Received-SPF: pass (google.com: domain of linux-kernel+bounces-20265-linux.lists.archive=gmail.com@vger.kernel.org designates 2604:1380:45d1:ec00::1 as permitted sender) client-ip=2604:1380:45d1:ec00::1;
Date: Mon, 08 Jan 2024 17:48:38 -0800
From: Kees Cook <kees@kernel.org>
To: Linus Torvalds <torvalds@linux-foundation.org>,
 Kees Cook <keescook@chromium.org>
CC: linux-kernel@vger.kernel.org, Alexey Dobriyan <adobriyan@gmail.com>,
 Josh Triplett <josh@joshtriplett.org>
Subject: Re: [GIT PULL] execve updates for v6.8-rc1
User-Agent: K-9 Mail for Android
In-Reply-To: <CAHk-=wgznerM-xs+x+krDfE7eVBiy_HOam35rbsFMMOwvYuEKQ@mail.gmail.com>
References: <202401081028.0E908F9E0A@keescook> <CAHk-=wgznerM-xs+x+krDfE7eVBiy_HOam35rbsFMMOwvYuEKQ@mail.gmail.com>
Message-ID: <D01C78AC-830C-4D73-9E9F-7FD38CEF2E82@kernel.org>
Precedence: bulk
MIME-Version: 1.0
Content-Type: text/plain;
 charset=utf-8
Content-Transfer-Encoding: quoted-printable


On January 8, 2024 4:19:45 PM PST, Linus Torvalds <torvalds@linux-foundati=
on=2Eorg> wrote:
>On Mon, 8 Jan 2024 at 10:35, Kees Cook <keescook@chromium=2Eorg> wrote:
>>
>> Josh Triplett (1):
>>       fs/exec=2Ec: Add fast path for ENOENT on PATH search before alloc=
ating mm
>
>No, we're not doing this=2E
>
>If you want to open the file before the allocations, then dammit, do
>exactly that=2E

This was exactly the feedback I had originally and wrote almost what you s=
uggest:

https://lore=2Ekernel=2Eorg/lkml/202209161637=2E9EDAF6B18@keescook/

>Anyway, I want to repeat: this patch is UNTESTED=2E It compiles for me=2E
>But that is literally all the testing it has gotten apart from a
>cursory "this patch looks sane"=2E
>
>There might be something seriously wrong with this patch, but it at
>least makes sense, unlike that horror that will look up the filename
>twice=2E
>
>I bet whatever benchmark did the original was not using long filenames
>with lots of components, or was only testing the ENOENT case=2E

But the perf testing of my proposed "look it up once" patch showed a net l=
oss to the successful execs which no one could explain=2E In the end we wen=
t with the original proposal=2E

If you think this is too much of a hack, I'm happy to drop it=2E My very f=
irst reaction was "fix userspace; shells use access() not execve()" but it =
seems enough other runtimes (Python?) use execve PATH searches that it woul=
d make a measurable real-world difference=2E

-Kees

--=20
Kees Cook