linux-kernel - Re: [PATCH] signal: don't silently convert SI

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20190417130336.i55vmf3x6cby2mvi@brauner.io>
Date:   Wed, 17 Apr 2019 15:03:37 +0200
From:   Christian Brauner <christian@...uner.io>
To:     Oleg Nesterov <oleg@...hat.com>
Cc:     Jann Horn <jannh@...gle.com>,
        "Eric W. Biederman" <ebiederm@...ssion.com>,
        Arnd Bergmann <arnd@...db.de>,
        Thomas Gleixner <tglx@...utronix.de>,
        linux-kernel@...r.kernel.org
Subject: Re: [PATCH] signal: don't silently convert SI_USER signals to
 non-current pidfd

On Mon, Apr 08, 2019 at 03:13:16PM +0200, Oleg Nesterov wrote:
> On 03/30, Jann Horn wrote:
> >
> > --- a/kernel/signal.c
> > +++ b/kernel/signal.c
> > @@ -3605,16 +3605,11 @@ SYSCALL_DEFINE4(pidfd_send_signal, int, pidfd, int, sig,
> >  		if (unlikely(sig != kinfo.si_signo))
> >  			goto err;
> >
> > +		/* Only allow sending arbitrary signals to yourself. */
> > +		ret = -EPERM;
> >  		if ((task_pid(current) != pid) &&
> > -		    (kinfo.si_code >= 0 || kinfo.si_code == SI_TKILL)) {
> > -			/* Only allow sending arbitrary signals to yourself. */
> > -			ret = -EPERM;
> > -			if (kinfo.si_code != SI_USER)
> > -				goto err;
> > -
> > -			/* Turn this into a regular kill signal. */
> > -			prepare_kill_siginfo(sig, &kinfo);
> > -		}
> > +		    (kinfo.si_code >= 0 || kinfo.si_code == SI_TKILL))
> > +			goto err;
> 
> ACK.
> 

Sorry Oleg. I missed that message somehow.
> 
> but perhaps it should always fail, even if task_pid(current) == pid.
> 
> sys_rt_sigqueueinfo() allows to send any siginfo to yourself, but this is only needed
> for checkpoint/restart.

Yes, that's why this was added. I would leave it in exactly because of
checkpoint/restart. I have sympathies for "this [...] project by various
mad Russians" [1] and it doesn't really hurt us. :)

[1]: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=099469502f62fbe0d7e4f0b83a2f22538367f734

Christian