Re: [PATCH] Fix race condition when exec'ing setuid files

[Jorge Merlino <jorge.merlino@canonical.com>]

El 13/9/22 a las 19:03, Kees Cook escribió:
> Thanks for reporting this and for having a reproducer!
> 
> It looks like this is "failing safe", in the sense that the bug causes
> an exec of a setuid binary to not actually change the euid. Is that an
> accurate understanding here?

Yes, that is correct.

>> This patch sort of fixes this by setting a process flag to the parent
>> process during the time this race is possible. Thus, if a process is
>> forking, it counts an extra user fo the fs_struct as the counter might be
>> incremented before the thread is visible. But this is not great as this
>> could generate the opposite problem as there may be an external process
>> sharing the fs_struct that is masked by some thread that is being counted
>> twice. I submit this patch just as an idea but mainly I want to introduce
>> this issue and see if someone comes up with a better solution.
> 
> I'll want to spend some more time studying this race, but yes, it looks
> like it should get fixed. I'm curious, though, how did you find this
> problem? It seems quite unusual to have a high-load heavily threaded
> process decide to exec.

It was reported to Canonical by a customer. I don't know exactly the 
circumstances where they see this problem occur in production.

Thanks
	Jorge