Linux-Fsdevel Archive on lore.kernel.org
 help / color / Atom feed
From: Christian Brauner <christian.brauner@ubuntu.com>
To: Matthew Bobrowski <repnop@google.com>,
	Jann Horn <jannh@google.com>, Oleg Nesterov <oleg@redhat.com>
Cc: jack@suse.cz, amir73il@gmail.com, linux-api@vger.kernel.org,
	linux-fsdevel@vger.kernel.org
Subject: Re: [PATCH 0/2] fanotify: Adding pidfd support to the fanotify API
Date: Mon, 19 Apr 2021 14:34:39 +0200
Message-ID: <20210419123439.q3lzgmk4clqoxs7r@wittgenstein> (raw)
In-Reply-To: <cover.1618527437.git.repnop@google.com>

On Fri, Apr 16, 2021 at 09:21:53AM +1000, Matthew Bobrowski wrote:
> Hey Jan/Amir/Christian,
> 
> This is the RFC patch series for adding pidfd support to the fanotify
> API.
> 
> tl;dr rather than returning a pid within struct
> fanotify_event_metadata, a pidfd is returned instead when fanotify has
> been explicitly told to do so via the new FAN_REPORT_PIDFD flag.
> 
> The main driver behind returning a pidfd within an event instead of a
> pid is that it permits userspace applications to better detect if
> they've possibly lost a TOCTOU race. A common paradigm among userspace
> applications that make use of the fanotify API is to crawl /proc/<pid>
> upon receiving an event. Userspace applications do this in order to
> further ascertain contextual meta-information about the process that
> was responsible for generating the filesystem event. On high pressure
> systems, where pid recycling isn't uncommon, it's no longer considered
> as a reliable approach to directly sift through /proc/<pid> and have
> userspace applications use the information contained within
> /proc/<pid> as it could, and does, lead to program execution
> inaccuracies.
> 
> Now when a pidfd is returned in an event, a userspace application can:
> 
>     a) Obtain the pid responsible for generating the filesystem event
>        from the pidfds fdinfo.
> 
>     b) Detect whether the userspace application lost the procfs access
>        race by sending a 0 signal on the pidfd and checking the return
>        value. A -ESRCH is indicative of the userspace application
>        losing the race, meaning that the pid has been recycled.

Thank you for working on this Matthew.

I'm explicitly adding Jann and Oleg to the thread since both have been
involved in the original design.

Oleg, Jann, I know this isn't necessarily your area of expertise but if
you could share your thoughts about returning pidfds that haven't been
opened via pidfd_open() or CLONE_PIDFD that would be great.
I've been conservative about this so far but I find it hard to resist
use-cases such as this.

Christian

      parent reply index

Thread overview: 35+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2021-04-15 23:21 Matthew Bobrowski
2021-04-15 23:22 ` [PATCH 1/2] pidfd_create(): remove static qualifier and declare pidfd_create() in linux/pid.h Matthew Bobrowski
2021-04-19 10:13   ` Jan Kara
2021-04-19 12:50   ` Christian Brauner
2021-04-20  0:17     ` Matthew Bobrowski
2021-04-15 23:22 ` [PATCH 2/2] fanotify: Add pidfd support to the fanotify API Matthew Bobrowski
2021-04-16  6:27   ` Amir Goldstein
2021-04-16  7:05     ` Matthew Bobrowski
2021-04-16  7:53       ` Amir Goldstein
2021-04-16  8:08         ` Matthew Bobrowski
2021-04-19 13:02     ` Christian Brauner
2021-04-19 10:21   ` Jan Kara
2021-04-20  1:35     ` Matthew Bobrowski
2021-04-19 13:20   ` Christian Brauner
2021-04-19 13:53     ` Amir Goldstein
2021-04-19 14:44       ` Christian Brauner
2021-04-19 13:55     ` Jan Kara
2021-04-19 15:02       ` Christian Brauner
2021-04-20  2:36         ` Matthew Bobrowski
2021-04-21  8:04           ` Jan Kara
2021-04-21  9:29             ` Amir Goldstein
2021-04-21 10:00               ` Jan Kara
2021-04-21 10:12                 ` Amir Goldstein
2021-04-21 13:48                   ` Jan Kara
2021-04-21 14:46                     ` Christian Brauner
2021-04-22 23:06             ` Matthew Bobrowski
2021-04-23  7:39               ` Amir Goldstein
2021-04-23  8:02                 ` Matthew Bobrowski
2021-04-23  8:14                   ` Amir Goldstein
2021-04-26 10:26                     ` Matthew Bobrowski
2021-04-26 11:11                       ` Amir Goldstein
2021-04-27  3:35                         ` Matthew Bobrowski
2021-04-27  5:14                           ` Amir Goldstein
2021-04-28 22:53                             ` Matthew Bobrowski
2021-04-19 12:34 ` Christian Brauner [this message]

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20210419123439.q3lzgmk4clqoxs7r@wittgenstein \
    --to=christian.brauner@ubuntu.com \
    --cc=amir73il@gmail.com \
    --cc=jack@suse.cz \
    --cc=jannh@google.com \
    --cc=linux-api@vger.kernel.org \
    --cc=linux-fsdevel@vger.kernel.org \
    --cc=oleg@redhat.com \
    --cc=repnop@google.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link

Linux-Fsdevel Archive on lore.kernel.org

Archives are clonable:
	git clone --mirror https://lore.kernel.org/linux-fsdevel/0 linux-fsdevel/git/0.git

	# If you have public-inbox 1.1+ installed, you may
	# initialize and index your mirror using the following commands:
	public-inbox-init -V2 linux-fsdevel linux-fsdevel/ https://lore.kernel.org/linux-fsdevel \
		linux-fsdevel@vger.kernel.org
	public-inbox-index linux-fsdevel

Example config snippet for mirrors

Newsgroup available over NNTP:
	nntp://nntp.lore.kernel.org/org.kernel.vger.linux-fsdevel


AGPL code for this site: git clone https://public-inbox.org/public-inbox.git