linux/include
Vasiliy Kulikov 72fa59970f move RLIMIT_NPROC check from set_user() to do_execve_common()
The patch http://lkml.org/lkml/2003/7/13/226 introduced an RLIMIT_NPROC
check in set_user() to check for NPROC exceeding via setuid() and
similar functions.

Before the check there was a possibility to greatly exceed the allowed
number of processes by an unprivileged user if the program relied on
rlimit only.  But the check created new security threat: many poorly
written programs simply don't check setuid() return code and believe it
cannot fail if executed with root privileges.  So, the check is removed
in this patch because of too often privilege escalations related to
buggy programs.

The NPROC can still be enforced in the common code flow of daemons
spawning user processes.  Most of daemons do fork()+setuid()+execve().
The check introduced in execve() (1) enforces the same limit as in
setuid() and (2) doesn't create similar security issues.

Neil Brown suggested to track what specific process has exceeded the
limit by setting PF_NPROC_EXCEEDED process flag.  With the change only
this process would fail on execve(), and other processes' execve()
behaviour is not changed.

Solar Designer suggested to re-check whether NPROC limit is still
exceeded at the moment of execve().  If the process was sleeping for
days between set*uid() and execve(), and the NPROC counter step down
under the limit, the defered execve() failure because NPROC limit was
exceeded days ago would be unexpected.  If the limit is not exceeded
anymore, we clear the flag on successful calls to execve() and fork().

The flag is also cleared on successful calls to set_user() as the limit
was exceeded for the previous user, not the current one.

Similar check was introduced in -ow patches (without the process flag).

v3 - clear PF_NPROC_EXCEEDED on successful calls to set_user().

Reviewed-by: James Morris <jmorris@namei.org>
Signed-off-by: Vasiliy Kulikov <segoon@openwall.com>
Acked-by: NeilBrown <neilb@suse.de>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2011-08-11 11:24:42 -07:00
..
acpi Merge branch 'apei-release' of git://git.kernel.org/pub/scm/linux/kernel/git/lenb/linux-acpi-2.6 2011-08-03 21:53:27 -10:00
asm-generic Merge branch 'next/cross-platform' of git://git.kernel.org/pub/scm/linux/kernel/git/arm/linux-arm-soc 2011-07-26 17:12:10 -07:00
crypto
drm drm: Separate EDID Header Check from EDID Block Check 2011-08-04 14:39:35 +01:00
keys
linux move RLIMIT_NPROC check from set_user() to do_execve_common() 2011-08-11 11:24:42 -07:00
math-emu
media [media] V4L: initial driver for ov5642 CMOS sensor 2011-07-27 17:56:09 -03:00
mtd
net net: Compute protocol sequence numbers and fragment IDs using MD5. 2011-08-06 18:33:19 -07:00
pcmcia Merge git://git.kernel.org/pub/scm/linux/kernel/git/brodo/pcmcia-2.6 2011-07-31 06:23:08 -10:00
rdma atomic: use <linux/atomic.h> 2011-07-26 16:49:47 -07:00
rxrpc atomic: use <linux/atomic.h> 2011-07-26 16:49:47 -07:00
scsi Merge branch 'for-linus' of git://git.open-osd.org/linux-open-osd 2011-08-06 22:56:03 -07:00
sound ASoC: Rename WM8915 to WM8996 2011-08-08 14:30:37 +09:00
target target: Bump version to v4.1.0-rc1-ml 2011-07-22 09:37:49 +00:00
trace Merge branch 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tytso/ext4 2011-08-01 13:56:03 -10:00
video OMAP: DSS2: Remove unused opt_clock_available 2011-07-25 10:22:05 +03:00
xen xen/balloon: memory hotplug support for Xen balloon driver 2011-07-25 20:57:08 -07:00
Kbuild