Some question about "security context of a task"

Some question about "security context of a task"

[loody]

hi all:
I found there is a user_struct, user, located at struct cred.
is it possible be null?
My platform sometimes panic when using kernel_thread to creating a
thread for running.

below is the place it happen

if (atomic_read(&p->real_cred->user->processes) >=
             p->signal->rlim[RLIMIT_NPROC].rlim_cur) {
after checking the parameter, I found p->real_cred->user is NULL.

When and how we allocate/destroy this parameter?
Does that mean we should some basic check before calling kernel_thread?

-- 
Regards,

Some question about "security context of a task"

[Mulyadi Santosa]

Hi....

On Wed, Feb 1, 2012 at 14:12, loody <miloody@gmail.com> wrote:
> below is the place it happen
>
> if (atomic_read(&p->real_cred->user->processes) >=
> ? ? ? ? ? ? p->signal->rlim[RLIMIT_NPROC].rlim_cur) {

Seems like a normal user limit checking...the one we usually set via
"ulimit" command. Checking number of processes to be precise...

> after checking the parameter, I found p->real_cred->user is NULL.

hm, IMHO if it exceeds ulimit, the process creation should just stop.
Not sure why read_cred->user becomes NULL. Maybe that's for clean up,
since later process will be terminated?

-- 
regards,

Mulyadi Santosa
Freelance Linux trainer and consultant

blog: the-hydra.blogspot.com
training: mulyaditraining.blogspot.com

Some question about "security context of a task"

[loody]

hi Mulyadi:

2012/2/1 Mulyadi Santosa <mulyadi.santosa@gmail.com>:
> Hi....
>
> On Wed, Feb 1, 2012 at 14:12, loody <miloody@gmail.com> wrote:
>> below is the place it happen
>>
>> if (atomic_read(&p->real_cred->user->processes) >=
>> ? ? ? ? ? ? p->signal->rlim[RLIMIT_NPROC].rlim_cur) {
>
> Seems like a normal user limit checking...the one we usually set via
> "ulimit" command. Checking number of processes to be precise...
>
>> after checking the parameter, I found p->real_cred->user is NULL.
>
> hm, IMHO if it exceeds ulimit, the process creation should just stop.
Yes, I think you are right.

> Not sure why read_cred->user becomes NULL. Maybe that's for clean up,
> since later process will be terminated?

The "later process" you mean is the caller?
please let me describe my environment more detail.
1. when outside event happen
2. calling driver's probe.
3. I use kernel_thread to create a thread in probe function.
Then the sequence seems like:
kernel_thread
  -> do_fork
  -> copy_process
  ..........
  p = dup_task_struct(current);
  /*The user_struct user is inherited from current.*/
  ...........
if (atomic_read(&p->real_cred->user->processes) >=
 ? ? ? ? ? ? p->signal->rlim[RLIMIT_NPROC].rlim_cur) {
.......

Then it panic.
1. why kernel thread need user_struct
2. is it use for kernel thread to record how may user mode program it created?

Thanks for your help,