linux-kernel - [PATCH] Document that PF_KTHREAD _is

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <YFYjOB1jpbqyNPAp@localhost.localdomain>
Date:   Sat, 20 Mar 2021 19:30:48 +0300
From:   Alexey Dobriyan <adobriyan@...il.com>
To:     akpm@...ux-foundation.org
Cc:     linux-kernel@...r.kernel.org, linux-api@...r.kernel.org
Subject: [PATCH] Document that PF_KTHREAD _is_ ABI

PF_KTHREAD value is visible via field number 9 of /proc/*/stat

	$ sudo cat /proc/2/stat
	2 (kthreadd) S 0 0 0 0 -1 2129984 0 ...
				  ^^^^^^^

It is used by at least systemd to check for kernel-threadness:
https://github.com/systemd/systemd/blob/main/src/basic/process-util.c#L354
src/basic/process-util.c:is_kernel_thread()

It means that the value can't be changed despite perceived notion that
task_struct flags are internal to kernel and can be shuffled at whim.

Formally, _all_ struct task_struct::flags PF_* values are kernel ABI
which is a disaster.

I hope we can mask everything but few flags and hope for the best :^)

Note for beginner Linux programmers:
every other way you find on the interwebs and Stack Overflow
for checking if pid belongs to a kernel thread is broken one way or
another.

Signed-off-by: Alexey Dobriyan <adobriyan@...il.com>
---

 include/linux/sched.h |    3 +++
 1 file changed, 3 insertions(+)

--- a/include/linux/sched.h
+++ b/include/linux/sched.h
@@ -1566,6 +1566,9 @@ extern struct pid *cad_pid;
 #define PF_MEMALLOC_NOIO	0x00080000	/* All allocation requests will inherit GFP_NOIO */
 #define PF_LOCAL_THROTTLE	0x00100000	/* Throttle writes only against the bdi I write to,
 						 * I am cleaning dirty pages from some other bdi. */
+/*
+ * PF_KTHREAD is part of kernel ABI, visible via value #9 in /proc/$pid/stat
+ */
 #define PF_KTHREAD		0x00200000	/* I am a kernel thread */
 #define PF_RANDOMIZE		0x00400000	/* Randomize virtual address space */
 #define PF_SWAPWRITE		0x00800000	/* Allowed to write to swap */