lkml.org 
[lkml]   [2009]   [Mar]   [29]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
SubjectRe: Q: check_unsafe_exec() races (Was: [PATCH 2/4] fix setuid sometimes doesn't)
On Sun, Mar 29, 2009 at 06:52:06AM +0200, Oleg Nesterov wrote:

> Let's suppose that check_unsafe_exec() does not set LSM_UNSAFE_SHARE and
> drops ->siglock. After that, another sub-thread does clone(CLONE_FS) without
> CLONE_THREAD.

Lovely. And yes, AFAICS that's a hole.

> Unless we killed other threads, I can't see how we can check ->fs is not
> shared with another process, we can fool ->bprm_set_creds() anyway.

We can't do that, until we are past the point of no return. Charming...
In principle, we can mark these threads as "-EAGAIN on such clone()" and
clean that on exec failure.


\
 
 \ /
  Last update: 2009-03-29 07:59    [from the cache]
©2003-2014 Jasper Spaans. Advertise on this site