lkml.org 
[lkml]   [2009]   [Mar]   [29]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    Date
    From
    SubjectRe: Q: check_unsafe_exec() races (Was: [PATCH 2/4] fix setuid sometimes doesn't)
    On Sun, Mar 29, 2009 at 06:52:06AM +0200, Oleg Nesterov wrote:

    > Let's suppose that check_unsafe_exec() does not set LSM_UNSAFE_SHARE and
    > drops ->siglock. After that, another sub-thread does clone(CLONE_FS) without
    > CLONE_THREAD.

    Lovely. And yes, AFAICS that's a hole.

    > Unless we killed other threads, I can't see how we can check ->fs is not
    > shared with another process, we can fool ->bprm_set_creds() anyway.

    We can't do that, until we are past the point of no return. Charming...
    In principle, we can mark these threads as "-EAGAIN on such clone()" and
    clean that on exec failure.


    \
     
     \ /
      Last update: 2009-03-29 07:59    [W:0.024 / U:29.800 seconds]
    ©2003-2016 Jasper Spaans. hosted at Digital OceanAdvertise on this site