On Tue, Jan 23, 2024 at 07:30:52PM +0100, Bernd Edlinger wrote: > - Currently a non-privileged program can potentially send such a privileged > tracer into a deadlock. > - With the alternative patch below that non-privileged can no longer send the > tracer into a deadlock, but it can still quickly escape out of the tracer's > control. > - But with my latest patch a sufficiently privileged tracer can neither be > sent into a deadlock nor can the attached process escape. Mission completed. Thanks for the details. And it would be pretty unfriendly to fail the execve() too (or, rather, it makes the execve failure unpredictable). I'll keep reading your patch... -- Kees Cook
