From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1754318AbdFWOyw (ORCPT ); Fri, 23 Jun 2017 10:54:52 -0400 Received: from mx1.redhat.com ([209.132.183.28]:17795 "EHLO mx1.redhat.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1754185AbdFWOyu (ORCPT ); Fri, 23 Jun 2017 10:54:50 -0400 DMARC-Filter: OpenDMARC Filter v1.3.2 mx1.redhat.com 38EB87F414 Authentication-Results: ext-mx01.extmail.prod.ext.phx2.redhat.com; dmarc=none (p=none dis=none) header.from=redhat.com Authentication-Results: ext-mx01.extmail.prod.ext.phx2.redhat.com; spf=pass smtp.mailfrom=oleg@redhat.com DKIM-Filter: OpenDKIM Filter v2.11.0 mx1.redhat.com 38EB87F414 Date: Fri, 23 Jun 2017 16:54:41 +0200 From: Oleg Nesterov To: tip-bot for Michal Hocko Cc: linux-tip-commits@vger.kernel.org, torvalds@linux-foundation.org, mingo@kernel.org, hpa@zytor.com, jkosina@suse.cz, mhocko@suse.com, tglx@linutronix.de, davej@codemonkey.org.uk, peterz@infradead.org, linux-kernel@vger.kernel.org Subject: Re: [tip:x86/mm] x86/mmap, ASLR: Do not treat unlimited-stack tasks as legacy mmap Message-ID: <20170623145441.GB9388@redhat.com> References: <20170614082218.12450-1-mhocko@kernel.org> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: User-Agent: Mutt/1.5.24 (2015-08-30) X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.5.16 (mx1.redhat.com [10.5.110.25]); Fri, 23 Jun 2017 14:54:45 +0000 (UTC) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On 06/23, tip-bot for Michal Hocko wrote: > > We added a heuristics to treat applications with RLIMIT_STACK configured > to unlimited as legacy. This means: To me this also means a minor security problem. The comment above PER_CLEAR_ON_SETID says "must be cleared upon setuid or setgid exec", but if you do "ulimit -s unlimited" before suid exec then ADDR_COMPAT_LAYOUT set by security checks will be ignored. > So let's try and remove this assumption - hopefully nothing breaks. Agreed. Oleg.