Messages in this thread | | | From | (Eric W. Biederman) | Date | Wed, 17 Jan 2018 11:49:31 -0600 | Subject | Re: [PATCH v2 1/3] Revert "do_SAK: Don't recursively take the tasklist_lock" |
| |
Oleg Nesterov <oleg@redhat.com> writes:
> On 01/17, Eric W. Biederman wrote: > >> Kirill Tkhai <ktkhai@virtuozzo.com> writes: >> >> > This reverts commit 20ac94378de5. >> > >> > send_sig() does not take tasklist_lock for a long time, >> > so this commit and the problem it solves are not relevant >> > anymore. >> > >> > Also, the problem of force_sig() is it clears SIGNAL_UNKILLABLE >> > flag, thus even global init may be killed by __do_SAK(), >> > which is definitely not the expected behavior. >> >> Actually it is. >> >> SAK should kill everything that has the tty open. If init opens the tty >> I am so sorry, it can not operate correctly. init should not have your >> tty open. > > OK, but then we need "force" in other places too. __do_SAK() does send_sig(SIGKILL) > in do_each_pid_task(PIDTYPE_SID) and if signal->tty == tty. > > Plus force_sig() is not rcu-friendly. > > So I personally agree with this change. Whether we want to kill the global init > or not should be discussed, if we want to do this __do_SAK() should use > SEND_SIG_FORCED and this is what Kirill is going to do (iiuc), but this needs > another patch.
To operate correctly, do_SAK() needs to kill everything that has the tty open. Unless we can make that guarantee I don't see the point of changing do_SAK.
It would be better to give up on do_SAK altogether than to keep do_SAK limping along and failing to meet it's security guarantees.
If there are real world races, let's document those and say do_SAK has been broken for X number of years and just remove it. Right now that seems the more reasonable course.
Unless there truly is someone using do_SAK to ensure they have a tty all to themselves.
Eric
| |