Hi Oleg, I have not been able to update my patch with your and Peter Peter Zijlstra's kind suggestions, because I am currently too busy with my role as openssl maintainer.
Just for clarification, my patch is 10% about deadlocks, and 90% about security. The idea is that if the de_thread is blocked, and the debugger may be trying to ptrace the exec thread. That must succeed or fail. So the debugger can release the zombie threads. The security issue is when the debugged process tries to exec a SUID process like /usr/bin/passwd In that case the new credentials are determined differently when the PTRACE is already attached (i.e. non-root), than when it is not yet attached (root user). My attempt at fixing this, determines the new credentials and the new dumpability as root user when the debugger did not yet attach before the de_thread. And keeps this decision. When the debugger wants to attach the de_thread the debug-user access rights are checked against the current user and additionally against the new user credentials. This I did by quickly switching the user credenitals to the next user and back again, under the cred_guard_mutex, which should make that safe. So at this time I have only one request for you. Could you please try out how the test case in my patch behaves with your fix? Thanks Bernd. On 11/9/25 18:14, Oleg Nesterov wrote: > Not for inclusion yet. 2/2 is untested, incomplete, possibly buggy. > > But could you review at least the intent? Do you see any problem with > this approach? > > This problem is very, very old. It seems that nobody can suggest a > simple/clean fix... > > Oleg. > --- > > fs/binfmt_elf.c | 4 +- > fs/binfmt_elf_fdpic.c | 4 +- > fs/binfmt_flat.c | 4 +- > fs/exec.c | 142 > +++++++++++++++++++++++------------------------- > include/linux/binfmts.h | 2 +- > kernel/exit.c | 9 +-- > kernel/signal.c | 6 +- > 7 files changed, 87 insertions(+), 84 deletions(-) >
