Messages in this thread | | | From | KOSAKI Motohiro <> | Subject | Re: [PATCH] exit: PR_SET_ANCHOR for marking processes as reapers for child processes | Date | Thu, 11 Mar 2010 16:56:45 +0900 (JST) |
| |
> Lennart Poettering <mzxreary@0pointer.de> writes: > > > On Thu, 04.03.10 15:08, Oleg Nesterov (oleg@redhat.com) wrote: > > > >> Should we clear ->child_anchor flags when the "sub-init" execs? Or, > >> at least, when the task changes its credentials? Probably not, but > >> dunno. > > > > Since this flag is only useful for a very well defined type of processes > > (i.e. session managers, supervising daemons, init systems) it might make > > sense to reset it automatically when privs are dropped or we exec > > something. After all, I don't see how we'd gain any useful functionality > > when we allow this flag to continue to be set. However we would > > certainly be on the safer side when we reset it, because that way it can > > never leak it to processes that are differently privileged or do not > > expect it. > > > > So, for the sake of being on the safe side, I think we should reset the > > flag on exec()/setuid(). > > > >> It is a bit strange that PR_SET_ANCHOR acts per-thread, not per > >> process. > > > > Yes, I agree, this should be per-process indeed. > > Have you take a look at the pid namespace? > > Except for the fact it requires privilege to create it seems to do > what you want. It is certainly what I have been using when I want > an inescapable environment. > > If nothing else I get the feeling that what you are after is > a generalization of the child_reaper feature in the pid namespace > and yet you haven't touched any of that code.
I guess it doesn't fit for gnome-session. because gtop or similar system monitoring process assume it can see all processes in the system.
thanks.
| |