Received: by 2002:ac0:aa62:0:0:0:0:0 with SMTP id w31-v6csp2668862ima; Mon, 22 Oct 2018 13:49:46 -0700 (PDT) X-Google-Smtp-Source: ACcGV61OaMYSuD7+scJ74/ng3TYgHgzh/bR0ifTtuxLdaorkCpAbRL4DXPF7jp5M8f+46642ZcVl X-Received: by 2002:a63:7e0d:: with SMTP id z13-v6mr16873291pgc.190.1540241386238; Mon, 22 Oct 2018 13:49:46 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1540241386; cv=none; d=google.com; s=arc-20160816; b=qrNJT6wV3D/xFIuI8djibnhQsr5hskd968W+tTlNgqI5QF0cKaXctrYTGfpd2qzoX/ ZPpGcZxfkmTZWvbu7sWItdUWQxG0exJgcJxfmaVlVETFkjWeS5NixjKUTso0RdwqIGgc wZExKCw/ng6SqOB8VBnthKW7/S+87PmnF9ZOrAqkZ/2d2PTSrj3TdFhy/BYYuOB24FrR UvFHH/20JSDXAXAyfOxgfVFJ15lftyoVndNIVPVIlI0kaZ9Qt3upWraiBp8+mNUmL++a veC2p+x1xNyTRGhZvKvKqlCAw2ChL4NVDgKeTJRyfud4Sjnr9sHXg10CM1Wtzxl14UiM KbEw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:sender:content-transfer-encoding :content-language:in-reply-to:mime-version:user-agent:date :message-id:from:references:cc:to:subject:dkim-signature; bh=8IjPZUpTB7thtl0TF0H8ol76qNbGNfQUl30tHr8oXr8=; b=zQGScJ8IwsVMtYpaNLjmex3jshWM8vwk/ESbAAOswnUAelwyFFSsHvHhRy5vP47ZYm rojSyXVai+kNegNI+O9EONvaoE033KAMWG5gcazavf9X4VrrOeNeEPuaouxvkM6m5CmM rYaeyhHYxlW0x5xtGFqRzXwJoi4+7VGzb0JGG0IbGdJWr69RMkFhT9uXkFodjQXzT6DL WoW8BvENpq+VgUproiZuTIju1IB0EW9sASCazgN/F6ZEXVC1jcdbuk45nzgXA9DObUVE YjiaGqzAzPiujYd6lqFYQatnTx+c7hM6/U/jewFT1FXkgAsERYU6hQ6YFi8Znc2nLw7/ AxmA== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@cisco.com header.s=iport header.b=ceMuSlzk; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=QUARANTINE sp=QUARANTINE dis=NONE) header.from=cisco.com Return-Path: Received: from vger.kernel.org (vger.kernel.org. [209.132.180.67]) by mx.google.com with ESMTP id a9-v6si7846173pgk.69.2018.10.22.13.49.31; Mon, 22 Oct 2018 13:49:46 -0700 (PDT) Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67; Authentication-Results: mx.google.com; dkim=pass header.i=@cisco.com header.s=iport header.b=ceMuSlzk; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=QUARANTINE sp=QUARANTINE dis=NONE) header.from=cisco.com Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1729308AbeJWFJD (ORCPT + 99 others); Tue, 23 Oct 2018 01:09:03 -0400 Received: from rcdn-iport-6.cisco.com ([173.37.86.77]:46312 "EHLO rcdn-iport-6.cisco.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1729266AbeJWFJD (ORCPT ); Tue, 23 Oct 2018 01:09:03 -0400 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cisco.com; i=@cisco.com; l=2392; q=dns/txt; s=iport; t=1540241337; x=1541450937; h=subject:to:cc:references:from:message-id:date: mime-version:in-reply-to:content-transfer-encoding; bh=bAsNdtHY2ntetBwx/RM7c+A12Dt9nNe9LNo8DpKC6M8=; b=ceMuSlzkUP5/dAWiQo9rTyUdYa/EgHX3YYLSCj0DjFx/12lSeum8OEU2 PuUOgUZo0RaEg1oxyz0OwoHhGOx9U2xIoEOHMGFPrqlPO+11a7ifEBpZ2 baWS/8DZ2fx8Uh3fJjDkLxnN9no8L+8vLvSVl1eN+FcLT8q6s3BVNkomB g=; X-IronPort-AV: E=Sophos;i="5.54,413,1534809600"; d="scan'208";a="470247364" Received: from alln-core-5.cisco.com ([173.36.13.138]) by rcdn-iport-6.cisco.com with ESMTP/TLS/DHE-RSA-AES256-GCM-SHA384; 22 Oct 2018 20:48:57 +0000 Received: from [10.154.208.149] ([10.154.208.149]) by alln-core-5.cisco.com (8.15.2/8.15.2) with ESMTP id w9MKmpGO018921; Mon, 22 Oct 2018 20:48:52 GMT Subject: Re: [PATCH] kernel/signal: Signal-based pre-coredump notification To: Jann Horn Cc: Thomas Gleixner , Ingo Molnar , Borislav Petkov , "H . Peter Anvin" , the arch/x86 maintainers , Peter Zijlstra , Arnd Bergmann , "Eric W. Biederman" , Khalid Aziz , Kate Stewart , deller@gmx.de, Greg Kroah-Hartman , Al Viro , Andrew Morton , christian@brauner.io, Catalin Marinas , Will Deacon , Dave.Martin@arm.com, mchehab+samsung@kernel.org, Michal Hocko , Rik van Riel , "Kirill A . Shutemov" , guro@fb.com, Marcos Souza , Oleg Nesterov , linux@dominikbrodowski.net, Cyrill Gorcunov , yang.shi@linux.alibaba.com, Kees Cook , kernel list , linux-arch , Victor Kamensky , xe-linux-external@cisco.com, sstrogin@cisco.com, Enke Chen References: <2631f765-8d7a-45ea-6aa4-d8a9bb00d56f@cisco.com> From: Enke Chen Message-ID: <14503a22-403e-3e39-cfd5-0b7a2f299986@cisco.com> Date: Mon, 22 Oct 2018 13:48:51 -0700 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.13; rv:52.0) Gecko/20100101 Thunderbird/52.9.1 MIME-Version: 1.0 In-Reply-To: Content-Type: text/plain; charset=utf-8 Content-Language: en-US Content-Transfer-Encoding: 7bit X-Auto-Response-Suppress: DR, OOF, AutoReply X-Outbound-SMTP-Client: 10.154.208.149, [10.154.208.149] X-Outbound-Node: alln-core-5.cisco.com Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Jann, Thanks for the feedback. I will post a revised patch shortly. On the related topic of "pdeath_signal", there are several inconsistencies by preserving the flag across execve(2). The flag is cleared under several conditions in different places. I will start a separate thread to see if it can still be cleaned up. PR_SET_PDEATHSIG (since Linux 2.1.57) Set the parent death signal of the calling process to arg2 (either a signal value in the range 1..maxsig, or 0 to clear). This is the signal that the calling process will get when its parent dies. This value is cleared for the child of a fork(2) and (since Linux 2.4.36 / 2.6.23) when executing a set-user-ID or set-group-ID binary, or a binary that has associated capabilities (see capabilities(7)). This value is preserved across execve(2). -- Enke On 10/22/18 8:40 AM, Jann Horn wrote: > On Sat, Oct 20, 2018 at 1:01 AM Enke Chen wrote: >> Regarding the security considerations, it seems simpler and more secure to >> just clear the "pre-coredump signal" cross execve(2), and let the new program >> decide for itself. What do you think? > > I don't have a problem with these semantics. > > I could imagine someone being unhappy about the theoretical race > window if they want to perform an in-place reexecution of a running > service, but I don't know whether anyone actually cares about that. > >> Changes to prctl(2): >> >> DESCRIPTION >> >> PR_SET_PREDUMP_SIG (since Linux 4.20.x) >> This allows the calling process to receive a signal (arg2, >> if nonzero) from a child process prior to the coredump of >> the child process. arg2 must be SIGUSR1, or SIGUSR2, or >> SIGCHLD, or 0 (for clear). >> >> When SIGCHLD is specified, the signal code is set to >> CLD_PREDUMP in such an SIGCHLD signal. >> >> The value of the pre-coredump signal is cleared across >> execve(2), or for the child of a fork(2). >> >> PR_GET_PREDUMP_SIG (since Linux 4.20.x) >> Return the current value of the pre-coredump signal for the >> calling process, in the location pointed to by (int *) arg2.