From mboxrd@z Thu Jan 1 00:00:00 1970 From: Jann Horn Subject: Re: [PATCH] kernel/signal: Signal-based pre-coredump notification Date: Mon, 22 Oct 2018 17:40:28 +0200 Message-ID: References: <2631f765-8d7a-45ea-6aa4-d8a9bb00d56f@cisco.com> Mime-Version: 1.0 Content-Type: text/plain; charset="UTF-8" Return-path: In-Reply-To: <2631f765-8d7a-45ea-6aa4-d8a9bb00d56f@cisco.com> Sender: linux-kernel-owner@vger.kernel.org To: enkechen@cisco.com Cc: Thomas Gleixner , Ingo Molnar , Borislav Petkov , "H . Peter Anvin" , the arch/x86 maintainers , Peter Zijlstra , Arnd Bergmann , "Eric W. Biederman" , Khalid Aziz , Kate Stewart , deller@gmx.de, Greg Kroah-Hartman , Al Viro , Andrew Morton , christian@brauner.io, Catalin Marinas , Will Deacon , Dave.Martin@arm.com, mchehab+samsung@kernel.org, Michal Hocko , Rik van Riel , "Kirill A . Shutemov" List-Id: linux-arch.vger.kernel.org On Sat, Oct 20, 2018 at 1:01 AM Enke Chen wrote: > Regarding the security considerations, it seems simpler and more secure to > just clear the "pre-coredump signal" cross execve(2), and let the new program > decide for itself. What do you think? I don't have a problem with these semantics. I could imagine someone being unhappy about the theoretical race window if they want to perform an in-place reexecution of a running service, but I don't know whether anyone actually cares about that. > Changes to prctl(2): > > DESCRIPTION > > PR_SET_PREDUMP_SIG (since Linux 4.20.x) > This allows the calling process to receive a signal (arg2, > if nonzero) from a child process prior to the coredump of > the child process. arg2 must be SIGUSR1, or SIGUSR2, or > SIGCHLD, or 0 (for clear). > > When SIGCHLD is specified, the signal code is set to > CLD_PREDUMP in such an SIGCHLD signal. > > The value of the pre-coredump signal is cleared across > execve(2), or for the child of a fork(2). > > PR_GET_PREDUMP_SIG (since Linux 4.20.x) > Return the current value of the pre-coredump signal for the > calling process, in the location pointed to by (int *) arg2. From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail-ot1-f66.google.com ([209.85.210.66]:42179 "EHLO mail-ot1-f66.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1728452AbeJVX75 (ORCPT ); Mon, 22 Oct 2018 19:59:57 -0400 Received: by mail-ot1-f66.google.com with SMTP id c23so38694474otl.9 for ; Mon, 22 Oct 2018 08:40:56 -0700 (PDT) MIME-Version: 1.0 References: <2631f765-8d7a-45ea-6aa4-d8a9bb00d56f@cisco.com> In-Reply-To: <2631f765-8d7a-45ea-6aa4-d8a9bb00d56f@cisco.com> From: Jann Horn Date: Mon, 22 Oct 2018 17:40:28 +0200 Message-ID: Subject: Re: [PATCH] kernel/signal: Signal-based pre-coredump notification Content-Type: text/plain; charset="UTF-8" Sender: linux-arch-owner@vger.kernel.org List-ID: To: enkechen@cisco.com Cc: Thomas Gleixner , Ingo Molnar , Borislav Petkov , "H . Peter Anvin" , the arch/x86 maintainers , Peter Zijlstra , Arnd Bergmann , "Eric W. Biederman" , Khalid Aziz , Kate Stewart , deller@gmx.de, Greg Kroah-Hartman , Al Viro , Andrew Morton , christian@brauner.io, Catalin Marinas , Will Deacon , Dave.Martin@arm.com, mchehab+samsung@kernel.org, Michal Hocko , Rik van Riel , "Kirill A . Shutemov" , guro@fb.com, Marcos Souza , Oleg Nesterov , linux@dominikbrodowski.net, Cyrill Gorcunov , yang.shi@linux.alibaba.com, Kees Cook , kernel list , linux-arch , Victor Kamensky , xe-linux-external@cisco.com, sstrogin@cisco.com Message-ID: <20181022154028.c5HDTQMrSS4z5QKAzIgYtNr5PoW9af9nkVXJ7QUV19Y@z> On Sat, Oct 20, 2018 at 1:01 AM Enke Chen wrote: > Regarding the security considerations, it seems simpler and more secure to > just clear the "pre-coredump signal" cross execve(2), and let the new program > decide for itself. What do you think? I don't have a problem with these semantics. I could imagine someone being unhappy about the theoretical race window if they want to perform an in-place reexecution of a running service, but I don't know whether anyone actually cares about that. > Changes to prctl(2): > > DESCRIPTION > > PR_SET_PREDUMP_SIG (since Linux 4.20.x) > This allows the calling process to receive a signal (arg2, > if nonzero) from a child process prior to the coredump of > the child process. arg2 must be SIGUSR1, or SIGUSR2, or > SIGCHLD, or 0 (for clear). > > When SIGCHLD is specified, the signal code is set to > CLD_PREDUMP in such an SIGCHLD signal. > > The value of the pre-coredump signal is cleared across > execve(2), or for the child of a fork(2). > > PR_GET_PREDUMP_SIG (since Linux 4.20.x) > Return the current value of the pre-coredump signal for the > calling process, in the location pointed to by (int *) arg2.