From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1754758AbcGLRZ5 (ORCPT ); Tue, 12 Jul 2016 13:25:57 -0400 Received: from mail-db5eur01on0136.outbound.protection.outlook.com ([104.47.2.136]:10608 "EHLO EUR01-DB5-obe.outbound.protection.outlook.com" rhost-flags-OK-OK-OK-FAIL) by vger.kernel.org with ESMTP id S1753823AbcGLRZz (ORCPT ); Tue, 12 Jul 2016 13:25:55 -0400 X-Greylist: delayed 1094 seconds by postgrey-1.27 at vger.kernel.org; Tue, 12 Jul 2016 13:25:55 EDT Authentication-Results: spf=none (sender IP is ) smtp.mailfrom=skinsbursky@virtuozzo.com; Reply-To: Subject: Re: [PATCH] prctl: remove one-shot limitation for changing exe link References: <20160712152940.24895.61315.stgit@localhost.localdomain> <20160712164233.GA4557@redhat.com> To: Oleg Nesterov CC: , , , , , , , , , , , , , , From: Stanislav Kinsburskiy Message-ID: <69b3bfd5-02aa-51ad-12b4-dc8d330b6c67@virtuozzo.com> Date: Tue, 12 Jul 2016 18:52:29 +0200 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Icedove/45.1.0 MIME-Version: 1.0 In-Reply-To: <20160712164233.GA4557@redhat.com> Content-Type: text/plain; charset="UTF-8"; format=flowed Content-Transfer-Encoding: 8bit X-Originating-IP: [178.19.210.162] X-ClientProxiedBy: AM3PR07CA0015.eurprd07.prod.outlook.com (10.141.45.143) To HE1PR0801MB1276.eurprd08.prod.outlook.com (10.167.247.142) X-MS-Office365-Filtering-Correlation-Id: cb42e770-1744-4f17-f9c6-08d3aa74eddc X-Microsoft-Exchange-Diagnostics: 1;HE1PR0801MB1276;2:vH/1O56s2zFB1AF+VCk0cPHiRBN2YywszUL3HYK1KGTLTiLPXPQOatn+wsgmKqsladYcuFUVSKtSQgKLOOQNYl14Cy/R8frFHL983ieF+5Z27un5PPimJ8gf50SMfn730/SWbfEIVClopIeiBMZcEz1dS2rsxcjinAY8OcrW6Hie4Hud7MnlG1sAbaaFLvvr;3:5+Dn1excrn7srH7Nt9Il91lfOWVxfPC/cIgcKee0QA4BgTqsLVADxucX7euCRhmBYxyy91sap44AA1O1IPK4ylLh637H22C8yD1UgbF6gQH3ENgkdjKWIOahbDjBIqpt;25:TWJ21fRCCPWQN9WLRL+PxZo/uajJI3d6tdvkTP3tS2yjP4SzEntMpFGRDvgHZP+AB/0dYa/CW43fgkyXqnrV+OMX2LFWZnKvOmteXSjHouIaL+11N2jm7II/FBC31+nD5TVIMqF7X6ma62IGIhqqZrYho6uFGpg6672GN7I3OxQjDg2QPkubJd1AOKPiAXoyy9e+Kh8j6REGgJWgv7oxIiQIezxUaO8plggujuOUZQQugwrBG9oW+8dwa73fwleuuxq1VeWXmBg3s+by3GcW3muQU6whzfX1fGwLKcmmC/kBgZLwue19cy6jTvcbz9+CivkgxrmKiQgSN0y+ESLL8iaqy0+3QswCkYY6fcTE8uicgYcmo7Yq89EBEAU6R4acvGikn6Y3ayU7kmDNAyzFi/uo+IblGCJkcEK6AVIFUe8= X-Microsoft-Antispam: UriScan:;BCL:0;PCL:0;RULEID:;SRVR:HE1PR0801MB1276; X-Microsoft-Exchange-Diagnostics: 1;HE1PR0801MB1276;31:VHEBCtNv1+hyUPQCyOUm6GbWpwLnaEDyidx/WpaR1kvEgfPqDoKRFa7gvnv32Vtn/tfjAiVwMYIIwyhSL28Qb3XGdnKklJ2kliR3VM5jiqlrixdmMzveMkXEzJ1Y97riv8xQkzFMAuWndGyEinphJscC/ZHmtt/ByYro8dLY1tvvJEERGRbUoRQkgeK/uJqpf284SkTeZuGightWtE7U4Q==;4:V9Eyoz/+r+iuEWdvOqLpe1NwwTLe6URzCnIvvYfJGOF5gLgZ94w0jDIpVIF/CQ6e7hkUcvDG4NfudJcv+tjqVmuhlrcM2i57zHIA958qd7IsEnqWr4TRYfvtH0AAM9qTDgYRXQqDkQCkEobIUSxH0YXpL3uOSCP4uSuutXue5wRjTU7QGfW1tk7CKn8tGUUDTUfxOsdlpybeP+WG3NFoc4VZRvPQ85SNtYsAZPbv1WIyZyWLToRy1UvKH4IXMbUpsbq3xYsTwweAeRchvvUDdK1fYF/tUyMIewl/l/xo/SrV0JVyZZlyWS+NM2G5R7P6Q+p3/gtdhXw/dM/Qk6d2LDW2DmL4iXtGd7tAqeGMfSeCpFiV45WN2Cmhfya1O3hCNBQK66NKBt78aSpWoMdrA4WS2IwNn8W+06cLCO/pxsjmLXOEy8G0vtb42/NpPh+J X-Microsoft-Antispam-PRVS: X-Exchange-Antispam-Report-Test: UriScan:; X-Exchange-Antispam-Report-CFA-Test: BCL:0;PCL:0;RULEID:(6040130)(601004)(2401047)(5005006)(8121501046)(10201501046)(3002001)(6041072)(6043046)(6042046);SRVR:HE1PR0801MB1276;BCL:0;PCL:0;RULEID:;SRVR:HE1PR0801MB1276; X-Forefront-PRVS: 0001227049 X-Forefront-Antispam-Report: SFV:NSPM;SFS:(10019020)(4630300001)(6049001)(6009001)(7916002)(24454002)(189002)(199003)(54534003)(47776003)(4001350100001)(66066001)(3450700001)(586003)(19580405001)(3846002)(19580395003)(23676002)(2870700001)(305945005)(4001430100002)(4326007)(7736002)(7846002)(81166006)(2906002)(8676002)(81156014)(6116002)(83506001)(50466002)(31696002)(2950100001)(64126003)(42186005)(8666005)(77096005)(86362001)(31686004)(36756003)(97736004)(33646002)(106356001)(189998001)(107886002)(110136002)(68736007)(43066003)(105586002)(101416001)(53806999)(54356999)(76176999)(50986999)(7059030);DIR:OUT;SFP:1102;SCL:1;SRVR:HE1PR0801MB1276;H:[10.1.197.90];FPR:;SPF:None;PTR:InfoNoRecords;MX:1;A:1;LANG:en; X-Microsoft-Exchange-Diagnostics: =?utf-8?B?MTtIRTFQUjA4MDFNQjEyNzY7MjM6L0sybjN5MW5tSEg3aDhma1B6VXpYYmlj?= =?utf-8?B?c1NnYUtmSUlkQ0N0Nk0zZS9BaDdEWE1WY0FuTmRObXM3a294bEs0YjNOc2I5?= =?utf-8?B?K0VmTVVlWXgzK0xjeVVaQWJqdlRnUlRGY1Vtd0pvWEpidTBobEVJckljUFVh?= =?utf-8?B?VE1GTmUrL0dKNFNjSjUvK1hsSTBEU2tXQ0lVcUdrRlVqZG5ETjdTQjRTWGNZ?= =?utf-8?B?R1ZkUGdyQzN0cjRuakVrcnRScS84RU0zTklvVE1ncWVzc3ljQkVNZ1dXQkll?= =?utf-8?B?b0t1RFN1Umw3dmtnLzNxL3Z2bjErT2t0cWl6RURZV0FIZHd4ZjI4b0Z6WmdJ?= =?utf-8?B?NEVyQXRiVSthZEpQTXc4dTdTaWNzVVFLUGVyaTdmWjdhMlA4aTVCMjkvcmc1?= =?utf-8?B?S2N5S05tU1ZGcWJqT2srekxwYVJ1d01OYUdCRjJCUmFYZFFsOEowRmlKVlQ2?= =?utf-8?B?UGQ1dW5PNERyMGxKRlBIckhxWC9ZUTdHRWJjL01iaDZwSFZvQ3hqb3hSUmlu?= =?utf-8?B?bzlVZUNQVkgzQXVMZVpuSmVOaGZuQ3ByQmF0WXFwS1AwdU9ydENVTjFwOGh1?= =?utf-8?B?UzRrYzF4WDlEZWhqWkNmdlpnOWxUNkVmbStBbk1WTFR5N01zWDdJcjB4WWRR?= =?utf-8?B?SEtKQVNLQloydnRzcE01YWF2cmsySktoU2pDTStHYmMzblQrcTBzRlFvMWNL?= =?utf-8?B?WksxbkdCQzRIQ3U1ZG1xeWIzd3llRUtQTU9teG5NLzl0akZnQ251di9JZTlH?= =?utf-8?B?bGNGTlRpQWRoL0VPVEgxZkpXRkYvNmRLMWpyb2RuNStONlNDWTNwM0xiWm1o?= =?utf-8?B?R1BrQnQ1WS9HVFpaQ3llbUJHZGpvSkhzeWptRENlWWh0VGhSUkp6bURoSXMv?= =?utf-8?B?STRBczNLV3JNUzlzbVUvZVFpM3ZQMjkzcXhQM1hrRitQS05qUUY3Z21DVlhz?= =?utf-8?B?K0haOVJXR1I2TkdPeGNvNkJtUnoycVRuaGRvWGVWeGMweTU3ektSd21XS1RE?= =?utf-8?B?OHMwVDZ4WERmNG4zWGJiWDFRS0MrekpoZHZWY1RJc1g2VFY1Y2V4aUVZTElX?= =?utf-8?B?d3JPSTRRU3Z4Y2ZIOExNTlRYTjdWMFdIWndNTmFGK3U5YjczdEZsdFVrWDlG?= =?utf-8?B?ZHBWTlR1UUVQeThYWkkxWnlObFB5RVdDZ0JtS01JcGU3c2czQnBERlVkaEdE?= =?utf-8?B?dUUvYTF6WUFmMmZzRU9XYkNBRkEveno0VXAxQjE4NytGVW52MGpxTmNmNVhL?= =?utf-8?B?MUxyL0JNUk92R1R5STRKTitiOGlJMExEMGtYZTNtNjRiTmNLWkxSd3gzVzVq?= =?utf-8?B?NWg4VlV3WmFsQk1EcllTaDdXbDdaOEpLZXllV1d3aDRLVG9Db3I0WVMvbnNz?= =?utf-8?B?ZWNzWlE3UDJ0bkE4OVBNVEthbEFWeW44a0NpcEs0Vy9raDNrdmJGTjB3bVVi?= =?utf-8?B?ZlBZK2tFbGdmWmMrRHBsa3A2T3FadWZTbkVpbUFocEUwLzdhZTR5QmRlWDBi?= =?utf-8?B?K1ZrS0hGU25xR2JuQUxET29vYzdCdHlWc21hUklGbjM1YkdtQ1NxRkZ0bmRu?= =?utf-8?B?K3lMOHRCelVNYndJdmwwa3YvU1FHelhrc3NMUEpzYXl2d2VRUlhkWnU4K3Fv?= =?utf-8?B?K0J0NUpQbHlOeFVkRWNJaXJDYUhDRHM0NGJDejFwMWVIQi93Tm1qaWpralh3?= =?utf-8?B?L0JCM091bmEvRjJ5Q2RUZ0x3cXkrWGRPS0pnYlFyTGk4MjdXdDRGQVRHQXdB?= =?utf-8?B?em1qUzQ2YWhPYndobnZTd01MS2x6Z2xKK1hVZmlBckowRU1Kd01BYUVwQTZr?= =?utf-8?Q?1TB1wbbxqp1havB?= X-Microsoft-Exchange-Diagnostics: 1;HE1PR0801MB1276;6:TN6IaayIx9ig1GjEmCyqP9B0ZX6GX7/M1sB0ysmUZd7QfKMTsMI8dHRtpYnFRXozK5o6qY6ASeAORgKsVRkBcmglsf65T4MBLNr9ixJy8r4Bd6YhWnzpzFuYuatKhboqxwP3QEvXrbgU14w1upEj67bX0I3TMvjq8zjY9l42k/mG5sFbpX18xdrDJlW5Pm2H8ZXsWWSIiqFWDHAtUdQjEZKhFPnErBCbcZh8bFrdBvA9cHv+KcXR19gBd2zuXoBFrDupwAvRFXUFVs0jqbvZHQUrdOjnm60vaHbwXOtW2quI1G44GbVNfn6JVFTiZKE3;5:3ZmMW1K4UFfsk1gz9SMR7ABsZrjLDcIFpmgLY4r0RlPfSMrtUjzU2PUothpZQX4flcQ3mGtBGb5ziD6Cp2K72DIHk9ZJtz/XlL/F0bdxNUPHqyzigkYrfNKuItYj74XbTues4Len89nd1gyoWPJwdg==;24:obzmfv6Y9aVupOsD2aADgriN95LSdKVcfRe4ZqYMk5USKUndivTly/V4fLOLOhuMc9RZw9Nk1BZm2p+XFrKVW9ZP1McCr/sfrvepQirvKyw=;7:2koYY/6yreBxqCDFXiNGlbFN2c6sNvXh3JRO/nhbatZmNknSnIkDCo86uUxwKW0XgUA28AEIDfqDK0wSy9q99bK8xeqLkYByYV90TCfRm7D0fBGzpLRtHgcQ4ygRwKsAB4r57sMKKOdy6PLwbRmv8TdKpFq0YgPxgaLhhLuZFQutjzzDtL8bLPM5xVmusWraw/00snD8qp5gHEmpwxWeq7qj2sosuVawEomjAadDjEd8cO3piH2eN1F0daXK9103 SpamDiagnosticOutput: 1:99 SpamDiagnosticMetadata: NSPM X-Microsoft-Exchange-Diagnostics: 1;HE1PR0801MB1276;20:28LVLO+w//ADv7VImdBkrwY40KVARk/PJn79SVyh034XBx76vkBhGOA5hQT7npefMdFvAM+EjBHzdiv+CWczE6FXvFXD7JMHReCW4gsh1n2YLLS5NGcrpKali5AkAilWkmgA5se/u5MMn73oN10o7AXAoC1v8gTSouP/CZ2RVYc= X-OriginatorOrg: virtuozzo.com X-MS-Exchange-CrossTenant-OriginalArrivalTime: 12 Jul 2016 16:52:36.3964 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-Transport-CrossTenantHeadersStamped: HE1PR0801MB1276 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org 12.07.2016 18:42, Oleg Nesterov пишет: > On 07/12, Stanislav Kinsburskiy wrote: >> --- a/kernel/sys.c >> +++ b/kernel/sys.c >> @@ -1696,16 +1696,6 @@ static int prctl_set_mm_exe_file(struct mm_struct *mm, unsigned int fd) >> fput(exe_file); >> } >> >> - /* >> - * The symlink can be changed only once, just to disallow arbitrary >> - * transitions malicious software might bring in. This means one >> - * could make a snapshot over all processes running and monitor >> - * /proc/pid/exe changes to notice unusual activity if needed. >> - */ >> - err = -EPERM; >> - if (test_and_set_bit(MMF_EXE_FILE_CHANGED, &mm->flags)) >> - goto exit; >> - > I didn't even try to read the changelog so I do not know why do you > want this change ;) > > But I would like to ack it in any case. I never understood why do we > want/need this MMF_EXE_FILE_CHANGED check, I suggested to remove it > many times. > > And can't resist, please note the xchg() below. Currently (before this > patch) we do not need it. I was specially added to ensure that we can > just remove this test_and_set_bit(MMF_EXE_FILE_CHANGED) without adding > a race. Thanks, Oleg. I'll take a look. But should this be addressed in this patch? Especially if it's not needed even now (before this patch)? > Acked-by: Oleg Nesterov >