linux.git/fs/exec.c, branch v2.6.24

vfs: coredumping fix

2007-11-28T18:58:01+00:00

fix: http://bugzilla.kernel.org/show_bug.cgi?id=3043

only allow coredumping to the same uid that the coredumping
task runs under.

Signed-off-by: Ingo Molnar 
Acked-by: Alan Cox 
Acked-by: Christoph Hellwig 
Acked-by: Al Viro 
Signed-off-by: Linus Torvalds

core dump: remain dumpable

2007-11-12T18:32:29+00:00

The coredump code always calls set_dumpable(0) when it starts (even
if RLIMIT_CORE prevents any core from being dumped).  The effect of
this (via task_dumpable) is to make /proc/pid/* files owned by root
instead of the user, so the user can no longer examine his own
process--in a case where there was never any privileged data to
protect.  This affects e.g. auxv, environ, fd; in Fedora (execshield)
kernels, also maps.  In practice, you can only notice this when a
debugger has requested PTRACE_EVENT_EXIT tracing.

set_dumpable was only used in do_coredump for synchronization and not
intended for any security purpose.  (It doesn't secure anything that wasn't
already unsecured when a process dies by SIGTERM instead of SIGQUIT.)

This changes do_coredump to check the core_waiters count as the means of
synchronization, which is sufficient.  Now we leave the "dumpable" bits alone.

Signed-off-by: Roland McGrath 
Signed-off-by: Linus Torvalds

Isolate some explicit usage of task->tgid

2007-10-19T18:53:40+00:00

With pid namespaces this field is now dangerous to use explicitly, so hide
it behind the helpers.

Also the pid and pgrp fields o task_struct and signal_struct are to be
deprecated.  Unfortunately this patch cannot be sent right now as this
leads to tons of warnings, so start isolating them, and deprecate later.

Actually the p->tgid == pid has to be changed to has_group_leader_pid(),
but Oleg pointed out that in case of posix cpu timers this is the same, and
thread_group_leader() is more preferable.

Signed-off-by: Pavel Emelyanov 
Acked-by: Oleg Nesterov 
Cc: Sukadev Bhattiprolu 
Cc: "Eric W. Biederman" 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds

pid namespaces: changes to show virtual ids to user

2007-10-19T18:53:40+00:00

This is the largest patch in the set. Make all (I hope) the places where
the pid is shown to or get from user operate on the virtual pids.

The idea is:
 - all in-kernel data structures must store either struct pid itself
   or the pid's global nr, obtained with pid_nr() call;
 - when seeking the task from kernel code with the stored id one
   should use find_task_by_pid() call that works with global pids;
 - when showing pid's numerical value to the user the virtual one
   should be used, but however when one shows task's pid outside this
   task's namespace the global one is to be used;
 - when getting the pid from userspace one need to consider this as
   the virtual one and use appropriate task/pid-searching functions.

[akpm@linux-foundation.org: build fix]
[akpm@linux-foundation.org: nuther build fix]
[akpm@linux-foundation.org: yet nuther build fix]
[akpm@linux-foundation.org: remove unneeded casts]
Signed-off-by: Pavel Emelyanov 
Signed-off-by: Alexey Dobriyan 
Cc: Sukadev Bhattiprolu 
Cc: Oleg Nesterov 
Cc: Paul Menage 
Cc: "Eric W. Biederman" 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds

pid namespaces: use task_pid() to find leader's pid

2007-10-19T18:53:37+00:00

Use task_pid() to get leader's 'struct pid' and avoid the find_pid().

Signed-off-by: Sukadev Bhattiprolu 
Acked-by: Pavel Emelianov 
Cc: Eric W. Biederman 
Cc: Cedric Le Goater 
Cc: Dave Hansen 
Cc: Serge Hallyn 
Cc: Herbert Poetzel 
Cc: Kirill Korotaev 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds

pid namespaces: rename child_reaper() function

2007-10-19T18:53:37+00:00

Rename the child_reaper() function to task_child_reaper() to be similar to
other task_* functions and to distinguish the function from 'struct
pid_namspace.child_reaper'.

Signed-off-by: Sukadev Bhattiprolu 
Cc: Pavel Emelianov 
Cc: Eric W. Biederman 
Cc: Cedric Le Goater 
Cc: Dave Hansen 
Cc: Serge Hallyn 
Cc: Herbert Poetzel 
Cc: Kirill Korotaev 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds

pid namespaces: define and use task_active_pid_ns() wrapper

2007-10-19T18:53:37+00:00

With multiple pid namespaces, a process is known by some pid_t in every
ancestor pid namespace.  Every time the process forks, the child process also
gets a pid_t in every ancestor pid namespace.

While a process is visible in >=1 pid namespaces, it can see pid_t's in only
one pid namespace.  We call this pid namespace it's "active pid namespace",
and it is always the youngest pid namespace in which the process is known.

This patch defines and uses a wrapper to find the active pid namespace of a
process.  The implementation of the wrapper will be changed in when support
for multiple pid namespaces are added.

Changelog:
	2.6.22-rc4-mm2-pidns1:
	- [Pavel Emelianov, Alexey Dobriyan] Back out the change to use
	  task_active_pid_ns() in child_reaper() since task->nsproxy
	  can be NULL during task exit (so child_reaper() continues to
	  use init_pid_ns).

	  to implement child_reaper() since init_pid_ns.child_reaper to
	  implement child_reaper() since tsk->nsproxy can be NULL during exit.

	2.6.21-rc6-mm1:
	- Rename task_pid_ns() to task_active_pid_ns() to reflect that a
	  process can have multiple pid namespaces.

Signed-off-by: Sukadev Bhattiprolu 
Acked-by: Pavel Emelianov 
Cc: Eric W. Biederman 
Cc: Cedric Le Goater 
Cc: Dave Hansen 
Cc: Serge Hallyn 
Cc: Herbert Poetzel 
Cc: Kirill Korotaev 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds

setup vma->vm_page_prot by vm_get_page_prot()

2007-10-19T18:53:34+00:00

This patch uses vm_get_page_prot() to setup vma->vm_page_prot.

Though inside vm_get_page_prot() the protection flags is AND with
(VM_READ|VM_WRITE|VM_EXEC|VM_SHARED), it does not hurt correct code.

Signed-off-by: Coly Li 
Cc: Hugh Dickins 
Cc: Tony Luck 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds

security/ cleanups

2007-10-17T15:43:07+00:00

This patch contains the following cleanups that are now possible:
- remove the unused security_operations->inode_xattr_getsuffix
- remove the no longer used security_operations->unregister_security
- remove some no longer required exit code
- remove a bunch of no longer used exports

Signed-off-by: Adrian Bunk 
Acked-by: James Morris 
Cc: Chris Wright 
Cc: Stephen Smalley 
Cc: Serge Hallyn 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds

exec: RT sub-thread can livelock and monopolize CPU on exec

2007-10-17T15:42:54+00:00

de_thread() yields waiting for ->group_leader to be a zombie. This deadlocks
if an rt-prio execer shares the same cpu with ->group_leader. Change the code
to use ->group_exit_task/notify_count mechanics.

This patch certainly uglifies the code, perhaps someone can suggest something
better.

Signed-off-by: Oleg Nesterov 
Cc: Roland McGrath 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds