Re: [PATCH v2] sysctl: move the "cad_pid" entry from pid_table[] to kern_reboot_table[]

[Oleg Nesterov <oleg@redhat.com>]

On 07/20, Bradley Morgan wrote:
>
> On July 20, 2026 12:13:43 PM GMT+01:00, Oleg Nesterov <oleg@redhat.com>
> wrote:
> >cad_pid is global, and kill_cad_pid() is only used in the root namespace.
> >
> >However, due to pid_table_root_permissions(), a non-root user can unshare
> >pid/user namespaces and modify it from the child namespace. This makes no
> >sense and is simply wrong.
> >
> >Move it to kern_reboot_table[] where it logically belongs; this ensures
> >that only GLOBAL_ROOT_UID can read/modify this sysctl.
> >
> >Note that this patch doesn't preserve "#ifdef CONFIG_PROC_SYSCTL" around
> >the "cad_pid"; CONFIG_PROC_SYSCTL selects CONFIG_SYSCTL, so it is always
> >set when kern_reboot_table[] is compiled.
>
> Worlds smallest nit: Could you add the patch this was inspired by in the
> description?
>
> E.g:
> <proposal>
> This patch was inspired from Cens patch fixing a UAF in cid_pid [1]

This patch was inspired by sashiko.dev who found this problem. Not by
the patches from Cen.

I'd be happy to add Reported-by: sashiko.dev but I don't think I can.

Oleg.