From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1755389AbcGZKgp (ORCPT ); Tue, 26 Jul 2016 06:36:45 -0400 Received: from mail-db5eur01on0135.outbound.protection.outlook.com ([104.47.2.135]:10496 "EHLO EUR01-DB5-obe.outbound.protection.outlook.com" rhost-flags-OK-OK-OK-FAIL) by vger.kernel.org with ESMTP id S1753285AbcGZKgl (ORCPT ); Tue, 26 Jul 2016 06:36:41 -0400 Authentication-Results: spf=none (sender IP is ) smtp.mailfrom=skinsbursky@virtuozzo.com; Reply-To: Subject: Re: [PATCH] prctl: remove one-shot limitation for changing exe link References: <20160712152940.24895.61315.stgit@localhost.localdomain> <8a863273-c571-63d6-c0c3-637dff5645a3@virtuozzo.com> <87y44pbmtc.fsf@x220.int.ebiederm.org> To: "Eric W. Biederman" CC: , , , , , , , , , , , , , , From: Stanislav Kinsburskiy Message-ID: <449cb90b-faa9-aedd-a33c-d360a44ff199@virtuozzo.com> Date: Tue, 26 Jul 2016 12:21:31 +0200 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Icedove/45.1.0 MIME-Version: 1.0 In-Reply-To: <87y44pbmtc.fsf@x220.int.ebiederm.org> Content-Type: text/plain; charset="windows-1251"; format=flowed Content-Transfer-Encoding: 8bit X-Originating-IP: [178.19.210.162] X-ClientProxiedBy: VI1PR0901CA0078.eurprd09.prod.outlook.com (10.167.203.174) To AM5PR0801MB1265.eurprd08.prod.outlook.com (10.167.216.140) X-MS-Office365-Filtering-Correlation-Id: 75beaeaf-bca8-41f6-5030-08d3b53e9f7d X-Microsoft-Exchange-Diagnostics: 1;AM5PR0801MB1265;2:bgojqQVEq9giERAdghRY1as3i+/nOm/N2uvJhVxzO7toTtxvap2ypMqxTv+c6RuHrd3viAqqfoFL5nYyC8eQM5ZiyB1VTj6kt8ijdr47V0IjqTNbkjgd0w3Eftit/YFuKjYE7ePtZjD+2XthPRO79gsc896L0wUbtEfQ10wx//kh18UtT+3QQ0yXDMUsZDiL;3:vlHxkF5hkGTaIQ7GqX35h+Lz7uBfAdk1DZ3eSTvKZjPl5T0hSxmjefugF+HPzCJSkobLlw5pP3CFcj/JvrfDfvyd2nF/7SPqbftDw7u+WR/RlEB0A4SIdPxNubd2hSgV;25:7t3mlH3MaCLendJu8fYe79oeeP6d3LISGEOi740foRiawjJoIQTKWeI49bBVtn558rnom9JR/396e9/JzhI7xvyYUg0zIRS6upYGzlfmdzm97Gr5QLUBXQoLw7z4bQ+OnZTyW+krwNoFIFylLvRXtLxe80IyCz1WZyS/u3cZk2UA3tcYWMQzZA/CSvRjODOvQGb9SLPehtuSnBor6If3rwTw9qxURB9veVl9S4V58Ln4PtrdKUeYZ/ue1ho2b2PuQ/pixP9O8YVm2d5qi9d1uNyIlUqXeQ9I+N0eQ5JRvAf1AMAHugjKlehvitMEwauaqXxLId4AD39la/RlF6413T71fpMl7Ra356jEGYgto3C+PyKOQrmSCcgXSk73R7eUNfmsrG5kn1FtlxGOO9n1cy84B9umdPuv7ZCZNDyA2+s= X-Microsoft-Antispam: UriScan:;BCL:0;PCL:0;RULEID:;SRVR:AM5PR0801MB1265; X-Microsoft-Exchange-Diagnostics: 1;AM5PR0801MB1265;31:vOQk6DNgnBwQBQRk0ZisEzYXp85B3ApmEuU5JJ7ASSLVtk/IO28zPzXA7/4T4qYhC0qwfNuoZo/okpIYCY9YRq75JTGbZa0gPuh9xb2MZXZ65Q6V9bQ+FYSQDCbebOJUorgVgP81ukfYRip2MtOXxovpv2Cnlzul41JxgdXrq61L2iLZTukMlp9zt3lLnc4Z76/MOR3xB7c7Or8cgf2g5Q==;4:HLncLcdMOR2t4vZesh0XIM0g0bJqNkmyZgyFggz32nvRGmbg/9kGW5qTO0zVvqBxISZyRcMOfajzosNyYNsbzj3ljHdulkeJ8bfsoETyeWeeJBgBfKWor7sLaYnKQwhvOFklGE8v/7mlemDzctIcUL+RUk7oy2UpVsCcPWnsDTNByebNaMyCGLdbYtMOP1wFc4+fMuJ1nTSHOI8r8gqPkv2ZvZIsHxGYCfstIaVs3qwXzJljMlCRCbj5sLCP/6PaBD7TC1rfOKm6qtS0p81IYRoONsPY7h7qP0CzBH43PVsDuXAFIVxz3Q6Y/1cY5lAXyuItYo0Djiagc8IE23YgJ6fj/iu0UOLiQPi1DB53mmQvWvwFynZYTHQSeNr1WTqVt2jC0QWn3qQ7noTjBzNIKT+jL3omrFB0wfojoppD/Dg= X-Microsoft-Antispam-PRVS: X-Exchange-Antispam-Report-Test: UriScan:; X-Exchange-Antispam-Report-CFA-Test: BCL:0;PCL:0;RULEID:(6040130)(601004)(2401047)(8121501046)(5005006)(3002001)(10201501046)(6041072)(6043046);SRVR:AM5PR0801MB1265;BCL:0;PCL:0;RULEID:;SRVR:AM5PR0801MB1265; X-Forefront-PRVS: 00159D1518 X-Forefront-Antispam-Report: SFV:NSPM;SFS:(10019020)(4630300001)(979002)(6009001)(6049001)(7916002)(189002)(199003)(57704003)(106356001)(101416001)(31686004)(33646002)(105586002)(36756003)(76176999)(54356999)(53806999)(50986999)(43066003)(561944003)(42186005)(110136002)(31696002)(66066001)(189998001)(47776003)(107886002)(97736004)(86362001)(4001350100001)(83506001)(8666005)(77096005)(64126003)(19580395003)(4001430100002)(50466002)(23686003)(81156014)(81166006)(3450700001)(6116002)(305945005)(2870700001)(8676002)(3846002)(7846002)(2906002)(68736007)(586003)(7736002)(19580405001)(4326007)(2950100001)(7059030)(969003)(989001)(999001)(1009001)(1019001);DIR:OUT;SFP:1102;SCL:1;SRVR:AM5PR0801MB1265;H:[10.1.197.90];FPR:;SPF:None;PTR:InfoNoRecords;MX:1;A:1;LANG:en; X-Microsoft-Exchange-Diagnostics: =?windows-1251?Q?1;AM5PR0801MB1265;23:QoLTWp7P1TVDEHagFNnyta/qgXAmcU+3Sqq?= =?windows-1251?Q?YLQfjaU7oLX9USk8uVj6651di6XExOUzYP9emggZaaHe8PeapoGDNHno?= =?windows-1251?Q?2Ze6FUGIphU83MeLWB95Kmq/+DaPeXWopcReNShkDdknVHPVe5ilOfbH?= =?windows-1251?Q?erGVUM7oID1KKhkdn3dVKHMkupoBm5o7ijhGP79xqqIst0v9zrdMHFX3?= =?windows-1251?Q?mZ1L+QY07zLYVSCjPA/ucm/bHEAATwvF4n/BukZZ4M3UOJI73y55nf6C?= =?windows-1251?Q?+vaoeWPspY245zGcnHsWMRJHJQ+KUsOoNj8ikwwTQ3m7mx9Sw/fUHttf?= =?windows-1251?Q?PY2FjQKsFkuZHEP15yr598hTSmKW78rOLH5LywVCr0Kq6MxKp+XzQx+H?= =?windows-1251?Q?PCHbcTe85ZuX5dqbMRS/UXIQYq8lURqy/8Op9b1FtZsuFHfDTtxlipYT?= =?windows-1251?Q?8zFyzR9tjMQZlTXhhba82/sWss0OGr05mFYt6BI6UK1kuk24n5IRB3xd?= =?windows-1251?Q?rsrVPbPAGMKlOCnlQOElwvi4BU5pCaqmTVmjgQyzhGLZDRdpZ1qkoOcd?= =?windows-1251?Q?v2/vvqQpseZnATSa0641co1KMdkk+nVo2o8N3VMhMFhWfAojIENsuHnA?= =?windows-1251?Q?yxICULGE9Nu6YFMzzOImG9XpJBkAZIkkc482J4Pv8WXWQFzfH+SeICFV?= =?windows-1251?Q?YO7zcTkNnAGM0Fe5dB4PWdNO3KxZ2Cd+5Rt1F4/Z1W5C+HGGa0fyIM10?= =?windows-1251?Q?yFo8h42JIT91IimDwoakEaE51hZJSxtGtTtqrSLHjUacevLMAR1lQQW1?= =?windows-1251?Q?dweYyVB5zxfX8BgfaYKON8ZwUixR9KZmfKGvlg8oy7Hnx4jyKGXON/P1?= =?windows-1251?Q?hf4XRQlzHegR1h3F6ym0dnrXlP0JAqB7BCTRohZYSI02pRxS/SK2brO4?= =?windows-1251?Q?vN8+DJdfGJJiAspHMIq1T1V96UzYijPAuJuNUwk8ByNURqwwOsLOAWbY?= =?windows-1251?Q?jUw1zQuFB2I07tTqA41lKjAjNRFJ4hsoVsqIy08AZD51EtPwZ9Ej7Lgu?= =?windows-1251?Q?Tca6pZNlM/erywrcdUniEBWtL5kDfXmXYe3poYpF97sEN/QRDEWQgpDX?= =?windows-1251?Q?Pg0ufTs/soRTcH2oQNehEYcj1LHpYfs9YL2N29eUoeR0nFOyRhaTiIjy?= =?windows-1251?Q?ShTbb2ju3vCRcrpGNQ91UiPpFUP0gkDUtNBcookbeD6PevtKHsvXcBBc?= =?windows-1251?Q?W9zYBTbqoIVKBcNA7TZyL4aJD9jiqZhSvgVfKmhWRFLUVerw5u01I616?= =?windows-1251?Q?gdkQxPNg2fQgFL/ynYZDcKmo7ewLhtuYIshUSAQLT+zhnwB8NU6agE/w?= =?windows-1251?Q?85wrkkRz6uInxSaVfapJ1euDfD76J84m0cWDdx5gVifdfLk59+0XLnjR?= =?windows-1251?Q?LmaG1Ko13mALvoghbtmNzP3IoFy7p3aBgVcSMqxUjpdYpsbHOyQC7o7x?= =?windows-1251?Q?vtYVSB+r0wPx6qnzi+KGgBeJbs8O5KbihgsLhhD1MNlXjELrgBixIs1+?= =?windows-1251?Q?MsKYLaKqisR0Frag=3D?= X-Microsoft-Exchange-Diagnostics: 1;AM5PR0801MB1265;6:ccUb8NyDX8ggTUPgzV/WUaOG/p2hc5vAvdhiSNecUj/UbjXuMb0gXfiAiKruq2We72N7meLLhAsHQy9rzDghdE0zn8BK4ZatW8jurAYHlgGWkXiyr7aWOnA3mWSy8LY7XhM9Sbm4T1ikUxSaNIyMqzxPRKD+5dVN+3jclLy8OMk1BTSJtxlV7mMYNewJd8DgvIkA2Owz94/w0NMydyXbICurPHatcVpxVx1lm9VS/RPmP7doBYzeWv8EajkKD7LR39Fjjonm4lvKDzMpTfc9S0FOPrtweTF5OMSVXA0gv2kR9xlxWebinTC08qVzC9Zg;5:YRVEzLtuPavNe78GW8lYXClDcNT5N3nwrqH4RrvKggJ0JgKCw5kptS4Q0nuinzZtrQLtleIbYhX+GE8pDqATfMaImXpxdGL+B7bswRRUTMm1zhnvfkfLEEVmuLKsC4tWsS4z870KlTqf19i7qzTz/g==;24:/8IEi6pyKQVsDJ7UCXrN0nUTITx3BSoXhqbMLjQ0gjxE3vaJJqQ7qja5yQcjzdjoNfe1hFIZzVw19SDhMwWj/Y+BmzWvRt8aRIZYE0A6jyg=;7:KWDitfASuB+Efuqv8zAkPeCKCXApNdwThP9VIunZYeIvXtuZ+1ZqyU+tlLhEf4eu8TcnDFvLwhwau8CAOjzIJ2YUBXudHHy20D51chACcURhb41y4WBwN9bA4l2TFqkxzvqJwokBwcaZT37VAL/ze3YzHTcKsUSS+OKOwfLdn1YBc52EGpcUVCduix2d+XbNfzExonfOm10IfjvFIkUvkJ0JsHwV5QyCjmwMmwNGXB40i0t+AfavM6Shnda/Ja8Z SpamDiagnosticOutput: 1:99 SpamDiagnosticMetadata: NSPM X-Microsoft-Exchange-Diagnostics: 1;AM5PR0801MB1265;20:vdOszyurLr4a35wXhuDWo2uk7ZZB/yjVISjiqRPm/7SAYcq2/KufXFtgVPhQzDU2r+9CdQXwsOzrqI17Vx4R0VYlrlJD/2bHVFOqd3nHvUygbaqe2FLBTpa3kdPENnbHqGS6lbUKWpkQJc7yF5JaV2y1/O18nSHDccV+u1C76No= X-OriginatorOrg: virtuozzo.com X-MS-Exchange-CrossTenant-OriginalArrivalTime: 26 Jul 2016 10:21:34.7883 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-Transport-CrossTenantHeadersStamped: AM5PR0801MB1265 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org 25.07.2016 20:21, Eric W. Biederman пишет: > Stanislav Kinsburskiy writes: > >> Gentlemen, >> >> Looks like there are no objections to this patch. > There has been objection. > > The only justification for the change that has been put forward is > someone doing a restore lazily. I don't see a reason why you can't call > prctl_set_mm_exe_file until you have the file in place instead of a > place holder that sounds like a trivial solution to any restore issues. If I understand your proposal correctly, you mean, that the call to prctl_set_mm_exe_file can be posponed till the actual file is in place. It can be done this way you propose (although it's ugly). But you objection looks like you want to preserve some behavior you believe is reliable. But it's not. > The truth is an unlimited settable exe link is essentially meaningless, > as you can't depend on it for anything. One shot seems the best > compromise I have seen put forward between the definite > checkpoint/restart requirement to set the this value and the general > need to have something that makes sense and people can depend on for > system management. Depending on exe link for system management is useful, but can't be reliable and can't prevent malicious software to compromise the system. If we wouldn't have the ability to change exe link, than the only thing we could be sure, that process at least started with the binary we believe is reliable. But since we can change it, the only thing we can rely now is the file is executable and process have permissions to execute it. And this guarantee in preserved across any amount of exe link replacement. > Also there is a big fat bug in prctl_set_mm_exe_file. It doesn't > validate that the new file is a actually mmaped executable. We would > definitely need that to be fixed before even considering removing the > limit. Why do we need it? To guarantee, that process has read permission to the file? > Right now all I see is people involved in the implementation details of > their own little feature > > So for the patch I am responding to: > Nacked-by: "Eric W. Biederman" > > Plus the merge window is open so no one is taking any patches right now. > It is the time to take what has already been staged and get that code > merged. > > Eric