From: Oleg Nesterov <oleg@redhat.com>
To: Christian Brauner <brauner@kernel.org>
Cc: Andy Lutomirski <luto@amacapital.net>,
"Eric W. Biederman" <ebiederm@xmission.com>,
Tycho Andersen <tycho@tycho.pizza>,
linux-api@vger.kernel.org, linux-kernel@vger.kernel.org
Subject: Re: [PATCH v2 2/2] pidfd: change pidfd_send_signal() to respect PIDFD_THREAD
Date: Tue, 20 Feb 2024 12:00:12 +0100 [thread overview]
Message-ID: <20240220110012.GB7783@redhat.com> (raw)
In-Reply-To: <20240220-pragmatisch-parzelle-8a1d10a94fae@brauner>
On 02/20, Christian Brauner wrote:
>
> On Tue, Feb 20, 2024 at 10:02:56AM +0100, Oleg Nesterov wrote:
> >
> > Ah. IIRC criu uses this hack to restore the pending (arbitrary) signals
> > collected at dump time.
> >
> > I was a bit surprise sys_pidfd_send_signal() allows this hack too, I don't
>
> I think that we simply mirrored the restrictions in the other system
> calls.
>
> > think that criu uses pidfd at restore time, but I do not know.
>
> Hm, I just checked and it doesn't use pidfd_send_signal(). It uses
> pidfds but only for pid reuse detection for RPC clients.
But perhaps something else already uses pidfd_send_signal() with info != NULL
or with info->si_code == SI_USER, we can't know. Please see below.
> So right now si_code is blocked for >= 0 and for SI_TKILL. If we were to
> simply ensure that si_code can't be < 0 then this amounts to effectively
> blocking @info from being filled in by userspace at all. Because 0 is a
> valid value.
I'am afraid I misunderstand you again... 0 == SI_USER is not a valid value
when siginfo != NULL.
Perhaps we can kill the "task_pid(current) != pid" check and just return
EPERM if "kinfo.si_code >= 0 || kinfo.si_code == SI_TKILL", I don't think
anobody needs pidfd_send_send_signal() to signal yourself. See below.
> + /* Currently unused. */
> + if (info)
> + return -EINVAL;
Well, to me this looks like the unnecessary restriction... And why?
But whatever we do,
> - /* Only allow sending arbitrary signals to yourself. */
> - ret = -EPERM;
> - if ((task_pid(current) != pid) &&
> - (kinfo.si_code >= 0 || kinfo.si_code == SI_TKILL))
> - goto err;
Can I suggest to fix this check in your tree (add type > PIDTYPE_TGID as
we discussed) first, then do other changes on top?
This way we can revert the next change(s) if we get regressions reports
without re-introducing the security problem.
Oleg.
next prev parent reply other threads:[~2024-02-20 11:01 UTC|newest]
Thread overview: 37+ messages / expand[flat|nested] mbox.gz Atom feed top
2024-02-09 13:06 [PATCH v2 1/2] signal: add the "int si_code" arg to prepare_kill_siginfo() Oleg Nesterov
2024-02-09 13:06 ` [PATCH v2 2/2] pidfd: change pidfd_send_signal() to respect PIDFD_THREAD Oleg Nesterov
2024-02-09 15:11 ` Christian Brauner
2024-02-09 15:15 ` Christian Brauner
2024-02-09 15:43 ` Oleg Nesterov
2024-02-09 15:49 ` Christian Brauner
2024-02-09 15:56 ` Oleg Nesterov
2024-02-10 10:23 ` Christian Brauner
2024-02-10 12:30 ` Oleg Nesterov
2024-02-10 12:47 ` Oleg Nesterov
2024-02-10 12:54 ` Christian Brauner
2024-02-10 13:15 ` Oleg Nesterov
2024-02-10 14:26 ` Christian Brauner
2024-02-10 16:51 ` Oleg Nesterov
2024-02-10 17:22 ` Christian Brauner
2024-02-14 12:36 ` Oleg Nesterov
2024-02-16 12:28 ` Christian Brauner
2024-02-16 13:06 ` Oleg Nesterov
2024-02-16 14:46 ` Christian Brauner
2024-02-16 18:12 ` Oleg Nesterov
2024-02-20 8:34 ` Christian Brauner
2024-02-20 9:02 ` Oleg Nesterov
2024-02-20 9:22 ` Christian Brauner
2024-02-20 11:00 ` Oleg Nesterov [this message]
2024-02-20 12:59 ` Christian Brauner
2024-02-20 16:22 ` Oleg Nesterov
2024-02-21 7:42 ` Christian Brauner
2024-02-21 12:55 ` Oleg Nesterov
2024-02-21 13:35 ` Christian Brauner
2024-02-09 19:08 ` Tycho Andersen
2024-02-09 15:10 ` [PATCH v2 1/2] signal: add the "int si_code" arg to prepare_kill_siginfo() Christian Brauner
2024-02-09 16:13 ` Christian Brauner
2024-02-09 16:22 ` Eric W. Biederman
2024-02-09 16:39 ` Oleg Nesterov
2024-02-09 19:36 ` Christian Brauner
2024-02-09 19:53 ` Oleg Nesterov
2024-02-09 20:01 ` Tycho Andersen
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20240220110012.GB7783@redhat.com \
--to=oleg@redhat.com \
--cc=brauner@kernel.org \
--cc=ebiederm@xmission.com \
--cc=linux-api@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=luto@amacapital.net \
--cc=tycho@tycho.pizza \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).