From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by smtp.lore.kernel.org (Postfix) with ESMTP id 3EFE1C433F5 for ; Fri, 7 Oct 2022 11:58:16 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id 975296B0072; Fri, 7 Oct 2022 07:58:15 -0400 (EDT) Received: by kanga.kvack.org (Postfix, from userid 40) id 9257B6B0073; Fri, 7 Oct 2022 07:58:15 -0400 (EDT) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id 7EC866B0074; Fri, 7 Oct 2022 07:58:15 -0400 (EDT) X-Delivered-To: linux-mm@kvack.org Received: from relay.hostedemail.com (smtprelay0012.hostedemail.com [216.40.44.12]) by kanga.kvack.org (Postfix) with ESMTP id 6CDDB6B0072 for ; Fri, 7 Oct 2022 07:58:15 -0400 (EDT) Received: from smtpin09.hostedemail.com (a10.router.float.18 [10.200.18.1]) by unirelay07.hostedemail.com (Postfix) with ESMTP id 0206D160FEE for ; Fri, 7 Oct 2022 11:58:14 +0000 (UTC) X-FDA: 79994005308.09.BA51D70 Received: from eu-smtp-delivery-151.mimecast.com (eu-smtp-delivery-151.mimecast.com [185.58.86.151]) by imf30.hostedemail.com (Postfix) with ESMTP id CF85580007 for ; Fri, 7 Oct 2022 11:58:12 +0000 (UTC) Received: from AcuMS.aculab.com (156.67.243.121 [156.67.243.121]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384) id uk-mta-25-ABR5MNZQOUi4UB5yYMDNEA-1; Fri, 07 Oct 2022 12:58:08 +0100 X-MC-Unique: ABR5MNZQOUi4UB5yYMDNEA-1 Received: from AcuMS.Aculab.com (10.202.163.4) by AcuMS.aculab.com (10.202.163.4) with Microsoft SMTP Server (TLS) id 15.0.1497.38; Fri, 7 Oct 2022 12:58:06 +0100 Received: from AcuMS.Aculab.com ([::1]) by AcuMS.aculab.com ([::1]) with mapi id 15.00.1497.040; Fri, 7 Oct 2022 12:58:06 +0100 From: David Laight To: 'Theodore Ts'o' , Kees Cook CC: Jorge Merlino , Christian Brauner , Eric Biederman , Jann Horn , Alexander Viro , Thomas Gleixner , Andy Lutomirski , "Sebastian Andrzej Siewior" , Andrew Morton , "linux-mm@kvack.org" , "linux-fsdevel@vger.kernel.org" , John Johansen , Paul Moore , James Morris , "Serge E. Hallyn" , Stephen Smalley , Eric Paris , Richard Haines , Casey Schaufler , Xin Long , "David S. Miller" , Todd Kjos , Ondrej Mosnacek , Prashanth Prahlad , Micah Morton , Fenghua Yu , Andrei Vagin , "linux-kernel@vger.kernel.org" , "apparmor@lists.ubuntu.com" , "linux-security-module@vger.kernel.org" , "selinux@vger.kernel.org" , "linux-hardening@vger.kernel.org" Subject: RE: [PATCH] Fix race condition when exec'ing setuid files Thread-Topic: [PATCH] Fix race condition when exec'ing setuid files Thread-Index: AQHY2e33//tmcksZekaHt2mlO/Dtmq4C0tkw Date: Fri, 7 Oct 2022 11:58:06 +0000 Message-ID: References: <202209131456.76A13BC5E4@keescook> <202210061301.207A20C8E5@keescook> In-Reply-To: Accept-Language: en-GB, en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-ms-exchange-transport-fromentityheader: Hosted x-originating-ip: [10.202.205.107] MIME-Version: 1.0 X-Mimecast-Spam-Score: 0 X-Mimecast-Originator: aculab.com Content-Language: en-US Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: quoted-printable ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=hostedemail.com; s=arc-20220608; t=1665143894; h=from:from:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=CriAwL2SkKyi6OWIm1txJemMBg7CnwfknBwHLpKOh98=; b=ypJxdwq2E7KW0EIwdo+d6rmm67uqiKLSaH/BH4hawgKlU5qCR/+q7jjKZ2/fJszvO8DL3e 1VlyqRe+GHgq0nP78v6P3qIpEKfYJW//zQnV+LZgItXDZIk+4O6Cv3ol6hEdy6/tgvTN89 yl6DbGUtCieWZrhqN1l3WXagoamUH/U= ARC-Authentication-Results: i=1; imf30.hostedemail.com; dkim=none; spf=pass (imf30.hostedemail.com: domain of david.laight@aculab.com designates 185.58.86.151 as permitted sender) smtp.mailfrom=david.laight@aculab.com; dmarc=pass (policy=none) header.from=aculab.com ARC-Seal: i=1; s=arc-20220608; d=hostedemail.com; t=1665143894; a=rsa-sha256; cv=none; b=Cxt+9/Au4ZQFpjOunP6xHPBWLnbnvZf+v1IIulsmIk2WlE/ql+vwT4iru+oSohkalDu/xy AL4yFS/KKRmxx5k8N0Gs22/qZW0rFcw/8RdwtP6Ia69ZGhfSjQubSuZC2y4/A72UVHsQq/ 3u8Y28TFUg3duFgoG/bNlKxiUFii3vo= X-Rspam-User: Authentication-Results: imf30.hostedemail.com; dkim=none; spf=pass (imf30.hostedemail.com: domain of david.laight@aculab.com designates 185.58.86.151 as permitted sender) smtp.mailfrom=david.laight@aculab.com; dmarc=pass (policy=none) header.from=aculab.com X-Stat-Signature: g17yteaw7di9qdkc6g5sdifspzuxj8o7 X-Rspamd-Queue-Id: CF85580007 X-Rspamd-Server: rspam02 X-HE-Tag: 1665143892-927022 X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: From: Theodore Ts'o > Sent: 07 October 2022 02:41 >=20 > On Thu, Oct 06, 2022 at 01:20:35PM -0700, Kees Cook wrote: > > > > So the question, then, is "why are they trying to exec while actively > > spawning new threads?" That appears to be the core problem here, and as > > far as I can tell, the kernel has behaved this way for a very long time= . > > I don't think the kernel should fix this, either, because it leads to a > > very weird state for userspace, where the thread spawner may suddenly > > die due to the exec happening in another thread. This really looks like > > something userspace needs to handle correctly (i.e. don't try to exec > > while actively spawning threads). >=20 > One of the classic failure modes is when a threaded program calls a > library, and that library might try to do a fork/exec (or call > system(3) to run some command. e.g., such as running "lvm create ..." > or to spawn some kind of helper daemon. >=20 > There are a number of stack overflow questions about this, and there > are some solutions to _some_ of the problems, such as using > pthread_atfork(), and knowing that you are about to call fork/exec, > and use some out of band mechanism to to make sure no threads get > spawned until the fork/exec is completed --- but if you don't know > that a library is going to do a fork/exec, well, life is tough. Or that a library thread is about to create a new thread. > One technique even advocated by a stack overflow article is "avoid > using threads whenver possible". :-/ Doesn't fork() only create the current thread in the new process? So by the time exec() runs there is a nice single threaded process with an fd table that isn't shared. For helpers there is always (a properly implemented) posix_spawn() :-) =09David - Registered Address Lakeside, Bramley Road, Mount Farm, Milton Keynes, MK1 1= PT, UK Registration No: 1397386 (Wales)