From: Jiri Slaby <jirislaby@gmail.com>
To: Oleg Nesterov <oleg@redhat.com>
Cc: akpm@linux-foundation.org, adobriyan@gmail.com,
nhorman@tuxdriver.com, linux-kernel@vger.kernel.org,
Stephen Smalley <sds@tycho.nsa.gov>,
James Morris <jmorris@namei.org>,
Eric Paris <eparis@parisplace.org>
Subject: Re: [PATCH v3 06/11] rlimits: do security check under task_lock
Date: Wed, 23 Jun 2010 23:35:35 +0200 [thread overview]
Message-ID: <4C227E27.7060604@gmail.com> (raw)
In-Reply-To: <20100623175602.GA14824@redhat.com>
On 06/23/2010 07:56 PM, Oleg Nesterov wrote:
> On 06/23, Jiri Slaby wrote:
>> I still see no way how this is wrong. We want to check whether current
>> thread has capabilities to change (someone else's) rlimits.
You know, this is one of those sentences where you wonder what kind of
idiot wrote that. And then you find out it was you being totally off base.
> Yes. but what is "someone else" ?
I don't know what was I thinking of. Indeed you are correct. When I was
writing that I was somehow under the impression (dunno why) that 'p' is
current process and the code checks whether 'p' can do the change. But
we are indeed checking whether 'current' may change 'p's limits -- or
better, as you wrote, not of the thread 'p' itself, but of its whole
process.
I'll resend a new version with you all in CCs to see what we can do with
the patches, if anything.
thanks,
--
js
next prev parent reply other threads:[~2010-06-23 21:35 UTC|newest]
Thread overview: 25+ messages / expand[flat|nested] mbox.gz Atom feed top
2010-05-10 18:00 [PATCH v3 01/11] rlimits: security, add task_struct to setrlimit Jiri Slaby
2010-05-10 18:00 ` [PATCH v3 02/11] rlimits: add task_struct to update_rlimit_cpu Jiri Slaby
2010-05-10 18:00 ` [PATCH v3 03/11] rlimits: make sure ->rlim_max never grows in sys_setrlimit Jiri Slaby
2010-05-10 18:00 ` [PATCH v3 04/11] rlimits: split sys_setrlimit Jiri Slaby
2010-05-10 18:00 ` [PATCH v3 05/11] rlimits: allow setrlimit to non-current tasks Jiri Slaby
2010-05-13 22:56 ` Andrew Morton
2010-06-06 20:23 ` [PATCH v3 06/11] rlimits: do security check under task_lock Jiri Slaby
2010-06-07 18:08 ` Oleg Nesterov
2010-06-23 15:20 ` Jiri Slaby
2010-06-23 16:12 ` Oleg Nesterov
2010-06-23 17:44 ` Jiri Slaby
2010-06-23 17:56 ` Oleg Nesterov
2010-06-23 21:35 ` Jiri Slaby [this message]
2010-06-23 18:37 ` Stephen Smalley
2010-05-10 18:00 ` Jiri Slaby
2010-05-13 22:56 ` Andrew Morton
2010-05-10 18:00 ` [PATCH v3 07/11] rlimits: add rlimit64 structure Jiri Slaby
2010-05-10 18:00 ` [PATCH v3 08/11] rlimits: redo do_setrlimit to more generic do_prlimit Jiri Slaby
2010-05-10 18:00 ` [PATCH v3 09/11] rlimits: switch more rlimit syscalls to do_prlimit Jiri Slaby
2010-05-10 18:00 ` [PATCH v3 10/11] rlimits: implement prlimit64 syscall Jiri Slaby
2010-05-13 22:56 ` Andrew Morton
2010-05-26 12:58 ` Jiri Slaby
2010-05-26 14:30 ` Andrew Morton
2010-05-26 15:13 ` Jiri Slaby
2010-05-10 18:00 ` [PATCH v3 11/11] unistd: add __NR_prlimit64 syscall numbers Jiri Slaby
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=4C227E27.7060604@gmail.com \
--to=jirislaby@gmail.com \
--cc=adobriyan@gmail.com \
--cc=akpm@linux-foundation.org \
--cc=eparis@parisplace.org \
--cc=jmorris@namei.org \
--cc=linux-kernel@vger.kernel.org \
--cc=nhorman@tuxdriver.com \
--cc=oleg@redhat.com \
--cc=sds@tycho.nsa.gov \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox