linux-kernel - Re: Syscall kill() can send signal to thread ID

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Fri, 23 Sep 2022 07:31:35 +0200
From:   Florian Weimer <fweimer@...hat.com>
To:     "Eric W. Biederman" <ebiederm@...ssion.com>
Cc:     cambda@...ux.alibaba.com, linux-kernel@...r.kernel.org,
        linux-api@...r.kernel.org, Xuan Zhuo <xuanzhuo@...ux.alibaba.com>,
        Dust Li <dust.li@...ux.alibaba.com>,
        Tony Lu <tonylu@...ux.alibaba.com>
Subject: Re: Syscall kill() can send signal to thread ID

* Eric W. Biederman:

> cambda@...ux.alibaba.com writes:
>
>> I found syscall kill() can send signal to a thread id, which is
>> not the TGID. But the Linux manual page kill(2) said:
>>
>> "The kill() system call can be used to send any signal to any
>> process group or process."
>>
>> And the Linux manual page tkill(2) said:
>>
>> "tgkill() sends the signal sig to the thread with the thread ID
>> tid in the thread group tgid.  (By contrast, kill(2) can be used
>> to send a signal only to a process (i.e., thread group) as a
>> whole, and the signal will be delivered to an arbitrary thread
>> within that process.)"
>>
>> I don't know whether the meaning of this 'process' should be
>> the TGID? Because I found kill(tid, 0) will return ESRCH on FreeBSD,
>> while Linux sends signal to the thread group that the thread belongs
>> to.
>>
>> If this is as expected, should we add a notice to the Linux manual
>> page? Because it's a syscall and the pids not equal to tgid are not
>> listed under /proc. This may be a little confusing, I guess.
>
> This is as expected.
>
> The bit about is /proc is interesting.  On linux try
> "cd /proc; cd tid" and see what happens.
>
> Using the thread id in kill(2) is used to select the process, and the
> delivery happens just the same as if the TGID had been used.
>
> It is one of those odd behaviors that we could potentially remove.  It
> would require hunting through all of the userspace applications to see
> if something happens to depend upon that behavior.  Unless it becomes
> expensive to maintain I don't expect we will ever do that.

It would just replace one odd behavior by another because kill for the
TID of the main thread will still send the signal to the entire process
(because the TID is equal to the PID), but for the other threads, it
would just send it to the thread.  So it would still be inconsistent.

Thanks,
Florian