Messages in this thread | | | Date | Wed, 25 Jun 2014 20:20:12 +0200 | From | Oleg Nesterov <> | Subject | Re: [PATCH v8 9/9] seccomp: implement SECCOMP_FILTER_FLAG_TSYNC |
| |
On 06/25, Kees Cook wrote: > > On Wed, Jun 25, 2014 at 10:24 AM, Oleg Nesterov <oleg@redhat.com> wrote: > > > > However, do_execve() takes cred_guard_mutex at the start in prepare_bprm_creds() > > and drops it in install_exec_creds(), so it should solve the problem? > > I can't tell yet. I'm still trying to understand the order of > operations here. It looks like de_thread() takes the sighand lock. > do_execve_common does: > > prepare_bprm_creds (takes cred_guard_mutex) > check_unsafe_exec (checks nnp to set LSM_UNSAFE_NO_NEW_PRIVS) > prepare_binprm (handles suid escalation, checks nnp separately) > security_bprm_set_creds (checks LSM_UNSAFE_NO_NEW_PRIVS) > exec_binprm > load_elf_binary > flush_old_exec > de_thread (takes and releases sighand->lock) > install_exec_creds (releases cred_guard_mutex)
Yes, and note that when cred_guard_mutex is dropped all other threads are already killed,
> I don't see a way to use cred_guard_mutex during tsync (which holds > sighand->lock) without dead-locking. What were you considering here?
Just take/drop current->signal->cred_guard_mutex along with ->siglock in seccomp_set_mode_filter() ? Unconditionally on depending on SECCOMP_FILTER_FLAG_TSYNC.
Oleg.
| |