From mboxrd@z Thu Jan 1 00:00:00 1970 From: Sukadev Bhattiprolu Subject: Re: [PATCH 4/9][cr][v2]: Restore file_owner info Date: Wed, 28 Jul 2010 12:25:03 -0700 Message-ID: <20100728192503.GA14570@us.ibm.com> References: <1274238452-15382-1-git-send-email-sukadev@linux.vnet.ibm.com> <1274238452-15382-5-git-send-email-sukadev@linux.vnet.ibm.com> <4C16FC14.1090001@cs.columbia.edu> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Cc: serue@us.ibm.com, Matt Helsley , matthew@wil.cx, linux-fsdevel@vger.kernel.org, Containers To: Oren Laadan Return-path: Received: from e35.co.us.ibm.com ([32.97.110.153]:56994 "EHLO e35.co.us.ibm.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1750952Ab0G1TTs (ORCPT ); Wed, 28 Jul 2010 15:19:48 -0400 Received: from d03relay01.boulder.ibm.com (d03relay01.boulder.ibm.com [9.17.195.226]) by e35.co.us.ibm.com (8.14.4/8.13.1) with ESMTP id o6SJBOTf027451 for ; Wed, 28 Jul 2010 13:11:24 -0600 Received: from d03av04.boulder.ibm.com (d03av04.boulder.ibm.com [9.17.195.170]) by d03relay01.boulder.ibm.com (8.13.8/8.13.8/NCO v10.0) with ESMTP id o6SJJbHM104480 for ; Wed, 28 Jul 2010 13:19:38 -0600 Received: from d03av04.boulder.ibm.com (loopback [127.0.0.1]) by d03av04.boulder.ibm.com (8.14.4/8.13.1/NCO v10.0 AVout) with ESMTP id o6SJJZTX030321 for ; Wed, 28 Jul 2010 13:19:37 -0600 Content-Disposition: inline In-Reply-To: <4C16FC14.1090001@cs.columbia.edu> Sender: linux-fsdevel-owner@vger.kernel.org List-ID: Oren Laadan [orenl@cs.columbia.edu] wrote: | > + | > + rcu_read_lock(); | > + pid = find_vpid(h->f_owner_pid); | | What if this fails - the pid is invalid/non-existent ? Good point. ->f_owner_pid can be 0 (in the normal case) and __fsetown() below will set the owner to NULL pid. But if ->f_owner_pid is non-zero, we should ensure we found a valid pid - added a check for this. | | > + /* | > + * TODO: Do we need to force==1 or can it be 0 ? 'force' is used to | > + * modify the owner, if one is already set. Can it be set when | > + * we restart an application ? | > + */ | > + ret = __f_setown(file, pid, h->f_owner_pid_type, uid, euid, 1); | > + rcu_read_unlock(); | | I wonder if this would be a problem in terms of security on a | non-container restart (e.g. not in a new pid-ns): one could set | any pid as owner and any signal to be sent, and cause an arbitrary | signal to be sent to an arbitrary process ? Yes, Matt and Serge pointed it out and for now we need CAP_KILL capability to restore an application that has file-leases. Sukadev