Messages in this thread |  | | | Date | Sun, 29 Mar 2009 06:55:13 +0100 | | From | Al Viro <> | | Subject | Re: Q: check_unsafe_exec() races (Was: [PATCH 2/4] fix setuid sometimes doesn't) |
| |
On Sun, Mar 29, 2009 at 06:52:06AM +0200, Oleg Nesterov wrote:
> Let's suppose that check_unsafe_exec() does not set LSM_UNSAFE_SHARE and > drops ->siglock. After that, another sub-thread does clone(CLONE_FS) without > CLONE_THREAD.
Lovely. And yes, AFAICS that's a hole.
> Unless we killed other threads, I can't see how we can check ->fs is not > shared with another process, we can fool ->bprm_set_creds() anyway.
We can't do that, until we are past the point of no return. Charming... In principle, we can mark these threads as "-EAGAIN on such clone()" and clean that on exec failure.
|  |