netdev - Re: [PATCH v2] connector: add an event for monitoring process tracers

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20110718175458.GA12840@redhat.com>
Date:	Mon, 18 Jul 2011 19:54:58 +0200
From:	Oleg Nesterov <oleg@...hat.com>
To:	Vladimir Zapolskiy <vzapolskiy@...il.com>
Cc:	netdev@...r.kernel.org, Evgeniy Polyakov <zbr@...emap.net>,
	"David S. Miller" <davem@...emloft.net>
Subject: Re: [PATCH v2] connector: add an event for monitoring process
	tracers

On 07/15, Vladimir Zapolskiy wrote:
>
> Such an event allows to create a simple automated userspace mechanism
> to be aware about processes connecting to others, therefore predefined
> process policies can be applied to them if needed.

I'd wish I could understand this ;) IOW, I still do not understand why
this is useful, but this doesn't matter. Since Evgeniy acked this patch,
I'll apply it to ptrace tree.

Can't resist, a couple of very minor/cosmetics nits. Just because I am
blighter ;)

> +void proc_ptrace_connector(struct task_struct *task, int which_id);

"which_id" doesn't match "ptrace_id" used elsewhere. And PTRACE_ATTACH
instead of simple boolean looks as if you are going to add more ptrace
events, but I guess this won't happen.

> -	if (!retval)
> +	if (!retval) {
>  		wait_on_bit(&task->jobctl, JOBCTL_TRAPPING_BIT,
>  			    ptrace_trapping_sleep_fn, TASK_UNINTERRUPTIBLE);
> +		proc_ptrace_connector(task, PTRACE_ATTACH);
> +	}

OK, but it is a bit strange we are waiting for STOPPED/TRACED transition
before we report PROC_EVENT_PTRACE. Perhaps it makes more sense to
call proc_ptrace_connector() first, this also decreases the probability
PTRACE_ATTACH will be reported after PROC_EVENT_EXIT.

But once again, this is very minor and cosmetic. I am going to apply
the patch as is unless you send v3 quickly.

Oleg.

--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html