From mboxrd@z Thu Jan 1 00:00:00 1970 From: Enke Chen Subject: Re: [PATCH] kernel/signal: Signal-based pre-coredump notification Date: Mon, 15 Oct 2018 11:39:32 -0700 Message-ID: <5bbe7c70-d6a8-7b37-51d4-eed9a99bc7e1@cisco.com> References: <20181013104446.b3z26rwmiripqfks@gmail.com> Mime-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 7bit Return-path: In-Reply-To: <20181013104446.b3z26rwmiripqfks@gmail.com> Content-Language: en-US Sender: linux-kernel-owner@vger.kernel.org Cc: christian@brauner.io, Thomas Gleixner , Ingo Molnar , Borislav Petkov , "H. Peter Anvin" , x86@kernel.org, Peter Zijlstra , Arnd Bergmann , "Eric W. Biederman" , Khalid Aziz , Kate Stewart , Helge Deller , Greg Kroah-Hartman , Al Viro , Andrew Morton , Catalin Marinas , Will Deacon , Dave Martin , Mauro Carvalho Chehab , Michal Hocko , Rik van Riel List-Id: linux-arch.vger.kernel.org Hi, Christian: As I replied to Jann, I will remove the code that does the setting on others to make the code simpler and more secure. Thanks. -- Enke >> +static bool set_predump_signal_perm(struct task_struct *p) >> +{ >> + const struct cred *cred = current_cred(), *pcred = __task_cred(p); >> + >> + return uid_eq(pcred->uid, cred->euid) || >> + uid_eq(pcred->euid, cred->euid) || >> + capable(CAP_SYS_ADMIN); > > So before proceeding I'd like to discuss at least two points: > - how does this interact with the dumpability of a process? > - do we need the capable(CAP_SYS_ADMIN) restriction to init_user_ns? > Seems we could make this work per-user-ns just like > PRCTL_SET_PDEATHSIG does? > >> +} From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from alln-iport-8.cisco.com ([173.37.142.95]:52186 "EHLO alln-iport-8.cisco.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1726594AbeJPC0H (ORCPT ); Mon, 15 Oct 2018 22:26:07 -0400 Subject: Re: [PATCH] kernel/signal: Signal-based pre-coredump notification References: <20181013104446.b3z26rwmiripqfks@gmail.com> From: Enke Chen Message-ID: <5bbe7c70-d6a8-7b37-51d4-eed9a99bc7e1@cisco.com> Date: Mon, 15 Oct 2018 11:39:32 -0700 MIME-Version: 1.0 In-Reply-To: <20181013104446.b3z26rwmiripqfks@gmail.com> Content-Type: text/plain; charset=utf-8 Content-Language: en-US Content-Transfer-Encoding: 7bit Sender: linux-arch-owner@vger.kernel.org List-ID: Cc: christian@brauner.io, Thomas Gleixner , Ingo Molnar , Borislav Petkov , "H. Peter Anvin" , x86@kernel.org, Peter Zijlstra , Arnd Bergmann , "Eric W. Biederman" , Khalid Aziz , Kate Stewart , Helge Deller , Greg Kroah-Hartman , Al Viro , Andrew Morton , Catalin Marinas , Will Deacon , Dave Martin , Mauro Carvalho Chehab , Michal Hocko , Rik van Riel , "Kirill A. Shutemov" , Roman Gushchin , Marcos Paulo de Souza , Oleg Nesterov , Dominik Brodowski , Cyrill Gorcunov , Yang Shi , Jann Horn , Kees Cook , linux-kernel@vger.kernel.org, linux-arch@vger.kernel.org, "Victor Kamensky (kamensky)" , xe-linux-external@cisco.com, Stefan Strogin , Enke Chen Message-ID: <20181015183932.vTxOsA1RRGpq-mrl-ldFwmFCDtXN06Qpf8C-50ks6KE@z> Hi, Christian: As I replied to Jann, I will remove the code that does the setting on others to make the code simpler and more secure. Thanks. -- Enke >> +static bool set_predump_signal_perm(struct task_struct *p) >> +{ >> + const struct cred *cred = current_cred(), *pcred = __task_cred(p); >> + >> + return uid_eq(pcred->uid, cred->euid) || >> + uid_eq(pcred->euid, cred->euid) || >> + capable(CAP_SYS_ADMIN); > > So before proceeding I'd like to discuss at least two points: > - how does this interact with the dumpability of a process? > - do we need the capable(CAP_SYS_ADMIN) restriction to init_user_ns? > Seems we could make this work per-user-ns just like > PRCTL_SET_PDEATHSIG does? > >> +}