Skip to contentSkip to conversation

'kill sig -1' must only apply to callers namespace

RFC PATCH In review [email protected] 3 participants 3 messages Oct 22, 2008 1 message not in the archive

lore
Share & tools
lore

[email protected]

author
#0 lore raw

RFC PATCH 1/1 'kill sig -1' must only apply to callers namespace

From d92b4befe07c6a1e852e4462126a5443342448cd Mon Sep 17 00:00:00 2001
From: Sukadev Bhattiprolu <[email protected]>
Date: Tue, 21 Oct 2008 18:00:01 -0700
Subject: [PATCH] kill sig -1 must only apply to callers namespace

Currently "kill <sig> -1" kills processes in all namespaces and breaks the isolation of namespaces. Earlier attempt to fix this is discussed at:

	http://lkml.org/lkml/2008/7/23/148

but nothing seems to have happened since then.

This patch uses the simple fix suggested by Oleg Nesterov.

Signed-off-by Sukadev Bhattiprolu <sukadev-r/[email protected]>
---
 kernel/signal.c |    3 ++-
 1 files changed, 2 insertions(+), 1 deletions(-)
kernel/signal.c +2 -1
index 105217d..4530fc6 100644
@@ -1144,7 +1144,8 @@ static int kill_something_info(int sig, struct siginfo *info, pid_t pid)
 		struct task_struct * p;
 
 		for_each_process(p) {
-			if (p->pid > 1 && !same_thread_group(p, current)) {
+			if (task_pid_vnr(p) > 1 &&
+					!same_thread_group(p, current)) {
 				int err = group_send_sig_info(sig, info, p);
 				++count;
 				if (err != -EPERM)
Signature · 1 line
1.5.2.5

A message that is not in the archive (sent off-list or not yet received): 20081022014141.GA25355-r/[email protected]

Tested-by
#2 lore raw
Quoted 9 lines · [email protected] wrote:
Quoted 2 lines

From d92b4befe07c6a1e852e4462126a5443342448cd Mon Sep 17 00:00:00 2001

From: Sukadev Bhattiprolu <[email protected]>
Date: Tue, 21 Oct 2008 18:00:01 -0700
Subject: [PATCH] kill sig -1 must only apply to callers namespace

Currently "kill <sig> -1" kills processes in all namespaces and breaks the isolation of namespaces. Earlier attempt to fix this is discussed at:

Quoted 7 lines
	http://lkml.org/lkml/2008/7/23/148

but nothing seems to have happened since then.

This patch uses the simple fix suggested by Oleg Nesterov.

Signed-off-by Sukadev Bhattiprolu <sukadev-r/[email protected]>
Tested-by Daniel Hokka Zakrisson <[email protected]>

Thank you for taking care of this.

Quoted 21 lines
---
 kernel/signal.c |    3 ++-
 1 files changed, 2 insertions(+), 1 deletions(-)
kernel/signal.c +2 -1
index 105217d..4530fc6 100644
@@ -1144,7 +1144,8 @@ static int kill_something_info(int sig, struct siginfo *info, pid_t
 pid)
 		struct task_struct * p;
 
 		for_each_process(p) {
-			if (p->pid > 1 && !same_thread_group(p, current)) {
+			if (task_pid_vnr(p) > 1 &&
+					!same_thread_group(p, current)) {
 				int err = group_send_sig_info(sig, info, p);
 				++count;

if (err != -EPERM)
--
1.5.2.5

Signature · 1 line
Daniel Hokka Zakrisson
Acked-by
#3 lore raw
In reply to a message not in the archive
Quoted 11 lines · [email protected] writes:
Quoted 1 line

From d92b4befe07c6a1e852e4462126a5443342448cd Mon Sep 17 00:00:00 2001

From: Sukadev Bhattiprolu <[email protected]>
Date: Tue, 21 Oct 2008 18:00:01 -0700
Subject: [PATCH] kill sig -1 must only apply to callers namespace

Currently "kill <sig> -1" kills processes in all namespaces and breaks the isolation of namespaces. Earlier attempt to fix this is discussed at:

	http://lkml.org/lkml/2008/7/23/148

but nothing seems to have happened since then.

Ugh. I thought that conversation had resolved the problem and gotten a patch in.

This patch works because pid_vnr returns 0 for processes outside of the current pid namespace.

Quoted 3 lines

This patch uses the simple fix suggested by Oleg Nesterov.

Signed-off-by Sukadev Bhattiprolu <sukadev-r/[email protected]>
Acked-by "Eric W. Biederman" <ebiederm-aS9lmoZGLiVWk0Htik3J/[email protected]>
Quoted 21 lines
---
 kernel/signal.c |    3 ++-
 1 files changed, 2 insertions(+), 1 deletions(-)
kernel/signal.c +2 -1
index 105217d..4530fc6 100644
@@ -1144,7 +1144,8 @@ static int kill_something_info(int sig, struct siginfo
 *info, pid_t pid)
 		struct task_struct * p;
 
 		for_each_process(p) {
-			if (p->pid > 1 && !same_thread_group(p, current)) {
+			if (task_pid_vnr(p) > 1 &&
+					!same_thread_group(p, current)) {
 				int err = group_send_sig_info(sig, info, p);
 				++count;

if (err != -EPERM)

Signature · 1 line
1.5.2.5