linux-kernel - Re: Re: [PATCH] connector: report comm change event when modifying /proc/pid/task/tid/comm

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Tue, 17 Sep 2019 18:07:38 +0100
From:   Will Deacon <will@...nel.org>
To:     KeMeng Shi <shikemeng@...wei.com>
Cc:     akpm@...ux-foundation.org, james.morris@...rosoft.com,
        gregkh@...uxfoundation.org, mortonm@...omium.org,
        will.deacon@....com, kristina.martsenko@....com,
        yuehaibing@...wei.com, malat@...ian.org, j.neuschaefer@....net,
        linux-kernel@...r.kernel.org
Subject: Re: Re: [PATCH] connector: report comm change event when modifying
 /proc/pid/task/tid/comm

On Tue, Sep 17, 2019 at 09:56:28AM -0400, KeMeng Shi wrote:
> on 2019/9/17 at 5:10, Will Deacon wrote:
> >The rough idea looks ok to me but I have two concerns:
> >
> >  (1) This looks like it will be visible to userspace, and this changes
> >      the behaviour after ~8 years of not reporting this event.
> This do bother for users who only care the comm change via prctl, but it
> also benefits users who want all comm changes. Maybe the best way is add
> something like config or switch to meet the both conditions above. In my
> opinion, users cares comm change event rather than how it change.

I was really just looking for some intuition as to how this event is
currently used and why extending it like this is unlikely to break those
existing users.

> >(2) What prevents proc_comm_connector(p) running concurrently with itself
> > via the prctl()? The locking seems to be confined to set_task_comm().
> To be honest, I did not consider the concurrence problem at beginning. And
> some comm change events may lost or are reported repeatly as follows:
> set name via procfs	set name via prctl
> set_task_comm
> 			set_task_comm
> proc_comm_connector
> 			proc_comm_connector
> Comm change event belong to procfs losts and the fresh comm change belong
> to prctl is reported twice. Actually, there is also concurrence problem
> without this update as follows:
> set name via procfs	set name via prctl
> 			set_task_comm
> set_task_comm
> 			proc_comm_connector
> Comm change event from procfs is reported instead of prctl, this may
> bothers user who only care the comm change via prctl.

Perhaps, although given that proc_comm_connector() is currently only called
on the prctl() path, then it does at least provide the comm from the most
recent prctl() invocation. With your path, the calls can go out of order,
so I think that probably needs fixing.

Will