From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 566AEC4332F for ; Thu, 10 Feb 2022 17:37:40 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S245236AbiBJRhi (ORCPT ); Thu, 10 Feb 2022 12:37:38 -0500 Received: from mxb-00190b01.gslb.pphosted.com ([23.128.96.19]:46560 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S245229AbiBJRhg (ORCPT ); Thu, 10 Feb 2022 12:37:36 -0500 Received: from mail-pf1-x434.google.com (mail-pf1-x434.google.com [IPv6:2607:f8b0:4864:20::434]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 708AEF03 for ; Thu, 10 Feb 2022 09:37:37 -0800 (PST) Received: by mail-pf1-x434.google.com with SMTP id 9so8612365pfx.12 for ; Thu, 10 Feb 2022 09:37:37 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=chromium.org; s=google; h=date:from:to:cc:subject:message-id:references:mime-version :content-disposition:content-transfer-encoding:in-reply-to; bh=N0oLRk9WeOqKeOJsm7SffWghsKhMRhJhnNCJ7hAOzHs=; b=TuUkbtECnMw5pstxW8Vf9MzxmHFnzQ3VrFEtni7dbPixYPAbEo7NkMJuM1Qgj661KE VJk9b0PYPRSKeDN+YxctUa3QcAVCD7gNix6N+IkF65J+3xW2bM603Gziaqz6EhHSn7Mb /8xvocsd5u5OmtK/6qYupEdGZ7DajwT8DsAUM= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=x-gm-message-state:date:from:to:cc:subject:message-id:references :mime-version:content-disposition:content-transfer-encoding :in-reply-to; bh=N0oLRk9WeOqKeOJsm7SffWghsKhMRhJhnNCJ7hAOzHs=; b=pRD7mZS7vkCQdc0lgYuW3/vinIxRrRalxizdsQDfyGpInkU0lmun0yBsWZ5b/5Znyi T9rOP8u66LnAcyzNSI8ToEIqgc60vlC3q/5mXJNL9UG1xjN0ojeUWJjrcWzXoVoFexIO UjeEo8pj9HsZv/Yn08DkXnbZCsqaeb66Hpij+zG7wRJw0AkFVhxoKLuxNyMG95dCdTCe 68Z/fWyuB9EYzZbBx0/hrap1eRMfaUcB9ptRZWLzNjm3WQtKv6sMCdlgQB0hUbGSbu3f 0z/q1m0Fcj38Cb0Y+tCHI0hT5F+fNcuR9Iq3BztSSNtHV9kaIBGv1jd3MZP5/WX6EevI /2gQ== X-Gm-Message-State: AOAM531rHnpfS+jYrneJc9rJVDwp0WRELF5jbvsrHmTyp//Jan2kn9tP l5/ChT19TIIo/xIvZnfWAFM8pI+j+Bd3gg== X-Google-Smtp-Source: ABdhPJxa+zZlprJsPdRL16Vv3RjWBcmKKx4NXwfBhSgmfxd679Na+4oIMIPpYFm1OsZM+mHYkOu5PQ== X-Received: by 2002:a05:6a00:134b:: with SMTP id k11mr8674137pfu.33.1644514656966; Thu, 10 Feb 2022 09:37:36 -0800 (PST) Received: from www.outflux.net (smtp.outflux.net. [198.145.64.163]) by smtp.gmail.com with ESMTPSA id 13sm23620222pfm.161.2022.02.10.09.37.36 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 10 Feb 2022 09:37:36 -0800 (PST) Date: Thu, 10 Feb 2022 09:37:36 -0800 From: Kees Cook To: Jann Horn Cc: "Eric W. Biederman" , Robert =?utf-8?B?xZp3acSZY2tp?= , stable@vger.kernel.org, Andy Lutomirski , Will Drewry , linux-kernel@vger.kernel.org, linux-hardening@vger.kernel.org Subject: Re: [PATCH 1/3] signal: HANDLER_EXIT should clear SIGNAL_UNKILLABLE Message-ID: <202202100935.FB3E60FA5@keescook> References: <20220210025321.787113-1-keescook@chromium.org> <20220210025321.787113-2-keescook@chromium.org> MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Disposition: inline Content-Transfer-Encoding: 8bit In-Reply-To: Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Thu, Feb 10, 2022 at 05:18:39PM +0100, Jann Horn wrote: > On Thu, Feb 10, 2022 at 3:53 AM Kees Cook wrote: > > Fatal SIGSYS signals were not being delivered to pid namespace init > > processes. Make sure the SIGNAL_UNKILLABLE doesn't get set for these > > cases. > > > > Reported-by: Robert Święcki > > Suggested-by: "Eric W. Biederman" > > Fixes: 00b06da29cf9 ("signal: Add SA_IMMUTABLE to ensure forced siganls do not get changed") > > Cc: stable@vger.kernel.org > > Signed-off-by: Kees Cook > > --- > > kernel/signal.c | 5 +++-- > > 1 file changed, 3 insertions(+), 2 deletions(-) > > > > diff --git a/kernel/signal.c b/kernel/signal.c > > index 38602738866e..33e3ee4f3383 100644 > > --- a/kernel/signal.c > > +++ b/kernel/signal.c > > @@ -1342,9 +1342,10 @@ force_sig_info_to_task(struct kernel_siginfo *info, struct task_struct *t, > > } > > /* > > * Don't clear SIGNAL_UNKILLABLE for traced tasks, users won't expect > > - * debugging to leave init killable. > > + * debugging to leave init killable, unless it is intended to exit. > > */ > > - if (action->sa.sa_handler == SIG_DFL && !t->ptrace) > > + if (action->sa.sa_handler == SIG_DFL && > > + (!t->ptrace || (handler == HANDLER_EXIT))) > > t->signal->flags &= ~SIGNAL_UNKILLABLE; > > You're changing the subclause: > > !t->ptrace > > to: > > (!t->ptrace || (handler == HANDLER_EXIT)) > > which means that the change only affects cases where the process has a > ptracer, right? That's not the scenario the commit message is talking > about... Sorry, yes, I was not as accurate as I should have been in the commit log. I have changed it to: Fatal SIGSYS signals (i.e. seccomp RET_KILL_* syscall filter actions) were not being delivered to ptraced pid namespace init processes. Make sure the SIGNAL_UNKILLABLE doesn't get set for these cases. > > > ret = send_signal(sig, info, t, PIDTYPE_PID); > > spin_unlock_irqrestore(&t->sighand->siglock, flags); > > -- > > 2.30.2 > > -- Kees Cook