From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Google-Smtp-Source: ACJfBosl7qRyI9T2f2gM8TweTaHrc2H0np1IFjAo4sJ5hwMwlTUaA9icE8v+KsRvnJGUekx/SU+Q ARC-Seal: i=1; a=rsa-sha256; t=1516270066; cv=none; d=google.com; s=arc-20160816; b=ieM5Bvb9+wPh9wrEFCypfPFScJplztGUUtcLa9QaC3IG4CA5H3frPaWVLj0q8pXZGb FcQEYMFZ+KQNQmQuPfENUdIUAxY8i81d9Xb/b7q9NHjF58ulXDr9dEZ21JfixtgDfPHm m6t8wy53NCRruel0BYP7jXt93+c8tT/+mPj7m5Lg9taX/ziQssU6ymLK8aH2S7K9lD8j EVHW9pOb4tbPvWuHa+ZwfEJuiDburWQYbxz3lUu1ThiOOre3/FvRZXQ/XQ/xVQeA503z JJp/1nxhbqj/G1s/CICji1uJbHo3zv/u9ad15CawBdXXAUWs3HMGBL+DLXVdvTHJl5Rk USnQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=spamdiagnosticmetadata:spamdiagnosticoutput :content-transfer-encoding:content-language:in-reply-to:mime-version :user-agent:date:message-id:from:references:cc:to:subject :dkim-signature:arc-authentication-results; bh=3MBqGtQloF26q8H5Zub+7PfUUvqyhgJBHDYM2OoSr6A=; b=cMeamHL6jHQi2VmhWWYt86pEww8IcFrfzedo3BodipneALIP7YFcQnbfPPwpCRbMuf VNfU+hTOvk3brTIKRwFuKPcgJQSq+7qE1Bb7EcQjtKuOYIIi1Y0HlHSoQZjjQp9GFx43 YMIW7Lm7y/Zl6J+IYV/X+dMH4oU0i2OP+1t7Td3V/F+j8nXpNg054lJUl4vDCiM4dXUn 40VFHzYNa0R6NupTkTacOQNzrAJVx7Z4trVMEf5b9l8q1AayfNzLcKJ4IExBvkkP7Ony qMMkj1Daf437cwmWS923KZ027klrDFQ2VEIMpUzZme6ZRg1S0dLKIPoVIeojccZZpkqQ JpIw== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@virtuozzo.com header.s=selector1 header.b=WM0G/I/p; spf=pass (google.com: domain of ktkhai@virtuozzo.com designates 104.47.2.123 as permitted sender) smtp.mailfrom=ktkhai@virtuozzo.com; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=virtuozzo.com Authentication-Results: mx.google.com; dkim=pass header.i=@virtuozzo.com header.s=selector1 header.b=WM0G/I/p; spf=pass (google.com: domain of ktkhai@virtuozzo.com designates 104.47.2.123 as permitted sender) smtp.mailfrom=ktkhai@virtuozzo.com; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=virtuozzo.com Authentication-Results: spf=none (sender IP is ) smtp.mailfrom=ktkhai@virtuozzo.com; Subject: Re: [PATCH v2 1/3] Revert "do_SAK: Don't recursively take the tasklist_lock" To: "Eric W. Biederman" , Oleg Nesterov Cc: gregkh@linuxfoundation.org, jslaby@suse.com, linux-kernel@vger.kernel.org References: <151619233415.5683.18062849657787533510.stgit@localhost.localdomain> <151619277281.5683.16110625178528288163.stgit@localhost.localdomain> <87shb4floe.fsf@xmission.com> <20180117173415.GA7964@redhat.com> <87tvvke5p0.fsf@xmission.com> From: Kirill Tkhai Message-ID: Date: Thu, 18 Jan 2018 13:07:40 +0300 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Thunderbird/52.5.2 MIME-Version: 1.0 In-Reply-To: <87tvvke5p0.fsf@xmission.com> Content-Type: text/plain; charset=utf-8 Content-Language: en-US Content-Transfer-Encoding: 7bit X-Originating-IP: [195.214.232.6] X-ClientProxiedBy: AM5PR0701CA0005.eurprd07.prod.outlook.com (2603:10a6:203:51::15) To AM5PR0801MB1330.eurprd08.prod.outlook.com (2603:10a6:203:1f::8) X-MS-PublicTrafficType: Email X-MS-Office365-Filtering-Correlation-Id: ba4b2169-3f07-49ff-5894-08d55e5b5093 X-Microsoft-Antispam: UriScan:;BCL:0;PCL:0;RULEID:(7020095)(4652020)(5600026)(4604075)(2017052603307)(7153060)(7193020);SRVR:AM5PR0801MB1330; X-Microsoft-Exchange-Diagnostics: 1;AM5PR0801MB1330;3:AJ6xqD48A2bsG5W4Vip2CcYLJg235xI00g3lP00JyhJhhmAoJ5AeaqfkVYF3c4iJJEyJlbZm+lv3nDls/dk8HLKdEtf8NJb54mIxWJVNHfFzei1dqC2urpGKrcUk4gRKczHkWdOdDzQBwwiONcb8aSh1DU3Bf9EIrkH+bRgTkrkNbWRvCAYr9jMdR8HHdkmPaPl3C7vVQkN/wTAhJk7n/YCotBx7l9RkgDBTNYb6dq+CP7pGP5WaOlhgkWwU9xa0;25:N5FffHYp1M076YYCMbju87kzED7HyRNKu+gciMoghtoASrQF8yILCvvY2PuqnE4rHvjfUK5ojOXbbD1n/e4Geu3bymCL2v/ROMKE3wXIE6dDmKlYF7u5s6MVYI9e+Hon4CYkU0nICCGEzwLr6jhnabMdRTkDfF7ccYCG+7eLKCSWU1M1xk1yUAO2a9etMA+8t6/g2PeFfPIUJzZ1DnV30ulo+K4R9WDmTt4LVNn4KNvtvwOt7id2ok5+IGM4pz7MuDmzcbYH9lPiCL5TJ7SqkWp/ZXnbGoiTlFFRARC7KMloG7PS236nH1ytHmx1JdNOwlLtUHcBTOud6Dc165yKDA==;31:0y5+eB1pl+8X3jB95KysFZ34ji6eido4Tf34iSQ48Ty5cYK9EFoH0N13HbHfbONhS/p+QYWFhXA1HtFoEYQqnFhqS02fC5NLDyFnrUmw014McZJKJaZd3uQMAhb29lrCVAYR68cULOLX5LPOd2E5zps118qXOmPcFcZ/f293apL6xq33I7OH/wxbNcQtanbWB3V4VpAK8Qlow0WVJN9QRkroqY1fvP88pObmSD4xiZQ= X-MS-TrafficTypeDiagnostic: AM5PR0801MB1330: X-Microsoft-Exchange-Diagnostics: 1;AM5PR0801MB1330;20:lw+vWG4fle2KGln0Jb7JZlfm1QDasqrTakJOnaOsSZhgXq4CtiwWkQEtNa7qvHXmjNyaiL0BhOHpoiI7hRd750dAhOE2L8Hp9elh7eeaTLXhFCWVBWJvCdZHfB5XTXAXBAv9Gden4l0Q9b1cymKvyz+914uyoNwZjNsIh/DYX4sOitLlfU+sz7OdgvvyQnXeTk8L58qs9FKpIDprbCf+i0wHE0A+5D0SuXWSWlh0N3z0nRetKlr79C3ckKkn/BPOvuXnoGj/MNswCDvHJ7+HBq7WKZL75iC/B+LwjgTqfJJnBI5vsFsEuDwxHo3owQlCLwlHPWJ4UjrzITelbilBJyS93MK6ABXuMjxAUgG3tQUC31+2fVCPq3NA41iwNnMTw2FVjDF+IexGhcd/TywEvq9NgSyQLdy2p/bs+h1gTCk=;4:Wek2P1EDi+VOTTeDJTdJCCmpQY8R68kLoH5bqDOiNKdjpdXg+HddFHMC/3aC22919t40/u4vaAcF6u0OYSyzYwx5netmoCF6HmlhrcFV06z9G5ANH5lchk0NydTXOYPqo94aQEbagSNZ2FsiWY9EkqSyvhuZ8uwYPTyRLGxirtQC2hvKLB/n8abJakroyHHdhfrh5R+9Ucpd++NZuUWph1efj7X9aNKLeIjeoGAxLCqmqrDj6DLRU8QzV18PHSQg+TLJwUQUz6ymiXfOWRGhzQuBjwIO8MhcpUHhVav/H0rvFZNyS+72bjyVM14gQX+H X-Microsoft-Antispam-PRVS: X-Exchange-Antispam-Report-Test: UriScan:(192374486261705); X-Exchange-Antispam-Report-CFA-Test: BCL:0;PCL:0;RULEID:(6040470)(2401047)(8121501046)(5005006)(3002001)(93006095)(93001095)(3231023)(944501161)(10201501046)(6041268)(20161123564045)(201703131423095)(201702281528075)(20161123555045)(201703061421075)(201703061406153)(20161123560045)(20161123558120)(20161123562045)(6072148)(201708071742011);SRVR:AM5PR0801MB1330;BCL:0;PCL:0;RULEID:(100000803101)(100110400095);SRVR:AM5PR0801MB1330; X-Forefront-PRVS: 05568D1FF7 X-Forefront-Antispam-Report: SFV:NSPM;SFS:(10019020)(6049001)(39850400004)(346002)(396003)(366004)(376002)(39380400002)(199004)(189003)(52314003)(36756003)(64126003)(110136005)(106356001)(58126008)(16576012)(16526018)(31686004)(316002)(8676002)(81156014)(81166006)(6486002)(65956001)(229853002)(50466002)(53936002)(8936002)(65806001)(83506002)(47776003)(66066001)(2486003)(52116002)(7736002)(52146003)(23676004)(305945005)(68736007)(3846002)(76176011)(4326008)(97736004)(93886005)(6246003)(6116002)(25786009)(86362001)(105586002)(230700001)(77096007)(31696002)(59450400001)(478600001)(26005)(386003)(65826007)(5660300001)(2950100002)(53546011)(2906002);DIR:OUT;SFP:1102;SCL:1;SRVR:AM5PR0801MB1330;H:[172.16.25.196];FPR:;SPF:None;PTR:InfoNoRecords;A:1;MX:1;LANG:en; X-Microsoft-Exchange-Diagnostics: =?utf-8?B?MTtBTTVQUjA4MDFNQjEzMzA7MjM6NDNmamQ4amtRK1lsWkJQWEd6MVZyVmQx?= =?utf-8?B?VkRGK1RMa1ZhWDhOQ1l1K2l1eG5obElFcjM0QmYxU01EUjlLSHJDQ21nTVdP?= =?utf-8?B?ZTR3bnZQbjkrS0xsTXFIWGRRTVU0bVlCWWM3RnorUk9DeGtqQ3hpWitNenRl?= =?utf-8?B?MzJTSEROT2FYQ3M4MUxOUVZkdGdUTldnT0h2cWZOeWZpSkc2TWhGYStnZmcv?= =?utf-8?B?U0NjT2ZYRjBPVksrRlVGR1J4WHFTZlgxclAvdlNJK3J2N3NiSTN4b05NRE4x?= =?utf-8?B?eHBhSnpUWEpKcmkrd1R0RWNGdWxOYnhnM0xLWWJXOXE3KzliSWhHN1d2anM5?= =?utf-8?B?ZG1DVnQ2YXlwUHVneVhGckMxTkYvVG5tbFUrc1k2ZWJvMjBDMEQvUDlyQXFX?= =?utf-8?B?Qk52SGZVaTFrelcxLzE5dU1yMTl5UnUvdjlhZmRiSzgzT2lPKzUzem0xbDlY?= =?utf-8?B?TElZelJOeXlWQ2o5VWRhbEVHeVUycTdaZ2ZLa1dCQTZaaXpwM2FYUTlDZ3Nq?= =?utf-8?B?RUxiblN4R2VFZjA3UG9BK2Z0bEhqQVhjMU5melF5UmtuRm4xeWZHcWltbTJw?= =?utf-8?B?Uktza0h1YmRKOWhtM3pXOHcrM2hEb0RSWVE0ZUhwT1hWdWlWbFI0cXBzWkpW?= =?utf-8?B?cXRYaXhPY3poeXFnT2FnSDcwdk9uSzc1VHFSb3JFdGVkdXJwMXlBUWFhUmkx?= =?utf-8?B?YUpGUzY1TVZmVmdqcjBKYUU2NHErMU0zTlZ2ejU4cDBhNkpWMWpKVzAva0pV?= =?utf-8?B?dUJLajFxUzdOUFhlNGJ3RSt4b28rTlBuU3hNWS8vSS9LQmxQdGFpRXF2TlU3?= =?utf-8?B?M244RDZCVWRoaWxSaUJuVjFYVDdPaWM0M2xXUkdwZ2xWa2Y0YzZhZzUzNzNh?= =?utf-8?B?N0xYMDdyY1VDOGlVaGJuTTMxaGw1YzhaNFN2MzljU0pMN2RUaUFTcjhYSGJ6?= =?utf-8?B?OUlQZ0QyWHFadjg5N2hhM1VCcjhOSTZpTTVoRDdILzJFaUtRUnZaSVRzYWEw?= =?utf-8?B?ZTVyY0xrRU5UOFJjcWZzcTI4MS93WjBIakxramFEQVgwTCtsMFRLU1NBUEw2?= =?utf-8?B?TElXeU8yQ1Awd2Zla25PNGtNUUhpVEhuU1ZYQmptQUV2RnRlY0hUNkFWOCtL?= =?utf-8?B?MjlnKzduZDhwZkdqZ0lWS1FyaFdVa251aStYNzBUWGdGT2o3VUxjY0s4WDMv?= =?utf-8?B?SUYyZXpQb0dlMXQ0cHlYVDI4TDRTOWV2SGpVbThyVkYyMmx0MWtwb21TSWlT?= =?utf-8?B?SC9UeFdmeHFaVmcvdlpmK0gxUDRVZWlrWHpJNFBabXA2OFloZDdPcG9lMG9a?= =?utf-8?B?S0c5KzBzeExhOVVCSytUQ2pVaGkzSmJRM1BBbHptNVg5WFVVeDFuWk5QTzNm?= =?utf-8?B?enZQOGN1eUN1U3pqSk1KTU92U2o5WUxMcVAvVW45TjJMejdBMC90bzQva0xo?= =?utf-8?B?UXJqT3hHcGhCcG1IYkJ6L29jWUpMczdBdjd1eFFPN2x3ZzlPYm9pL1dEVmVS?= =?utf-8?B?YTZ6TUcvdFIyZlJyM1plZVBlQU9qeU04KzJpMEl6QlhLdVBHZlJtazVpeVJQ?= =?utf-8?B?U2lxdXQxWWdkRElpR2tHdStpeS9EZlRYdng4TEowT0xqeG1KK0NJN25wZTM2?= =?utf-8?B?N1BleHlMQnowNXZwckFHSXhsejRkUW1tNWZNTFpSZEdwdlVsNk9RamlueEcv?= =?utf-8?B?dG1FNU9MMXYzR0JIdk9Oc0R6WVpUTlVxTlJDU3M4SzNrd0N5ak1BOXRJeWdZ?= =?utf-8?B?ZVYxZldaRHl4bkJPUXJ3Rm9TcmpXcHVOOXplM2U2Uld3S3MwUXJMZjJwNTFs?= =?utf-8?B?VUtxSUFwYnpNRkE5dDRGREp3cmR2ZTFITjZZbi8wNEJiNm1NVmsrR25kMDl5?= =?utf-8?Q?Oi6noW1FYHzqcPyaOfGB8K/B+rHXNbAZ2L?= X-Microsoft-Exchange-Diagnostics: 1;AM5PR0801MB1330;6:OMMn+BiRZ959FUzdtJFDGA7NrBFwydQOFeejsQfcUuQPdIjbgfGoiNfODLsgAIB/kgH3ukkH+04W0bqCR4kv7OGVrDt1fP/AKhU12vaeQZy00+Vps23OaCblGSO9l+PrhAvkZZDNONXm9dbIjgoYEzGSoWjmH0iCLKQm0dST+Tj+KosVbedvcyDoQ10PL+1jJmIGvfCbkU4GaovvHbNDHKn8xgULAiVwk4Z4Bg6OBMwQK98SeHPfHwMMLwngAs8Vxh6ogzCzc0KSZNj2UfoJQQgcWLuCpip9Xzwsr+PgsLoGTLOhYYnn26Jx9VGx7tEc8iHg2Z+mH2X2qf5mEQnILmwi0GsHnjwArRxDRWMtqL4=;5:XPmZjZVsX8Lpg2JfnTHjI7eTEPkT2fl2DSdqZJRgLCrDdUTrIh7TWbpLkWEYoFNsKJvelYQ4vSsuNTEgBo4VC1trHfVwpb9laBnsLCZrXYp2635yBMeIzS/ItKSzOezFRJ3l+ZmMuOpxUo7MW3CouTffloQJj+nmKIkdmlyN2+g=;24:/RfADNjLhR1NdQ87t2Z/3Qz7pePhyU3cN1u7t1d9mlV2hBipN8FORDK/eGb6cqI+XrIhX1YoVhCLovScwkW8xPhZSTDdAwOcqUOH03q/SsA=;7:H3Ic9ekCmwr9NrdwoS8nzAg4rWGDx0jqt2F7YFXnZY2qpyB7As6VADAMeKXXv27DGCSFjyJIvns5YDwBFvwiVfUbxj9aaJJrDLMPvflP3lo8g3xIMYQFxuuLueAE6AvZ3/8J+tFoCDkEruyGnQvlZHTH5S9W+IezNPQFN+3gg0RorFT3jhI0NoIIM8gzCCa6Q4bCKp/f2J8jA+t/dLt8sBQftZNQlYFGpvWlSLvyInWeH1CEI/DVOxhSnGoCYKy0 SpamDiagnosticOutput: 1:99 SpamDiagnosticMetadata: NSPM X-Microsoft-Exchange-Diagnostics: 1;AM5PR0801MB1330;20:SmHU1qH6Z189Fxf44ZVHiWsulNcTsbw+eF3aLq5Lf8JXxiUwxZxUaY4juwCZP8B39tayos9U/MRsEKkyVIO4CwsS/eCpGC/9kRiRrEWowY9GxglC8n2wCvIegyVZjXV2yak09h0szfJP/eDJogUF8ZkQtXQBhPCF1tYDv6Ck2lY= X-OriginatorOrg: virtuozzo.com X-MS-Exchange-CrossTenant-OriginalArrivalTime: 18 Jan 2018 10:07:42.6380 (UTC) X-MS-Exchange-CrossTenant-Network-Message-Id: ba4b2169-3f07-49ff-5894-08d55e5b5093 X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: 0bc7f26d-0264-416e-a6fc-8352af79c58f X-MS-Exchange-Transport-CrossTenantHeadersStamped: AM5PR0801MB1330 X-getmail-retrieved-from-mailbox: INBOX X-GMAIL-THRID: =?utf-8?q?1589843366609121628?= X-GMAIL-MSGID: =?utf-8?q?1589924400781984017?= X-Mailing-List: linux-kernel@vger.kernel.org List-ID: On 17.01.2018 20:49, Eric W. Biederman wrote: > Oleg Nesterov writes: > >> On 01/17, Eric W. Biederman wrote: >> >>> Kirill Tkhai writes: >>> >>>> This reverts commit 20ac94378de5. >>>> >>>> send_sig() does not take tasklist_lock for a long time, >>>> so this commit and the problem it solves are not relevant >>>> anymore. >>>> >>>> Also, the problem of force_sig() is it clears SIGNAL_UNKILLABLE >>>> flag, thus even global init may be killed by __do_SAK(), >>>> which is definitely not the expected behavior. >>> >>> Actually it is. >>> >>> SAK should kill everything that has the tty open. If init opens the tty >>> I am so sorry, it can not operate correctly. init should not have your >>> tty open. >> >> OK, but then we need "force" in other places too. __do_SAK() does send_sig(SIGKILL) >> in do_each_pid_task(PIDTYPE_SID) and if signal->tty == tty. >> >> Plus force_sig() is not rcu-friendly. >> >> So I personally agree with this change. Whether we want to kill the global init >> or not should be discussed, if we want to do this __do_SAK() should use >> SEND_SIG_FORCED and this is what Kirill is going to do (iiuc), but this needs >> another patch. > > To operate correctly, do_SAK() needs to kill everything that has the tty > open. Unless we can make that guarantee I don't see the point of > changing do_SAK. do_SAK() doesn't kill everything at the moment, and it wasn't able to do that 10 years ago, when the reverted commit was introduced. There are two ways to obtain dead tty: 1)when fd send via unix sockets 2)when a process open foreign /proc/[foreign_pid/fd/fdX If someone wants to fix that, this possibly should be made outside __do_SAK(). But these races were 10+ years ago, when SAK was implemented, and my patchset does not add new races to already existing. > It would be better to give up on do_SAK altogether than to keep do_SAK > limping along and failing to meet it's security guarantees. > > If there are real world races, let's document those and say do_SAK has > been broken for X number of years and just remove it. Right now that > seems the more reasonable course. > > Unless there truly is someone using do_SAK to ensure they have a tty all > to themselves. We can remove it, but someone may already use this interface, and this will break the compatibility. Anyway, my patchset does not aim to check either SAK is broken or not. My patchset just make the same functionality as now, but faster.