Message-Id: <200504182115.j3ILFFKh024783@turing-police.cc.vt.edu>
To: Lorenzo =?ISO-8859-1?Q?Hern=E1ndez_?=
	 =?ISO-8859-1?Q?Garc=EDa-Hierro?= <lorenzo@gnu.org>
Cc: Christoph Hellwig <hch@infradead.org>,
       "linux-kernel@vger.kernel.org" <linux-kernel@vger.kernel.org>
Subject: Re: [PATCH] RLIMIT_NPROC enforcement during execve() calls 
In-Reply-To: Your message of "Mon, 18 Apr 2005 20:07:04 +0200."
             <1113847624.17341.36.camel@localhost.localdomain> 
From: Valdis.Kletnieks@vt.edu
References: <1113845937.17341.29.camel@localhost.localdomain> <20050418174346.GA28790@infradead.org>
            <1113847624.17341.36.camel@localhost.localdomain>
Mime-Version: 1.0
Content-Type: multipart/signed; boundary="==_Exmh_1113858914_10881P";
	 micalg=pgp-sha1; protocol="application/pgp-signature"
Content-Transfer-Encoding: 7bit
Date: Mon, 18 Apr 2005 17:15:15 -0400
Sender: linux-kernel-owner@vger.kernel.org
Content-Length: 1286
Lines: 34

--==_Exmh_1113858914_10881P
Content-Type: text/plain; charset=us-ascii

On Mon, 18 Apr 2005 20:07:04 +0200, Lorenzo =?ISO-8859-1?Q?Hern=E1ndez_?= =?ISO-8859-1?Q?Garc=EDa-Hierro?= said:

> The limit is only checked when process is created on a fork() call, but
> during execution it's uid can change, thus, the limit for the new uid
> could be exceed.

The only two ways I can see this happening are (1) if the process is running
as uid 0 (or capability-equivalent) at fork() time and have called set*uid()
before execve(), or (2) we just exec'ed a set-UID binary.

In both cases the "obvious" thing to do is to re-check the target UID's rlimit,
but there may be some squirrelly corner case where this isn't true...

--==_Exmh_1113858914_10881P
Content-Type: application/pgp-signature

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.1 (GNU/Linux)
Comment: Exmh version 2.5 07/13/2001

iD8DBQFCZCNicC3lWbTT17ARAiiPAJ0cHoSUOTEf8prW6yk0nnDINH3pNQCgvA6j
oSmDLBN/CCWA8C3Mjru26xU=
=H/Pt
-----END PGP SIGNATURE-----

--==_Exmh_1113858914_10881P--
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/