Re: [CRIU] [PATCH 1/3] prctl: reduce permissions to change boundaries of data, brk and stack

2014-03-07 Thread Pavel Emelyanov
Hi, Eric, Why can't you have the process of interest do: ptrace(PTRACE_ATTACHME); execve(executable, args, ...); /* Have the ptracer inject the recovery/fixup code */ /* Fix up the mostly correct process to look like it has been

Re: [CRIU] [PATCH 1/3] prctl: reduce permissions to change boundaries of data, brk and stack

2014-03-07 Thread Pavel Emelyanov
Hi, Eric, Why can't you have the process of interest do: ptrace(PTRACE_ATTACHME); execve(executable, args, ...); /* Have the ptracer inject the recovery/fixup code */ /* Fix up the mostly correct process to look like it has been * executing for a while.

Re: [CRIU] [PATCH 1/3] prctl: reduce permissions to change boundaries of data, brk and stack

2014-02-17 Thread Pavel Emelyanov
On 02/17/2014 12:52 PM, Cyrill Gorcunov wrote: > On Mon, Feb 17, 2014 at 12:34:12PM +0400, Pavel Emelyanov wrote: > ... >> Maybe we can make prlctl() do lite-execve()? It will open the executable, >> read the >> required amount of headers and just put data red from there onto mm-struct? >> This

Re: [CRIU] [PATCH 1/3] prctl: reduce permissions to change boundaries of data, brk and stack

2014-02-17 Thread Cyrill Gorcunov
On Mon, Feb 17, 2014 at 12:34:12PM +0400, Pavel Emelyanov wrote: ... > Maybe we can make prlctl() do lite-execve()? It will open the executable, > read the > required amount of headers and just put data red from there onto mm-struct? > This > should be MUCH better, that full execve() with

Re: [CRIU] [PATCH 1/3] prctl: reduce permissions to change boundaries of data, brk and stack

2014-02-17 Thread Pavel Emelyanov
On 02/15/2014 12:09 AM, Eric W. Biederman wrote: > Pavel Emelyanov writes: > >> On 02/14/2014 11:16 PM, Eric W. Biederman wrote: >>> Cyrill Gorcunov writes: >>> On Fri, Feb 14, 2014 at 09:43:14PM +0400, Andrew Vagin wrote: >> My brain hurts just looking at this patch and how you are

Re: [CRIU] [PATCH 1/3] prctl: reduce permissions to change boundaries of data, brk and stack

2014-02-17 Thread Pavel Emelyanov
On 02/15/2014 12:09 AM, Eric W. Biederman wrote: Pavel Emelyanov xe...@parallels.com writes: On 02/14/2014 11:16 PM, Eric W. Biederman wrote: Cyrill Gorcunov gorcu...@gmail.com writes: On Fri, Feb 14, 2014 at 09:43:14PM +0400, Andrew Vagin wrote: My brain hurts just looking at this patch

Re: [CRIU] [PATCH 1/3] prctl: reduce permissions to change boundaries of data, brk and stack

2014-02-17 Thread Cyrill Gorcunov
On Mon, Feb 17, 2014 at 12:34:12PM +0400, Pavel Emelyanov wrote: ... Maybe we can make prlctl() do lite-execve()? It will open the executable, read the required amount of headers and just put data red from there onto mm-struct? This should be MUCH better, that full execve() with loading

Re: [CRIU] [PATCH 1/3] prctl: reduce permissions to change boundaries of data, brk and stack

2014-02-17 Thread Pavel Emelyanov
On 02/17/2014 12:52 PM, Cyrill Gorcunov wrote: On Mon, Feb 17, 2014 at 12:34:12PM +0400, Pavel Emelyanov wrote: ... Maybe we can make prlctl() do lite-execve()? It will open the executable, read the required amount of headers and just put data red from there onto mm-struct? This should

Re: [CRIU] [PATCH 1/3] prctl: reduce permissions to change boundaries of data, brk and stack

2014-02-15 Thread Eric W. Biederman
Andrey Wagin writes: > 2014-02-14 23:16 GMT+04:00 Eric W. Biederman : >> >> Hmm. Let me rewind this a little bit. >> >> I want to be very stupid and ask the following. >> >> Why can't you have the process of interest do: >> ptrace(PTRACE_ATTACHME); >> execve(executable, args,

Re: [CRIU] [PATCH 1/3] prctl: reduce permissions to change boundaries of data, brk and stack

2014-02-15 Thread Eric W. Biederman
Cyrill Gorcunov writes: > On Fri, Feb 14, 2014 at 12:18:46PM -0800, Eric W. Biederman wrote: >> >> > >> >> > Why can't you have the process of interest do: >> >> > ptrace(PTRACE_ATTACHME); >> >> > execve(executable, args, ...); >> >> > >> >> > /* Have the

Re: [CRIU] [PATCH 1/3] prctl: reduce permissions to change boundaries of data, brk and stack

2014-02-15 Thread Eric W. Biederman
Cyrill Gorcunov gorcu...@gmail.com writes: On Fri, Feb 14, 2014 at 12:18:46PM -0800, Eric W. Biederman wrote: Why can't you have the process of interest do: ptrace(PTRACE_ATTACHME); execve(executable, args, ...); /* Have the ptracer inject the

Re: [CRIU] [PATCH 1/3] prctl: reduce permissions to change boundaries of data, brk and stack

2014-02-15 Thread Eric W. Biederman
Andrey Wagin ava...@gmail.com writes: 2014-02-14 23:16 GMT+04:00 Eric W. Biederman ebied...@xmission.com: Hmm. Let me rewind this a little bit. I want to be very stupid and ask the following. Why can't you have the process of interest do: ptrace(PTRACE_ATTACHME);

Re: [CRIU] [PATCH 1/3] prctl: reduce permissions to change boundaries of data, brk and stack

2014-02-14 Thread Cyrill Gorcunov
On Fri, Feb 14, 2014 at 12:18:46PM -0800, Eric W. Biederman wrote: > >> > > >> > Why can't you have the process of interest do: > >> > ptrace(PTRACE_ATTACHME); > >> > execve(executable, args, ...); > >> > > >> > /* Have the ptracer inject the recovery/fixup code */ > >> >

Re: [CRIU] [PATCH 1/3] prctl: reduce permissions to change boundaries of data, brk and stack

2014-02-14 Thread Andrey Wagin
2014-02-14 23:16 GMT+04:00 Eric W. Biederman : > Cyrill Gorcunov writes: > >> On Fri, Feb 14, 2014 at 09:43:14PM +0400, Andrew Vagin wrote: >>> > My brain hurts just looking at this patch and how you are justifying it. >>> > >>> > For the resources you are mucking with below all you have to do is

Re: [CRIU] [PATCH 1/3] prctl: reduce permissions to change boundaries of data, brk and stack

2014-02-14 Thread Eric W. Biederman
Cyrill Gorcunov writes: > On Fri, Feb 14, 2014 at 11:47:13PM +0400, Pavel Emelyanov wrote: >> >> Maybe we could improve this api and provide argument as a pointer >> >> to a structure, which would have all the fields we're going to >> >> modify, which in turn would allow us to verify that all

Re: [CRIU] [PATCH 1/3] prctl: reduce permissions to change boundaries of data, brk and stack

2014-02-14 Thread Eric W. Biederman
Pavel Emelyanov writes: > On 02/14/2014 11:16 PM, Eric W. Biederman wrote: >> Cyrill Gorcunov writes: >> >>> On Fri, Feb 14, 2014 at 09:43:14PM +0400, Andrew Vagin wrote: > My brain hurts just looking at this patch and how you are justifying it. > > For the resources you are

Re: [CRIU] [PATCH 1/3] prctl: reduce permissions to change boundaries of data, brk and stack

2014-02-14 Thread Cyrill Gorcunov
On Fri, Feb 14, 2014 at 11:47:13PM +0400, Pavel Emelyanov wrote: > >> Maybe we could improve this api and provide argument as a pointer > >> to a structure, which would have all the fields we're going to > >> modify, which in turn would allow us to verify that all new values > >> are sane and fit

Re: [CRIU] [PATCH 1/3] prctl: reduce permissions to change boundaries of data, brk and stack

2014-02-14 Thread Pavel Emelyanov
On 02/14/2014 11:16 PM, Eric W. Biederman wrote: > Cyrill Gorcunov writes: > >> On Fri, Feb 14, 2014 at 09:43:14PM +0400, Andrew Vagin wrote: My brain hurts just looking at this patch and how you are justifying it. For the resources you are mucking with below all you have to do is

Re: [CRIU] [PATCH 1/3] prctl: reduce permissions to change boundaries of data, brk and stack

2014-02-14 Thread Eric W. Biederman
Cyrill Gorcunov writes: > On Fri, Feb 14, 2014 at 09:43:14PM +0400, Andrew Vagin wrote: >> > My brain hurts just looking at this patch and how you are justifying it. >> > >> > For the resources you are mucking with below all you have to do is to >> > verify that you are below the appropriate

Re: [CRIU] [PATCH 1/3] prctl: reduce permissions to change boundaries of data, brk and stack

2014-02-14 Thread Cyrill Gorcunov
On Fri, Feb 14, 2014 at 09:43:14PM +0400, Andrew Vagin wrote: > > My brain hurts just looking at this patch and how you are justifying it. > > > > For the resources you are mucking with below all you have to do is to > > verify that you are below the appropriate rlimit at all times and no > >

Re: [CRIU] [PATCH 1/3] prctl: reduce permissions to change boundaries of data, brk and stack

2014-02-14 Thread Cyrill Gorcunov
On Fri, Feb 14, 2014 at 09:43:14PM +0400, Andrew Vagin wrote: My brain hurts just looking at this patch and how you are justifying it. For the resources you are mucking with below all you have to do is to verify that you are below the appropriate rlimit at all times and no

Re: [CRIU] [PATCH 1/3] prctl: reduce permissions to change boundaries of data, brk and stack

2014-02-14 Thread Eric W. Biederman
Cyrill Gorcunov gorcu...@gmail.com writes: On Fri, Feb 14, 2014 at 09:43:14PM +0400, Andrew Vagin wrote: My brain hurts just looking at this patch and how you are justifying it. For the resources you are mucking with below all you have to do is to verify that you are below the

Re: [CRIU] [PATCH 1/3] prctl: reduce permissions to change boundaries of data, brk and stack

2014-02-14 Thread Pavel Emelyanov
On 02/14/2014 11:16 PM, Eric W. Biederman wrote: Cyrill Gorcunov gorcu...@gmail.com writes: On Fri, Feb 14, 2014 at 09:43:14PM +0400, Andrew Vagin wrote: My brain hurts just looking at this patch and how you are justifying it. For the resources you are mucking with below all you have to do

Re: [CRIU] [PATCH 1/3] prctl: reduce permissions to change boundaries of data, brk and stack

2014-02-14 Thread Cyrill Gorcunov
On Fri, Feb 14, 2014 at 11:47:13PM +0400, Pavel Emelyanov wrote: Maybe we could improve this api and provide argument as a pointer to a structure, which would have all the fields we're going to modify, which in turn would allow us to verify that all new values are sane and fit rlimits,

Re: [CRIU] [PATCH 1/3] prctl: reduce permissions to change boundaries of data, brk and stack

2014-02-14 Thread Eric W. Biederman
Pavel Emelyanov xe...@parallels.com writes: On 02/14/2014 11:16 PM, Eric W. Biederman wrote: Cyrill Gorcunov gorcu...@gmail.com writes: On Fri, Feb 14, 2014 at 09:43:14PM +0400, Andrew Vagin wrote: My brain hurts just looking at this patch and how you are justifying it. For the resources

Re: [CRIU] [PATCH 1/3] prctl: reduce permissions to change boundaries of data, brk and stack

2014-02-14 Thread Eric W. Biederman
Cyrill Gorcunov gorcu...@gmail.com writes: On Fri, Feb 14, 2014 at 11:47:13PM +0400, Pavel Emelyanov wrote: Maybe we could improve this api and provide argument as a pointer to a structure, which would have all the fields we're going to modify, which in turn would allow us to verify that

Re: [CRIU] [PATCH 1/3] prctl: reduce permissions to change boundaries of data, brk and stack

2014-02-14 Thread Andrey Wagin
2014-02-14 23:16 GMT+04:00 Eric W. Biederman ebied...@xmission.com: Cyrill Gorcunov gorcu...@gmail.com writes: On Fri, Feb 14, 2014 at 09:43:14PM +0400, Andrew Vagin wrote: My brain hurts just looking at this patch and how you are justifying it. For the resources you are mucking with

Re: [CRIU] [PATCH 1/3] prctl: reduce permissions to change boundaries of data, brk and stack

2014-02-14 Thread Cyrill Gorcunov
On Fri, Feb 14, 2014 at 12:18:46PM -0800, Eric W. Biederman wrote: Why can't you have the process of interest do: ptrace(PTRACE_ATTACHME); execve(executable, args, ...); /* Have the ptracer inject the recovery/fixup code */ /* Fix up the mostly correct