On 11/15, Kees Cook wrote: > > On Fri, Nov 15, 2013 at 12:36 PM, Oleg Nesterov <oleg@xxxxxxxxxx> wrote: > > > > unless I missed something, this is the fix, not cleanup ? > > > > If commit_creds()->set_dumpable(SUID_DUMP_ROOT) races with > > sys_prctl()->set_dumpable(SUID_DUMP_DISABLE), we can get > > SUID_DUMP_USER afaics. > > > > Yes, yes, even if I am right this race is very unlikely. > > Hm, yes, that is a fix then. I struggle to imagine it being > exploitable (i.e. control over both threads, one at least already with > a different cred, etc), but it certainly does look like a bug. Yes, yes, sure, this is only theoretical. OK, I am sending the patches to lkml. I didn't dare to keep your ack, please review v2 (v1 confused bit-mask with bit-number, and in theory we need ACCESS_ONCE). It would be really nice if someone can ack the "it is safe to mix bitops and cmpxchg" assumption mentioned in the changelog. Alex, Josh, this also partly reverts 179899fd5dc780fe "coredump: update coredump-related headers", I think fs/coredump.h buys nothing. Oleg. fs/coredump.c | 1 - fs/coredump.h | 6 ----- fs/exec.c | 61 +++++-------------------------------------------- include/linux/sched.h | 25 ++++++++++++++----- 4 files changed, 24 insertions(+), 69 deletions(-) -- To unsubscribe from this list: send the line "unsubscribe linux-arch" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
