linux-kernel - Re: [PATCH] Document that PF_KTHREAD _is

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Sat, 20 Mar 2021 10:23:12 -0700
From:   Andy Lutomirski <luto@...nel.org>
To:     Alexey Dobriyan <adobriyan@...il.com>
Cc:     Andrew Morton <akpm@...ux-foundation.org>,
        LKML <linux-kernel@...r.kernel.org>,
        Linux API <linux-api@...r.kernel.org>
Subject: Re: [PATCH] Document that PF_KTHREAD _is_ ABI

> On Mar 20, 2021, at 9:31 AM, Alexey Dobriyan <adobriyan@...il.com> wrote:
>
> PF_KTHREAD value is visible via field number 9 of /proc/*/stat
>
>    $ sudo cat /proc/2/stat
>    2 (kthreadd) S 0 0 0 0 -1 2129984 0 ...
>                  ^^^^^^^
>
> It is used by at least systemd to check for kernel-threadness:
> https://github.com/systemd/systemd/blob/main/src/basic/process-util.c#L354
> src/basic/process-util.c:is_kernel_thread()

Eww.

Could we fix it differently and more permanently by modifying the proc
code to display the values systemd expects?


>
> It means that the value can't be changed despite perceived notion that
> task_struct flags are internal to kernel and can be shuffled at whim.
>
> Formally, _all_ struct task_struct::flags PF_* values are kernel ABI
> which is a disaster.
>
> I hope we can mask everything but few flags and hope for the best :^)
>
> Note for beginner Linux programmers:
> every other way you find on the interwebs and Stack Overflow
> for checking if pid belongs to a kernel thread is broken one way or
> another.
>
> Signed-off-by: Alexey Dobriyan <adobriyan@...il.com>
> ---
>
> include/linux/sched.h |    3 +++
> 1 file changed, 3 insertions(+)
>
> --- a/include/linux/sched.h
> +++ b/include/linux/sched.h
> @@ -1566,6 +1566,9 @@ extern struct pid *cad_pid;
> #define PF_MEMALLOC_NOIO    0x00080000    /* All allocation requests will inherit GFP_NOIO */
> #define PF_LOCAL_THROTTLE    0x00100000    /* Throttle writes only against the bdi I write to,
>                         * I am cleaning dirty pages from some other bdi. */
> +/*
> + * PF_KTHREAD is part of kernel ABI, visible via value #9 in /proc/$pid/stat
> + */
> #define PF_KTHREAD        0x00200000    /* I am a kernel thread */
> #define PF_RANDOMIZE        0x00400000    /* Randomize virtual address space */
> #define PF_SWAPWRITE        0x00800000    /* Allowed to write to swap */