lkml.org 
[lkml]   [2018]   [Jan]   [17]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
From
Date
SubjectRe: [PATCH v2 1/3] Revert "do_SAK: Don't recursively take the tasklist_lock"
Oleg Nesterov <oleg@redhat.com> writes:

> On 01/17, Eric W. Biederman wrote:
>
>> Kirill Tkhai <ktkhai@virtuozzo.com> writes:
>>
>> > This reverts commit 20ac94378de5.
>> >
>> > send_sig() does not take tasklist_lock for a long time,
>> > so this commit and the problem it solves are not relevant
>> > anymore.
>> >
>> > Also, the problem of force_sig() is it clears SIGNAL_UNKILLABLE
>> > flag, thus even global init may be killed by __do_SAK(),
>> > which is definitely not the expected behavior.
>>
>> Actually it is.
>>
>> SAK should kill everything that has the tty open. If init opens the tty
>> I am so sorry, it can not operate correctly. init should not have your
>> tty open.
>
> OK, but then we need "force" in other places too. __do_SAK() does send_sig(SIGKILL)
> in do_each_pid_task(PIDTYPE_SID) and if signal->tty == tty.
>
> Plus force_sig() is not rcu-friendly.
>
> So I personally agree with this change. Whether we want to kill the global init
> or not should be discussed, if we want to do this __do_SAK() should use
> SEND_SIG_FORCED and this is what Kirill is going to do (iiuc), but this needs
> another patch.

To operate correctly, do_SAK() needs to kill everything that has the tty
open. Unless we can make that guarantee I don't see the point of
changing do_SAK.

It would be better to give up on do_SAK altogether than to keep do_SAK
limping along and failing to meet it's security guarantees.

If there are real world races, let's document those and say do_SAK has
been broken for X number of years and just remove it. Right now that
seems the more reasonable course.

Unless there truly is someone using do_SAK to ensure they have a tty all
to themselves.

Eric

\
 
 \ /
  Last update: 2018-01-18 00:21    [W:0.914 / U:0.088 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site