Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18;
MIME-Version: 1.0
References: <CAHk-=whJttTNFQn1fMYp91LZ90iHE7B2THZ8NjQ7fBwmWX9k6w@mail.gmail.com>
 <87imi8nzlw.fsf@x220.int.ebiederm.org> <CAHk-=wgh4zts+3hdkGzHLJ6pBGumcJ=23gRbMfubDrLstis2Bg@mail.gmail.com>
 <CAHk-=whKHpERyVv2-C+kxq9KV_mJPW3hkGDpn6f4yOvs+au8SA@mail.gmail.com>
 <20200411182043.GA3136@redhat.com> <CAHk-=wgwXpKepChGi4ZhQVxZxD0ic8s2CDXvUmqBTMaKGz-fjg@mail.gmail.com>
 <20200412195049.GA23824@redhat.com> <CAHk-=wiDwR+6ugYaKEGHfYteLF+NH5xu=T7uuUTkK9y-hr6zow@mail.gmail.com>
 <AM6PR03MB51708CF53D8A02086427DAC2E4AC0@AM6PR03MB5170.eurprd03.prod.outlook.com>
 <CAHk-=wi_zr9dwX3UBYvgkmm6eVQfRP50orryJ6ZVAxuFqdSG5A@mail.gmail.com> <20200428190836.GC29960@redhat.com>
In-Reply-To: <20200428190836.GC29960@redhat.com>
From:   Linus Torvalds <torvalds@linux-foundation.org>
Date:   Tue, 28 Apr 2020 13:35:41 -0700
Message-ID: <CAHk-=wi03QRcUR1DfbEr+Pw-DAMENzY-FuRcGawtj9p597=p2w@mail.gmail.com>
Subject: Re: [GIT PULL] Please pull proc and exec work for 5.7-rc1
To:     Oleg Nesterov <oleg@redhat.com>
Cc:     Jann Horn <jannh@google.com>,
        Bernd Edlinger <bernd.edlinger@hotmail.de>,
        "Eric W. Biederman" <ebiederm@xmission.com>,
        Waiman Long <longman@redhat.com>,
        Ingo Molnar <mingo@kernel.org>, Will Deacon <will@kernel.org>,
        Linux Kernel Mailing List <linux-kernel@vger.kernel.org>,
        Alexey Gladkov <gladkov.alexey@gmail.com>
Content-Type: multipart/mixed; boundary="0000000000006586b205a45fc75c"
Sender: linux-kernel-owner@vger.kernel.org
Precedence: bulk

--0000000000006586b205a45fc75c
Content-Type: text/plain; charset="UTF-8"

On Tue, Apr 28, 2020 at 12:08 PM Oleg Nesterov <oleg@redhat.com> wrote:
>
> Oops. I can update that old patch but somehow I thought there is a better
> plan which I don't yet understand...

I don't think any plan survived reality.

Unless we want to do something *really* hacky.. The attached patch is
not meant to be serious.

> And, IIRC, Jan had some ideas how to rework the new creds calculation in
> execve paths to avoid the cred_guard_mutex deadlock?

I'm not sure how you'd do that.

Execve() fundamentally needs to serialize with PTRACE_ATTACH somehow,
since the whole point is that "tsk->ptrace" changes how the
credentials are interpreted.

So PTRACE_ATTACH doesn't really _change_ the credentials, but it very
much changes what execve() will do with them.

But I guess we could do a "if somebody attached to us while we did the
execve(), just repeat the whole thing"

Jann, what was your clever idea? Maybe it got lost in the long thread..

               Linus

--0000000000006586b205a45fc75c
Content-Type: application/octet-stream; name=patch
Content-Disposition: attachment; filename=patch
Content-Transfer-Encoding: base64
Content-ID: <f_k9kdajpw0>
X-Attachment-Id: f_k9kdajpw0

IGtlcm5lbC9wdHJhY2UuYyB8IDIxICsrKysrKysrKysrKysrKysrKy0tLQogMSBmaWxlIGNoYW5n
ZWQsIDE4IGluc2VydGlvbnMoKyksIDMgZGVsZXRpb25zKC0pCgpkaWZmIC0tZ2l0IGEva2VybmVs
L3B0cmFjZS5jIGIva2VybmVsL3B0cmFjZS5jCmluZGV4IDQzZDYxNzk1MDhkNi4uZWJiYzk4NzY5
MTRiIDEwMDY0NAotLS0gYS9rZXJuZWwvcHRyYWNlLmMKKysrIGIva2VybmVsL3B0cmFjZS5jCkBA
IC0zMSw2ICszMSw3IEBACiAjaW5jbHVkZSA8bGludXgvY25fcHJvYy5oPgogI2luY2x1ZGUgPGxp
bnV4L2NvbXBhdC5oPgogI2luY2x1ZGUgPGxpbnV4L3NjaGVkL3NpZ25hbC5oPgorI2luY2x1ZGUg
PGxpbnV4L2RlbGF5Lmg+CiAKICNpbmNsdWRlIDxhc20vc3lzY2FsbC5oPgkvKiBmb3Igc3lzY2Fs
bF9nZXRfKiAqLwogCkBAIC0zOTAsMTAgKzM5MSwyNCBAQCBzdGF0aWMgaW50IHB0cmFjZV9hdHRh
Y2goc3RydWN0IHRhc2tfc3RydWN0ICp0YXNrLCBsb25nIHJlcXVlc3QsCiAJICogUHJvdGVjdCBl
eGVjJ3MgY3JlZGVudGlhbCBjYWxjdWxhdGlvbnMgYWdhaW5zdCBvdXIgaW50ZXJmZXJlbmNlOwog
CSAqIFNVSUQsIFNHSUQgYW5kIExTTSBjcmVkcyBnZXQgZGV0ZXJtaW5lZCBkaWZmZXJlbnRseQog
CSAqIHVuZGVyIHB0cmFjZS4KKwkgKgorCSAqIERvbid0IHdhaXQgZm9yZXZlciBvbiB0aGUgY3Jl
ZGVudGlhbCBsb2NrIGlmIHRoZSB0YXJnZXQgaXMKKwkgKiBnb2luZyB0aHJvdWdoIGFuIGV4ZWN2
ZS4KKwkgKgorCSAqIFdoYXRldmVyLiBXZSBkb24ndCBoYXZlICJtdXRleF9sb2NrX2ludGVycnVw
dGlibGVfdGltZW91dCgpIi4KKwkgKiBCdXQgdGhpcyB3b3VsZCBiZSBhIGRpc2d1c3RpbmcgaGFj
ayBldmVuIHdpdGggaXQuCiAJICovCi0JcmV0dmFsID0gLUVSRVNUQVJUTk9JTlRSOwotCWlmICht
dXRleF9sb2NrX2ludGVycnVwdGlibGUoJnRhc2stPnNpZ25hbC0+Y3JlZF9ndWFyZF9tdXRleCkp
Ci0JCWdvdG8gb3V0OworCWZvciAoOzspIHsKKwkJaWYgKG11dGV4X3RyeWxvY2soJnRhc2stPnNp
Z25hbC0+Y3JlZF9ndWFyZF9tdXRleCkpCisJCQlicmVhazsKKwkJcmV0dmFsID0gLUVSRVNUQVJU
Tk9JTlRSOworCQlpZiAoc2lnbmFsX3BlbmRpbmcoY3VycmVudCkpCisJCQlnb3RvIG91dDsKKwkJ
cmV0dmFsID0gLUVBR0FJTjsKKwkJaWYgKHRhc2stPmluX2V4ZWN2ZSkKKwkJCWdvdG8gb3V0Owor
CQltc2xlZXBfaW50ZXJydXB0aWJsZSgxMDApOworCX0KIAogCXRhc2tfbG9jayh0YXNrKTsKIAly
ZXR2YWwgPSBfX3B0cmFjZV9tYXlfYWNjZXNzKHRhc2ssIFBUUkFDRV9NT0RFX0FUVEFDSF9SRUFM
Q1JFRFMpOwo=
--0000000000006586b205a45fc75c--