From mboxrd@z Thu Jan 1 00:00:00 1970 From: Richard Guy Briggs Subject: Re: Is zero a valid value for the pid member of the AUDIT_SIGNAL_INFO message? Date: Tue, 11 Mar 2014 23:32:01 -0400 Message-ID: <20140312033201.GC15329@madcap2.tricolour.ca> References: <20140311221517.GA15334@madcap2.tricolour.ca> <1394586404.10287.4.camel@localhost> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Return-path: Content-Disposition: inline In-Reply-To: <1394586404.10287.4.camel@localhost> List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: linux-audit-bounces@redhat.com Errors-To: linux-audit-bounces@redhat.com To: Eric Paris Cc: linux-audit@redhat.com List-Id: linux-audit@redhat.com On 14/03/11, Eric Paris wrote: > On Tue, 2014-03-11 at 18:15 -0400, Richard Guy Briggs wrote: > > Steve, > > > > Subject says it all... > > > > Is zero a valid value for the pid member of the AUDIT_SIGNAL_INFO message? > > No... > > Given that userspace requests AUDIT_SIGNAL_INFO after it gets a signal, > and that audit_sig_{uid,pid,...} get filled in when some task sent > auditd that signal, the idea that the pid would be 0 doesn't make > sense... (unless auditd requests AUDIT_SIGNAL_INFO without getting a > signal, but that's just dumb) The reason I ask is that it is initialized to -1, which I assume is no more valid than zero in your interpretation above. I looked at converting audit_sig_pid from pid_t to struct pid *, but then get_pid() would also be needed to protect that reference. A put_pid() would need to be done once it is no longer needed, which could be immediately after it is read in the AUDIT_SIGNAL_INFO message preparation, assuming it would never need to be read again. If this isn't the case, put_pid() could be called when audit_pid is nulled, but if that message never comes, that struct pid is stuck with a stale refcount. (That isn't an issue if it is init or systemd, but it is still wrong.) This looks more and more like overkill and should probably leave audit_sig_pid as pid_t. - RGB -- Richard Guy Briggs Senior Software Engineer, Kernel Security, AMER ENG Base Operating Systems, Red Hat Remote, Ottawa, Canada Voice: +1.647.777.2635, Internal: (81) 32635, Alt: +1.613.693.0684x3545