linux-kernel - Re: [PATCH] proc: allow killing processes via file descriptors (Larger pids)

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <875zwt2fvr.fsf_-_@xmission.com>
Date:   Mon, 19 Nov 2018 10:26:00 -0600
From:   ebiederm@...ssion.com (Eric W. Biederman)
To:     Dmitry Safonov <0x7f454c46@...il.com>
Cc:     Andy Lutomirski <luto@...nel.org>, dancol@...gle.com,
        rdunlap@...radead.org, christian@...uner.io,
        open list <linux-kernel@...r.kernel.org>,
        Serge Hallyn <serge@...lyn.com>, jannh@...gle.com,
        Andrew Morton <akpm@...ux-foundation.org>,
        Oleg Nesterov <oleg@...hat.com>, cyphar@...har.com,
        Al Viro <viro@...iv.linux.org.uk>,
        linux-fsdevel@...r.kernel.org,
        Linux API <linux-api@...r.kernel.org>, timmurray@...gle.com,
        Kees Cook <keescook@...omium.org>, jengelh@...i.de,
        Andrei Vagin <avagin@...il.com>
Subject: Re: [PATCH] proc: allow killing processes via file descriptors (Larger pids)

Dmitry Safonov <0x7f454c46@...il.com> writes:
>
> So, I just wanted to gently remind about procfs with netlink socket[1].
> It seems to me that whenever you receive() pid information, you
> can request some uniq 64(?) bit number and kill the process using it.
> Whenever uniqueness of 64-bit number to handle pids will be a question
> the netlink message might be painlessly extended to 128 or whatever.

No.

I have seen this requested twice in this thread now, and despite
understanding where everyone is coming from I do not believe it will
be wise to implement larger pids.

The problem is that we then have to make these larger pids live in
the pid namespace, make struct pid larger to hold them and update
CRIU to save and restore them.

All for a very small handful of processes that use this extended API.

Eric