From: Sukadev Bhattiprolu <[email protected]>
Subject: [RFC][PATCH 6/7][v4] SI_USER: Masquerade si_pid when crossing pid ns
boundary
When sending a signal to a descendant namespace, we must set ->si_pid to
0 since the sender does not have a valid pid in the descendant namespace.
But we cannot do this in sys_kill() since a) we do not yet know the pid
namespace of receiver b) the pid number in sys_kill() may correspond to
a process group and processes in the process group may be in different
namespaces. So masquerade si_pid at the lower level, send_signal()
function.
Note:
- If rt_sigqueueinfo() sets si_code to SI_USER when sending a
signal across a pid namespace boundary, the value in ->si_pid
will be cleared to 0.
Signed-off-by: Sukadev Bhattiprolu <[email protected]>
---
kernel/signal.c | 32 +++++++++++++++++++++++++++++++-
1 files changed, 31 insertions(+), 1 deletions(-)
diff --git a/kernel/signal.c b/kernel/signal.c
index 660fadd..5a6aea8 100644
--- a/kernel/signal.c
+++ b/kernel/signal.c
@@ -885,6 +885,34 @@ static inline int siginfo_from_ancestor_ns(struct
task_struct *t,
return 0;
}
+/*
+ * masquerade_si_pid():
+ *
+ * Called when signal is crossing pid namespace boundary. Compute
+ * pid of sender in receiver's pid namespace.
+ *
+ * We only care about SI_USER here. Other si_codes are addressed
+ * either at the 'origin' of signal or set to a default value in
+ * send_signal(). But we can't address SI_USER at 'origin', i.e .
+ * in sys_kill(), since we may have a process group, rather than
+ * a specific process there. And different processes in same pgrp
+ * can be in different namespaces.
+ */
+static void masquerade_si_pid(struct task_struct *t, siginfo_t *info)
+{
+ if (is_si_special(info) || SI_FROMKERNEL(info))
+ return;
+
+ /*
+ * When crossing pid namespace boundary, SI_USER signal can only
+ * go from ancestor to descendant ns but not the other way. So,
+ * just ->si_pid to 0 since, the sender will not have a pid in
+ * the receiver's namespace.
+ */
+ if (info->si_code == SI_USER)
+ info->si_pid = 0;
+}
+
static int send_signal(int sig, struct siginfo *info, struct task_struct *t,
int group)
{
@@ -946,6 +974,8 @@ static int send_signal(int sig, struct siginfo *info,
struct task_struct *t,
break;
default:
copy_siginfo(&q->info, info);
+ if (from_ancestor_ns)
+ masquerade_si_pid(t, &q->info);
break;
}
} else if (!is_si_special(info)) {
@@ -2343,7 +2373,7 @@ sys_kill(pid_t pid, int sig)
info.si_signo = sig;
info.si_errno = 0;
info.si_code = SI_USER;
- info.si_pid = task_tgid_vnr(current);
+ info.si_pid = 0; /* masquerade in send_signal() */
info.si_uid = current_uid();
return kill_something_info(sig, &info, pid);
--
1.5.2.5
_______________________________________________
Containers mailing list
[email protected]
https://lists.linux-foundation.org/mailman/listinfo/containers
_______________________________________________
Devel mailing list
[email protected]
https://openvz.org/mailman/listinfo/devel
