I can confirm this on Ubuntu 24.04.5 with procps 2:4.0.4-4ubuntu3.3
(amd64).
Test plan, step 1, on the affected package:
$ /usr/bin/strace -e trace=kill -e inject=kill:error=EPERM /usr/bin/kill -0
-1443247
kill(-1, 0) = -1 EPERM (Operation not permitted) (INJECTED)
Real-world impact: on 2026-10-04 a program cancelled a child build by
executing `kill -TERM -<pgid>` (Rust std::process::Command, so the procps
binary and not a shell builtin). The group id was about 1,800,000, so the
call became kill(-1, SIGTERM). It ended the whole desktop session (67 days
of uptime) together with every running job of the user, and unsaved work
was lost.
In a throw-away PID namespace, `kill -TERM -120` terminated 8 unrelated
processes as well as group 120, while `kill -TERM -- -120` terminated only
the group. The same test in an Ubuntu 26.04 container (procps
2:4.0.4-9ubuntu1) signals only the intended group.
With the default pid_max, roughly a quarter of all PIDs start with 1, so
ordinary process-group cleanup silently becomes kill(-1) for them. I think
this meets the SRU criterion of a bug that can cause loss of user data.
I am happy to verify the package from noble-proposed.
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/2166756
Title:
[Noble SRU] procps kill truncates negative PIDs
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/procps/+bug/2166756/+subscriptions
--
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
