linux-kernel - Re: Re: [PATCH] connector: report comm change event when modifying /proc/pid/task/tid/comm

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20190917135628.3054-1-shikemeng@huawei.com>
Date:   Tue, 17 Sep 2019 09:56:28 -0400
From:   KeMeng Shi <shikemeng@...wei.com>
To:     <will@...nel.org>, <akpm@...ux-foundation.org>,
        <james.morris@...rosoft.com>, <gregkh@...uxfoundation.org>,
        <mortonm@...omium.org>, <will.deacon@....com>,
        <kristina.martsenko@....com>, <yuehaibing@...wei.com>,
        <malat@...ian.org>, <j.neuschaefer@....net>
CC:     <linux-kernel@...r.kernel.org>
Subject: Re: Re: [PATCH] connector: report comm change event when modifying /proc/pid/task/tid/comm

on 2019/9/17 at 5:10, Will Deacon wrote:
>The rough idea looks ok to me but I have two concerns:
>
>  (1) This looks like it will be visible to userspace, and this changes
>      the behaviour after ~8 years of not reporting this event.
This do bother for users who only care the comm change via prctl, but it
also benefits users who want all comm changes. Maybe the best way is add
something like config or switch to meet the both conditions above. In my
opinion, users cares comm change event rather than how it change.

>(2) What prevents proc_comm_connector(p) running concurrently with itself
> via the prctl()? The locking seems to be confined to set_task_comm().
To be honest, I did not consider the concurrence problem at beginning. And
some comm change events may lost or are reported repeatly as follows:
set name via procfs	set name via prctl
set_task_comm
			set_task_comm
proc_comm_connector
			proc_comm_connector
Comm change event belong to procfs losts and the fresh comm change belong
to prctl is reported twice. Actually, there is also concurrence problem
without this update as follows:
set name via procfs	set name via prctl
			set_task_comm
set_task_comm
			proc_comm_connector
Comm change event from procfs is reported instead of prctl, this may
bothers user who only care the comm change via prctl.

There is no matter if user only care the latest comm change otherwise, put
setting name and reporting event in crtical region may be the only answer.

I'm sorry the response to (1) concern is missing in last mail. This is a
full version. Apologize again for my mistake.

Thanks for review.
KeMeng Shi