Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
Feedback-ID: id2994666:Fastmail
User-Agent: Cyrus-JMAP/3.9.0-alpha0-624-g7714e4406d-fm-20230801.001-g7714e440
Mime-Version: 1.0
Message-Id: <6feef7e0-ea72-412d-837e-34b6fdd3b869@app.fastmail.com>
In-Reply-To: <20230811115710.GA21779@redhat.com>
References: <20230807085203.819772-1-david@readahead.eu>
 <20230807-porzellan-rehkitz-9fde1b94dd6b@brauner>
 <20230811112911.GA22566@redhat.com>
 <20230811-perplex-installieren-899f5925534d@brauner>
 <20230811115710.GA21779@redhat.com>
Date:   Mon, 14 Aug 2023 07:13:09 +0200
From:   "David Rheinsberg" <david@readahead.eu>
To:     "Oleg Nesterov" <oleg@redhat.com>,
        "Christian Brauner" <brauner@kernel.org>
Cc:     linux-kernel@vger.kernel.org, "Jan Kara" <jack@suse.cz>,
        "Kees Cook" <keescook@chromium.org>,
        "Alexander Mikhalitsyn" <alexander@mihalicyn.com>,
        "Luca Boccassi" <bluca@debian.org>
Subject: Re: [PATCH] pid: allow pidfds for reaped tasks
Content-Type: text/plain
Precedence: bulk

Hi Oleg,

On Fri, Aug 11, 2023, at 1:57 PM, Oleg Nesterov wrote:
>> What code do we need to allow userspace to open a pidfd to a leader pid
>> even if it has already been exited and reaped (without also accidently
>> allowing to open non-lead pid pidfds)?
>
> I'll try to think more, but can you also explain why do we need this?
>
> See my another email. Can't we simply shift the pid_has_task(PIDTYPE_TGID)
> check from pidfd_prepare() to pidfd_create() ? (and then we can kill
> pidfd_prepare and rename __pidfd_prepare to pidfd_prepare).

Yes, the easiest solution would be to use `__pidfd_prepare()` and ensure that the caller only ever calls this on tg-leaders. This would work just fine, imo. And this was my initial approach.

I think Christian preferred an explicit assertion that ensures we do not accidentally hand out pidfds for non-tg-leaders. The question is thus whether there is an easy way to assert this even for reaped tasks? Or whether there is a simple way to flag a pid that was used as tg-leader? Or, ultimately, whether this has limited use and we should just use `__pidfd_prepare()`?

Thanks a lot!
David