Vasiliy Kulikov 72fa59970f move RLIMIT_NPROC check from set_user() to do_execve_common() ... The patch http://lkml.org/lkml/2003/7/13/226 introduced an RLIMIT_NPROC check in set_user() to check for NPROC exceeding via setuid() and similar functions. Before the check there was a possibility to greatly exceed the allowed number of processes by an unprivileged user if the program relied on rlimit only. But the check created new security threat: many poorly written programs simply don't check setuid() return code and believe it cannot fail if executed with root privileges. So, the check is removed in this patch because of too often privilege escalations related to buggy programs. The NPROC can still be enforced in the common code flow of daemons spawning user processes. Most of daemons do fork()+setuid()+execve(). The check introduced in execve() (1) enforces the same limit as in setuid() and (2) doesn't create similar security issues. Neil Brown suggested to track what specific process has exceeded the limit by setting PF_NPROC_EXCEEDED process flag. With the change only this process would fail on execve(), and other processes' execve() behaviour is not changed. Solar Designer suggested to re-check whether NPROC limit is still exceeded at the moment of execve(). If the process was sleeping for days between set*uid() and execve(), and the NPROC counter step down under the limit, the defered execve() failure because NPROC limit was exceeded days ago would be unexpected. If the limit is not exceeded anymore, we clear the flag on successful calls to execve() and fork(). The flag is also cleared on successful calls to set_user() as the limit was exceeded for the previous user, not the current one. Similar check was introduced in -ow patches (without the process flag). v3 - clear PF_NPROC_EXCEEDED on successful calls to set_user(). Reviewed-by: James Morris <jmorris@namei.org> Signed-off-by: Vasiliy Kulikov <segoon@openwall.com> Acked-by: NeilBrown <neilb@suse.de> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>		2011-08-11 11:24:42 -07:00
..
debug	Merge branch 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jwessel/linux-2.6-kgdb	2011-08-01 13:39:40 -10:00
events
gcov
irq
power
time
trace	Merge branch 'linus' into perf/urgent	2011-08-05 10:33:55 +02:00
.gitignore
acct.c
async.c
audit_tree.c
audit_watch.c
audit.c
audit.h
auditfilter.c
auditsc.c
backtracetest.c
bounds.c
capability.c
cgroup_freezer.c
cgroup.c
compat.c
configs.c
cpu.c
cpuset.c
crash_dump.c
cred.c	move RLIMIT_NPROC check from set_user() to do_execve_common()	2011-08-11 11:24:42 -07:00
delayacct.c
dma.c
elfcore.c
exec_domain.c
exit.c
extable.c
fork.c	move RLIMIT_NPROC check from set_user() to do_execve_common()	2011-08-11 11:24:42 -07:00
freezer.c
futex_compat.c
futex.c	Merge branch 'linus' into core/urgent	2011-08-04 09:09:27 +02:00
groups.c
hrtimer.c
hung_task.c
irq_work.c
itimer.c
jump_label.c
kallsyms.c
Kconfig.freezer
Kconfig.hz
Kconfig.locks
Kconfig.preempt
kexec.c
kfifo.c
kmod.c	Boot up with usermodehelper disabled	2011-08-03 22:03:29 -10:00
kprobes.c
ksysfs.c
kthread.c
latencytop.c
lockdep_internals.h
lockdep_proc.c
lockdep_states.h
lockdep.c	lockdep: Clear whole lockdep_map on initialization	2011-08-04 10:17:56 +02:00
Makefile	jump label: Reduce the cycle count by changing the link order	2011-08-05 23:57:33 +02:00
module.c
mutex-debug.c
mutex-debug.h
mutex.c
mutex.h
notifier.c
nsproxy.c
padata.c
panic.c
params.c
pid_namespace.c
pid.c
pm_qos_params.c
posix-cpu-timers.c
posix-timers.c
printk.c	cap_syslog: don't use WARN_ONCE for CAP_SYS_ADMIN deprecation warning	2011-08-09 18:22:22 -07:00
profile.c
ptrace.c
range.c
rcupdate.c
rcutiny_plugin.h
rcutiny.c
rcutorture.c
rcutree_plugin.h
rcutree_trace.c
rcutree.c
rcutree.h
relay.c
res_counter.c
resource.c
rtmutex_common.h
rtmutex-debug.c
rtmutex-debug.h
rtmutex-tester.c
rtmutex.c
rtmutex.h
rwsem.c
sched_autogroup.c
sched_autogroup.h
sched_clock.c
sched_cpupri.c
sched_cpupri.h
sched_debug.c
sched_fair.c
sched_features.h
sched_idletask.c
sched_rt.c
sched_stats.h
sched_stoptask.c
sched.c
seccomp.c
semaphore.c
signal.c
smp.c
softirq.c
spinlock.c
srcu.c
stacktrace.c
stop_machine.c
sys_ni.c
sys.c	move RLIMIT_NPROC check from set_user() to do_execve_common()	2011-08-11 11:24:42 -07:00
sysctl_binary.c
sysctl_check.c
sysctl.c
taskstats.c	taskstats: add_del_listener() should ignore !valid listeners	2011-08-03 14:25:20 -10:00
test_kprobes.c
time.c
timeconst.pl
timer.c
tracepoint.c
tsacct.c
uid16.c
up.c
user_namespace.c
user-return-notifier.c
user.c
utsname_sysctl.c
utsname.c
wait.c
watchdog.c
workqueue_sched.h
workqueue.c