Re: [PATCH 0/2] fanotify: Adding pidfd support to the fanotify API

From: Christian Brauner <christian.brauner@ubuntu.com>
To: Matthew Bobrowski <repnop@google.com>,
	Jann Horn <jannh@google.com>, Oleg Nesterov <oleg@redhat.com>
Cc: jack@suse.cz, amir73il@gmail.com, linux-api@vger.kernel.org,
	linux-fsdevel@vger.kernel.org
Subject: Re: [PATCH 0/2] fanotify: Adding pidfd support to the fanotify API
Date: Mon, 19 Apr 2021 14:34:39 +0200	[thread overview]
Message-ID: <20210419123439.q3lzgmk4clqoxs7r@wittgenstein> (raw)
In-Reply-To: <cover.1618527437.git.repnop@google.com>

On Fri, Apr 16, 2021 at 09:21:53AM +1000, Matthew Bobrowski wrote:
> Hey Jan/Amir/Christian,
> 
> This is the RFC patch series for adding pidfd support to the fanotify
> API.
> 
> tl;dr rather than returning a pid within struct
> fanotify_event_metadata, a pidfd is returned instead when fanotify has
> been explicitly told to do so via the new FAN_REPORT_PIDFD flag.
> 
> The main driver behind returning a pidfd within an event instead of a
> pid is that it permits userspace applications to better detect if
> they've possibly lost a TOCTOU race. A common paradigm among userspace
> applications that make use of the fanotify API is to crawl /proc/<pid>
> upon receiving an event. Userspace applications do this in order to
> further ascertain contextual meta-information about the process that
> was responsible for generating the filesystem event. On high pressure
> systems, where pid recycling isn't uncommon, it's no longer considered
> as a reliable approach to directly sift through /proc/<pid> and have
> userspace applications use the information contained within
> /proc/<pid> as it could, and does, lead to program execution
> inaccuracies.
> 
> Now when a pidfd is returned in an event, a userspace application can:
> 
>     a) Obtain the pid responsible for generating the filesystem event
>        from the pidfds fdinfo.
> 
>     b) Detect whether the userspace application lost the procfs access
>        race by sending a 0 signal on the pidfd and checking the return
>        value. A -ESRCH is indicative of the userspace application
>        losing the race, meaning that the pid has been recycled.

Thank you for working on this Matthew.

I'm explicitly adding Jann and Oleg to the thread since both have been
involved in the original design.

Oleg, Jann, I know this isn't necessarily your area of expertise but if
you could share your thoughts about returning pidfds that haven't been
opened via pidfd_open() or CLONE_PIDFD that would be great.
I've been conservative about this so far but I find it hard to resist
use-cases such as this.

Christian