernel_coredump(sig))
>  			return NULL;
>  		/* FALLTHRU */
>  	case SIGEV_NONE: