Messages in this thread |  | | | Date | Sun, 29 Mar 2009 05:10:22 +0100 | | From | Al Viro <> | | Subject | Re: Q: check_unsafe_exec() races (Was: [PATCH 2/4] fix setuid sometimes doesn't) |
| |
On Sun, Mar 29, 2009 at 01:53:43AM +0100, Oleg Nesterov wrote:
> Can't find the patch which introduced check_unsafe_exec(), so > I am asking here. > > How it is supposed to work? > > Let's suppose we have two threads T1 and T2. T1 exits, and calls > exit_fs(). > > exit_fs: > > tsk->fs = NULL; > // WINDOW > put_fs_struct(fs); > > Now, if T2 does exec() and check_unsafe_exec() happens in the WINDOW > above, we set LSM_UNSAFE_SHARE. > > Or we can race with sub-thread doing clone(CLONE_FS|CLONE_THREAD), > the new thread is not visible in ->thread_group, buy copy_fs() > can already increment fs->count.
Frankly, I don't think we really care. Note that having several sub-threads and doing execve() in one of them will kill the rest, so you really want to do some kind of synchronization to get something similar to reasonable behaviour anyway.
> Another question. Why do we check sighand->count? We always unshare > ->sighand on exec, see de_thread().
Correct. That check can and should go.
|  |