From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mx2.suse.de ([195.135.220.15]:57497 "EHLO mx2.suse.de" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1750721AbcLUFEO (ORCPT ); Wed, 21 Dec 2016 00:04:14 -0500 Subject: Re: [PATCH] fs: exec: apply CLOEXEC before changing dumpable task flags To: Oleg Nesterov References: <20161220110457.22254-1-asarai@suse.de> <20161220172955.GA7776@redhat.com> Cc: viro@zeniv.linux.org.uk, ebiederm@xmission.com, linux-fsdevel@vger.kernel.org, linux-kernel@vger.kernel.org, cyphar@cyphar.com, dev@opencontainers.org From: Aleksa Sarai Message-ID: <622e4440-a328-2785-fb77-9a77c5b000df@suse.de> Date: Wed, 21 Dec 2016 16:04:04 +1100 MIME-Version: 1.0 In-Reply-To: <20161220172955.GA7776@redhat.com> Content-Type: text/plain; charset=windows-1252; format=flowed Content-Transfer-Encoding: 7bit Sender: linux-fsdevel-owner@vger.kernel.org List-ID: >> @@ -1287,6 +1287,13 @@ void setup_new_exec(struct linux_binprm * bprm) >> /* This is the point of no return */ >> current->sas_ss_sp = current->sas_ss_size = 0; >> >> + /* >> + * We have to apply CLOEXEC before we change whether the process is >> + * dumpable to avoid a race with a process in userspace trying to access >> + * the should-be-closed file descriptors of a process undergoing exec(2). >> + */ >> + do_close_on_exec(current->files); > > Cosmetic, but perhaps this should go into flush_old_exec() then? Yeah, I was thinking the same thing. Also, I'll cc stable (v3.2+) to the patch. -- Aleksa Sarai Software Engineer (Containers) SUSE Linux GmbH https://www.cyphar.com/