Potential security problem in patch: Fix reading /proc/<pid>/mem when parent dies.

Potential security problem in patch: Fix reading /proc/<pid>/mem when parent dies.

[Alan Cox]

On Iau, 2004-11-18 at 16:01, Linux Kernel Mailing List wrote:
> ChangeSet 1.2155, 2004/11/18 08:01:00-08:00, torvalds@ppc970.osdl.org
> 
> 	Fix reading /proc/<pid>/mem when parent dies.
> 	
> 	We should not touch "self_exec_id" here. The parent changed,
> 	not we.

The original point of this was that if our parent changed then our new
parent is not aware of our special status. As a result we can send
random signals to init and since it does not see SIGCLD we can get
zombies or worse when we exit.

The original code was correct here for protecting init. The side effect
does need fixing but not this way. Perhaps it would be simpler just to
protect init as it is already "special" for signal handling.

Alan

Re: Potential security problem in patch: Fix reading /proc/<pid>/mem when parent dies.

[Alan Cox]

On Gwe, 2004-11-19 at 00:52, Linus Torvalds wrote:
> How could we send random signals? That's what the "exit_signal" thing is 
> for, and the code does
> 
> 	if (p->exit_signal != -1)
> 		p->exit_signal = SIGCHLD;
> 
> for that.
> 
> Is there any other way to set exit_signal afterwards? If so, I think we 
> should have a security check at _that_ point.

Ok that makes sense now I look harder at it. While it was added to
protect agains that case the code you quote already covers all the cases
I can see. We can clone new threads but they too will get reparented or
will simply kill us.

Re: Potential security problem in patch: Fix reading /proc/<pid>/mem when parent dies.

[Linus Torvalds]

On Thu, 18 Nov 2004, Alan Cox wrote:
> 
> The original point of this was that if our parent changed then our new
> parent is not aware of our special status. As a result we can send
> random signals to init and since it does not see SIGCLD we can get
> zombies or worse when we exit.

How could we send random signals? That's what the "exit_signal" thing is 
for, and the code does

	if (p->exit_signal != -1)
		p->exit_signal = SIGCHLD;

for that.

Is there any other way to set exit_signal afterwards? If so, I think we 
should have a security check at _that_ point.

		Linus