Re: [PATCH 2.6.13.1] Patch for invisible threads

Sripathi Kodi
2005-09-13T21:37:31Z

Al Viro wrote:
>
> Well... If exposing the list of tasks in a group is OK, we can just leave
> ->permission NULL for that sucker. If it's not (and arguably it can be
> sensitive information), we have a bigger problem - right now chroot boundary
> is the only control we have there; normally anyone can ls /proc/<whatever>/task
> and see other threads.
>

Al, I understand that we can't set ->permission to NULL as it removes the
chroot boundary check. If I understood you correctly, we need to put
additional checks in proc_permission to ensure anyone doing ls
/proc/<pid>/task won't be able to see other threads.

Coming back to the problem of being able to see the threads of a process
whose main thread has done pthread_exit, it appears to me that the only
hurdle is getting the ->fs pointer from task struct. Since all threads of
the process point to the same fs structure, would it be okay if we try to
get it from some other thread? Below is the patch I tried for this:

Signed-off-by: Sripathi Kodi <sripathik@in.ibm.com>

--- linux-2.6.13.1-orig/fs/proc/base.c 2005-09-13 23:53:06.000000000 -0500
+++ linux-2.6.13.1/fs/proc/base.c 2005-09-13 23:51:36.000000000 -0500
@@ -273,13 +273,25 @@ static int proc_cwd_link(struct inode *i

static int proc_root_link(struct inode *inode, struct dentry **dentry,
struct vfsmount **mnt)
{
- struct fs_struct *fs;
+ struct fs_struct *fs = NULL;
int result = -ENOENT;
- task_lock(proc_task(inode));
- fs = proc_task(inode)->fs;
- if(fs)
- atomic_inc(&fs->count);
- task_unlock(proc_task(inode));
+ struct task_struct *task = proc_task(inode);
+ struct task_struct *leader_task = task;
+
+ read_lock(&tasklist_lock);
+ if (pid_alive(task)) {
+ do {
+ task_lock(task);
+ if ((fs = task->fs)) {
+ atomic_inc(&fs->count);
+ task_unlock(task);
+ break;
+ }
+ task_unlock(task);
+ } while ((task = next_thread(task)) != leader_task);
+ }
+ read_unlock(&tasklist_lock);
+
if (fs) {
read_lock(&fs->lock);
*mnt = mntget(fs->rootmnt);