Re: [PATCH V2 1/2] exec: don't wait for zombie threads with cred_guard_mutex held

From	ebiederm@xmission.com (Eric W. Biederman)
Newsgroups	linux.kernel
Subject	Re: [PATCH V2 1/2] exec: don't wait for zombie threads with cred_guard_mutex held
Date	2017-02-20 23:40 +0100
Message-ID	<td4MG-2a7-17@gated-at.bofh.it> (permalink)
References	<tapDY-4My-5@gated-at.bofh.it> <tapDY-4My-19@gated-at.bofh.it> <tatey-7cr-21@gated-at.bofh.it> <tbsJs-5E4-17@gated-at.bofh.it> <tcY4y-6nx-11@gated-at.bofh.it>
Organization	linux.* mail to news gateway

Show all headers | View raw

Oleg,

My apologies for not replying in-line but I think I can be clearer just
saying what I think needs to be said.

Today cred_guard_mutex is part of making exec appear to be an atomic
operation to ptrace and and proc.  To make exec appear to be atomic
we do need to take the mutex at the beginning and release it at the end
of exec.

The semantics of exec appear atomic to ptrace_attach and to proc readers
are necessary to ensure we use the proper process credentials in the
event of a suid exec.

I believe making cred_guard_mutex per task is an option.  Reducing the
scope of cred_guard_mutex concerns me.  There appear to be some fields
like sighand that we currently expose in proc that might possibly be
problematic.  So I am not certain we protect enough things in our proc
accessors.

Do you know if we can make cred_guard_mutex a per-task lock again?

Eric

Thread

Re: [PATCH V2 1/2] exec: don't wait for zombie threads with cred_guard_mutex held ebiederm@xmission.com (Eric W. Biederman) - 2017-02-16 12:50 +0100
  Re: [PATCH V2 1/2] exec: don't wait for zombie threads with         cred_guard_mutex held Oleg Nesterov <oleg@redhat.com> - 2017-02-20 16:30 +0100
    Re: [PATCH V2 1/2] exec: don't wait for zombie threads with         cred_guard_mutex held Oleg Nesterov <oleg@redhat.com> - 2017-02-20 16:40 +0100
    Re: [PATCH V2 1/2] exec: don't wait for zombie threads with cred_guard_mutex held ebiederm@xmission.com (Eric W. Biederman) - 2017-02-20 23:40 +0100
      Re: [PATCH V2 1/2] exec: don't wait for zombie threads with         cred_guard_mutex held Oleg Nesterov <oleg@redhat.com> - 2017-02-21 19:00 +0100
        Re: [PATCH V2 1/2] exec: don't wait for zombie threads with cred_guard_mutex held ebiederm@xmission.com (Eric W. Biederman) - 2017-02-21 21:30 +0100
          Re: [PATCH V2 1/2] exec: don't wait for zombie threads with         cred_guard_mutex held Oleg Nesterov <oleg@redhat.com> - 2017-02-22 19:10 +0100

csiph-web