From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752209AbdJCQgp (ORCPT ); Tue, 3 Oct 2017 12:36:45 -0400 Received: from out01.mta.xmission.com ([166.70.13.231]:38870 "EHLO out01.mta.xmission.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751721AbdJCQgo (ORCPT ); Tue, 3 Oct 2017 12:36:44 -0400 From: ebiederm@xmission.com (Eric W. Biederman) To: Linus Torvalds Cc: =?utf-8?Q?J=C3=BCrg?= Billeter , Andrew Morton , Oleg Nesterov , Michael Kerrisk , Filipe Brandenburger , David Wilcox , hansecke@gmail.com, Linux Kernel Mailing List References: <20170909094008.49983-1-j@bitron.ch> <20170929123058.48924-1-j@bitron.ch> <20171002162041.a7cefe8af71327b8becd2347@linux-foundation.org> <87o9pogbf7.fsf@xmission.com> <1507013157.2304.48.camel@bitron.ch> <878tgse1c5.fsf@xmission.com> Date: Tue, 03 Oct 2017 11:36:25 -0500 In-Reply-To: (Linus Torvalds's message of "Tue, 3 Oct 2017 09:10:04 -0700") Message-ID: <87shf0b33q.fsf@xmission.com> User-Agent: Gnus/5.13 (Gnus v5.13) Emacs/25.1 (gnu/linux) MIME-Version: 1.0 Content-Type: text/plain X-XM-SPF: eid=1dzQBQ-0004oG-Px;;;mid=<87shf0b33q.fsf@xmission.com>;;;hst=in02.mta.xmission.com;;;ip=67.3.200.44;;;frm=ebiederm@xmission.com;;;spf=neutral X-XM-AID: U2FsdGVkX1/UAbVum9U+gf0hP8l62vFUhMgSqI3/704= X-SA-Exim-Connect-IP: 67.3.200.44 X-SA-Exim-Mail-From: ebiederm@xmission.com X-Spam-Report: * -1.0 ALL_TRUSTED Passed through trusted hosts only via SMTP * 1.5 TR_Symld_Words too many words that have symbols inside * 0.0 TVD_RCVD_IP Message was received from an IP address * 0.0 T_TM2_M_HEADER_IN_MSG BODY: No description available. * -0.0 BAYES_20 BODY: Bayes spam probability is 5 to 20% * [score: 0.1166] * -0.0 DCC_CHECK_NEGATIVE Not listed in DCC * [sa08 1397; Body=1 Fuz1=1 Fuz2=1] X-Spam-DCC: XMission; sa08 1397; Body=1 Fuz1=1 Fuz2=1 X-Spam-Combo: ;Linus Torvalds X-Spam-Relay-Country: X-Spam-Timing: total 5678 ms - load_scoreonly_sql: 0.03 (0.0%), signal_user_changed: 2.9 (0.1%), b_tie_ro: 2.2 (0.0%), parse: 0.62 (0.0%), extract_message_metadata: 11 (0.2%), get_uri_detail_list: 0.94 (0.0%), tests_pri_-1000: 6 (0.1%), tests_pri_-950: 0.89 (0.0%), tests_pri_-900: 0.73 (0.0%), tests_pri_-400: 18 (0.3%), check_bayes: 18 (0.3%), b_tokenize: 4.6 (0.1%), b_tok_get_all: 6 (0.1%), b_comp_prob: 1.55 (0.0%), b_tok_touch_all: 3.3 (0.1%), b_finish: 0.62 (0.0%), tests_pri_0: 150 (2.6%), check_dkim_signature: 0.39 (0.0%), check_dkim_adsp: 2.4 (0.0%), tests_pri_500: 5486 (96.6%), poll_dns_idle: 5480 (96.5%), rewrite_mail: 0.00 (0.0%) Subject: Re: [RESEND PATCH] prctl: add PR_[GS]ET_PDEATHSIG_PROC X-Spam-Flag: No X-SA-Exim-Version: 4.2.1 (built Thu, 05 May 2016 13:38:54 -0600) X-SA-Exim-Scanned: Yes (on in02.mta.xmission.com) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Linus Torvalds writes: > On Tue, Oct 3, 2017 at 7:46 AM, Eric W. Biederman wrote: >> >> The process that requests the signal be sent is the process that is >> receiving the signal. I can see a theoretical need for a permission >> check in there somewhere (especially as this persists over fork). > > Note that it also persists over not just fork, but execve() too. > > Yes, the signal is cleared if the e[ug]id/fs[ug]id is changed by exec, > but not (for example) if just uid is changed. *Scratches head* pdeath_signal is cleared during exec if bprm->cap_elevated. bprm->cap_elevated is set if we are not root and we gain caps during the exec. bprm->cap_elevated is set if is_setid is true. is_setid is set if the uid != eid or gid != egid. So looking at that I am not exactly wild about the name cap_elevated, but it seems to clear pdeath_signal if the jus the uid is changed during exec. > Does that matter? Probably not. But signal handling does actually > check uid, so it does actually affect signal permission checks across > execve. I don't think there is anything in exec in this case to worry about. Of course there is the completely bizarre case that if the parent execs or calls setresuid it is possible that the signal won't send because it is the parent's permission that are checked. I think that is probably a bug. I can understand not sending to our future self if our future self has different credentials than our present self. But not sending to our future self because someone else changed seems completely bizarre to me. Eric