On 03/29, Al Viro wrote: > > On Sun, Mar 29, 2009 at 01:53:43AM +0100, Oleg Nesterov wrote: > > > Let's suppose we have two threads T1 and T2. T1 exits, and calls > > exit_fs(). > > > > exit_fs: > > > > tsk->fs = NULL; > > // WINDOW > > put_fs_struct(fs); > > > > Now, if T2 does exec() and check_unsafe_exec() happens in the WINDOW > > above, we set LSM_UNSAFE_SHARE. > > > > Or we can race with sub-thread doing clone(CLONE_FS|CLONE_THREAD), > > the new thread is not visible in ->thread_group, buy copy_fs() > > can already increment fs->count. > > Frankly, I don't think we really care. Note that having several sub-threads > and doing execve() in one of them will kill the rest, so you really want > to do some kind of synchronization to get something similar to reasonable > behaviour anyway. OK. Let's suppose that check_unsafe_exec() does not set LSM_UNSAFE_SHARE and drops ->siglock. After that, another sub-thread does clone(CLONE_FS) without CLONE_THREAD. Unless we killed other threads, I can't see how we can check ->fs is not shared with another process, we can fool ->bprm_set_creds() anyway. Confused. Oleg. -- To unsubscribe from this list: send the line "unsubscribe linux-fsdevel" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
