Re: [PATCH] proc: allow killing processes via file descriptors

On Sun, Nov 18, 2018 at 8:17 AM, Andy Lutomirski [off-list ref] wrote:

On Sun, Nov 18, 2018 at 7:53 AM Daniel Colascione [off-list ref] wrote:

quoted

On Sun, Nov 18, 2018 at 7:38 AM, Andy Lutomirski [off-list ref] wrote:

quoted

I fully agree that a more comprehensive, less expensive API for
managing processes would be nice.  But I also think that this patch
(using the directory fd and ioctl) is better from a security
perspective than using a new file in /proc.

That's an assertion, not an argument. And I'm not opposed to an
operation on the directory FD, now that it's clear Linus has banned
"write(2)-as-a-command" APIs. I just insist that we implement the API
with a system call instead of a less-reliable ioctl due to the
inherent namespace collision issues in ioctl command names.

Linus banned it because of bugs iike the ones in the patch.

Maybe: he didn't provide a reason. What's your point?

quoted

quoted

I have an old patch to make proc directory fds pollable:

https://lore.kernel.org/patchwork/patch/345098/

That patch plus the one in this thread might make a nice addition to
the kernel even if we expect something much better to come along
later.

I've always commented on that patch. You never addressed my technical
objections. Why are you bringing up this patch again as if that
discussion had never happened? To review, that patch has various race
conditions

I don't think I ever saw that review.

https://lore.kernel.org/lkml/CAKOZuevXXqwJepmLNUtrU=f8jtdgdKAzUAnAA2+KVcWoMxMyFg@mail.gmail.com/ (local)

quoted

and even if it were technically correct, it'd be an abuse
of directory objects (in what other circumstance do we poll
directories?) and not logically generalizable to a model in which we
expose process exit status via the exit-monitoring API.

I agree it's weird.  It might be better to have /proc/PID/exit_status
and make *that* pollable.

That's exactly what my patch provides. I feel like we're rehashing the
previous discussion.