Received: by 2002:ac0:98c7:0:0:0:0:0 with SMTP id g7-v6csp393665imd; Wed, 31 Oct 2018 21:56:12 -0700 (PDT) X-Google-Smtp-Source: AJdET5fJjIjf0iQfC5H+4fa7+3ZTEd3TGB5ZTbXcwXXv4ao4AGwV8rPQoIw7xi6QMNxCDca3DwEE X-Received: by 2002:a17:902:4624:: with SMTP id o33-v6mr6273962pld.285.1541048172529; Wed, 31 Oct 2018 21:56:12 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1541048172; cv=none; d=google.com; s=arc-20160816; b=VLhOk6MAGCImiI3J9/3Vqb1EIZTeK8g6YJkrM+zBFMNVgmBCJSbgQe92DWzx9utYNM hxEA5u+LA7+dVz0x8GjfPoTOLRs0Ec+6ZO2qAscIzcJDCEF2j89Jz6hbU2Er97eoc9Mx S/DfB59RYbQrUB/a0sK2H/lF7Tykn2m9I8LJVmQHvlH3kCn5j8xTy6Cy/9z6j3QDfmgx j0JjK+efFPHU3rQ+5e/tvL3OEHmLYezro/fGzqDCzxSOZpOkxPEqaHXXyJUwH1eeizIO laH9o5pI+NjnK2YdpLzb7pqQ764HUNLtAXcZEaeEjicaHgHgmGEmPsAdPiSVcyn5TQlZ JK4w== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:sender:cc:to:subject:message-id:date:from :in-reply-to:references:mime-version:dkim-signature; bh=iCYBov7PlFbs0m4DdJ3/d/tqrR80NN1s4c31iT8ynxE=; b=Y7J/J6LN73zX2qRXrwv+6nm5NC8wdTplZzLS95Kr3mk+3Ak6Z++ZAFe35cGHFkiHId 92GEdru62Ycz+EPVMxSFTIIt0pW7dLQlwM9TgYS2/29cmfjDUnM1S317a//aO+gOB59o kajXHO4x45yoPOtT6gZ4wqWJD6AGwOKyH9KRiCH7hOkkBOqbdHLMnVr0bU9TquuMK+x1 fISnvNlFySSyd0GOBhOCkMCzxwkbFuCCJDWmEJguiZ8wtY1aLuNF7CZvhpxoIYDBbzXE DnK3SHRpYrSwMo3MoKq6R7dT17d9yAPDP0flQCOlCovgc6eRGd2Vtc/8Xf2uPSBxfDLu ClDA== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@kernel.org header.s=default header.b="z/3C0xys"; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=kernel.org Return-Path: Received: from vger.kernel.org (vger.kernel.org. [209.132.180.67]) by mx.google.com with ESMTP id g74-v6si30926605pfe.4.2018.10.31.21.55.57; Wed, 31 Oct 2018 21:56:12 -0700 (PDT) Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67; Authentication-Results: mx.google.com; dkim=pass header.i=@kernel.org header.s=default header.b="z/3C0xys"; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=kernel.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1727668AbeKANzY (ORCPT + 99 others); Thu, 1 Nov 2018 09:55:24 -0400 Received: from mail.kernel.org ([198.145.29.99]:42760 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1726396AbeKANzY (ORCPT ); Thu, 1 Nov 2018 09:55:24 -0400 Received: from mail-wr1-f41.google.com (mail-wr1-f41.google.com [209.85.221.41]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id B6FC320833 for ; Thu, 1 Nov 2018 04:54:03 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1541048044; bh=qswDDJzJ+Bk7GpKfMZLA6LpUbWHM7uZqnClApvqgHxE=; h=References:In-Reply-To:From:Date:Subject:To:Cc:From; b=z/3C0xysryzpJgmw4g7THRZYXhU4GW95o0O3xRxcRogULn56+Vrh2C4UsnDrSf30F MBGwXAMyffGNt9aoQo8WrFbYO9TBR3xgJpCySyREZH7ifJ8YzMkdtW24/lQMaV+JpY 6EeSz4aQ8FXmu3G29JXtOUsKJsFN24Ds+altXWLc= Received: by mail-wr1-f41.google.com with SMTP id r10-v6so18792069wrv.6 for ; Wed, 31 Oct 2018 21:54:03 -0700 (PDT) X-Gm-Message-State: AGRZ1gJcT4svDCYZLcNpPhQWOTpoq8B6qCsQJUMnVpEBZ7IAp9auHoLd wIR1aEgL9xMrz6dLRRJ5Oan6rIP0ZwZsDIhucD757A== X-Received: by 2002:adf:97d3:: with SMTP id t19-v6mr5462455wrb.283.1541048042165; Wed, 31 Oct 2018 21:54:02 -0700 (PDT) MIME-Version: 1.0 References: <20181029221037.87724-1-dancol@google.com> In-Reply-To: From: Andy Lutomirski Date: Wed, 31 Oct 2018 21:53:50 -0700 X-Gmail-Original-Message-ID: Message-ID: Subject: Re: [RFC PATCH] Implement /proc/pid/kill To: Jann Horn Cc: dancol@google.com, LKML , timmurray@google.com, Joel Fernandes , surenb@google.com, Andrew Lutomirski , Linux API , "Eric W. Biederman" Content-Type: text/plain; charset="UTF-8" Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Wed, Oct 31, 2018 at 9:23 AM Jann Horn wrote: > > +linux-api, Andy Lutomirski, Eric Biederman > > On Wed, Oct 31, 2018 at 3:12 AM Daniel Colascione wrote: > > Add a simple proc-based kill interface. To use /proc/pid/kill, just > > write the signal number in base-10 ASCII to the kill file of the > > process to be killed: for example, 'echo 9 > /proc/$$/kill'. > > This is a kernel API change, you should CC the linux-api list. > > I think that getting the semantics of this right might be easier if > you used an ioctl handler instead of a write handler. > > > Semantically, /proc/pid/kill works like kill(2), except that the > > process ID comes from the proc filesystem context instead of from an > > explicit system call parameter. This way, it's possible to avoid races > > between inspecting some aspect of a process and that process's PID > > being reused for some other process. > > > > With /proc/pid/kill, it's possible to write a proper race-free and > > safe pkill(1). An approximation follows. A real program might use > > openat(2), having opened a process's /proc/pid directory explicitly, > > with the directory file descriptor serving as a sort of "process > > handle". > > > > #!/bin/bash > > set -euo pipefail > > pat=$1 > > for proc_status in /proc/*/status; do ( > > cd $(dirname $proc_status) > > readarray proc_argv -d'' < cmdline > > if ((${#proc_argv[@]} > 0)) && > > [[ ${proc_argv[0]} = *$pat* ]]; > > then > > echo 15 > kill > > fi > > ) || true; done > > > > Signed-off-by: Daniel Colascione > > --- > > fs/proc/base.c | 39 +++++++++++++++++++++++++++++++++++++++ > > 1 file changed, 39 insertions(+) > > > > diff --git a/fs/proc/base.c b/fs/proc/base.c > > index 7e9f07bf260d..923d62b21e67 100644 > > --- a/fs/proc/base.c > > +++ b/fs/proc/base.c > > @@ -205,6 +205,44 @@ static int proc_root_link(struct dentry *dentry, struct path *path) > > return result; > > } > > > > +static ssize_t proc_pid_kill_write(struct file *file, > > + const char __user *buf, > > + size_t count, loff_t *ppos) > > +{ > > + ssize_t res; > > + int sig; > > + char buffer[4]; > > + > > + res = -EINVAL; > > + if (*ppos != 0) > > + goto out; > > + > > + res = -EINVAL; > > + if (count > sizeof(buffer) - 1) > > + goto out; > > + > > + res = -EFAULT; > > + if (copy_from_user(buffer, buf, count)) > > + goto out; > > + > > + buffer[count] = '\0'; > > + res = kstrtoint(strstrip(buffer), 10, &sig); > > + if (res) > > + goto out; > > + > > + res = kill_pid(proc_pid(file_inode(file)), sig, 0); Indeed, you can't do this from .write unless you manage to pass a cred struct pointer in. ioctl or a new syscall would be better. --Andy