From mboxrd@z Thu Jan 1 00:00:00 1970 X-Msuck: nntp://news.gmane.org/gmane.linux.lib.musl.general/14775 Path: news.gmane.org!.POSTED.blaine.gmane.org!not-for-mail From: Rich Felker Newsgroups: gmane.linux.lib.musl.general Subject: Re: Re: posix_spawn Date: Tue, 1 Oct 2019 11:06:14 -0400 Message-ID: <20191001150614.GF16318@brightrain.aerifal.cx> References: <20190930223632.GW9017@brightrain.aerifal.cx> <20191001022102.GA16318@brightrain.aerifal.cx> <20191001025543.GB16318@brightrain.aerifal.cx> <87pnjhvtch.fsf@oldenburg2.str.redhat.com> <20191001114246.GC16318@brightrain.aerifal.cx> <87muektuud.fsf@oldenburg2.str.redhat.com> <20191001144455.GE16318@brightrain.aerifal.cx> Reply-To: musl@lists.openwall.com Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Injection-Info: blaine.gmane.org; posting-host="blaine.gmane.org:195.159.176.226"; logging-data="200975"; mail-complaints-to="usenet@blaine.gmane.org" User-Agent: Mutt/1.5.21 (2010-09-15) Cc: Joshua Hudson , "musl@lists.openwall.com" To: Florian Weimer Original-X-From: musl-return-14791-gllmg-musl=m.gmane.org@lists.openwall.com Tue Oct 01 17:06:32 2019 Return-path: Envelope-to: gllmg-musl@m.gmane.org Original-Received: from mother.openwall.net ([195.42.179.200]) by blaine.gmane.org with smtp (Exim 4.89) (envelope-from ) id 1iFJjT-000q9b-V1 for gllmg-musl@m.gmane.org; Tue, 01 Oct 2019 17:06:32 +0200 Original-Received: (qmail 31813 invoked by uid 550); 1 Oct 2019 15:06:29 -0000 Mailing-List: contact musl-help@lists.openwall.com; run by ezmlm Precedence: bulk List-Post: List-Help: List-Unsubscribe: List-Subscribe: List-ID: Original-Received: (qmail 31793 invoked from network); 1 Oct 2019 15:06:28 -0000 Content-Disposition: inline In-Reply-To: <20191001144455.GE16318@brightrain.aerifal.cx> Original-Sender: Rich Felker Xref: news.gmane.org gmane.linux.lib.musl.general:14775 Archived-At: On Tue, Oct 01, 2019 at 10:44:55AM -0400, Rich Felker wrote: > On Tue, Oct 01, 2019 at 04:15:54PM +0200, Florian Weimer wrote: > > * Joshua Hudson: > > > > > You guys open to adding more extensions to posix_spawn? > > > > > > The code that I'm actually trying to run is setgroups;setgid;setuid so > > > I think the use case is common. > > > > > > More of the security-critical code being in the library is generally a > > > good thing. > > > > Rich is objecting to my glibc changes. We require unanimous consent at > > present. Unless I can convince him that his analysis is incorrect, that > > essentially kills further API additions in this area. > > Can you point me to which ones you're referring to? I'm not generally > opposed to extensions to solve the deficiencies in posix_spawn, but > there may be one I'm not remembering where there was something about > it in particular that I found problematic. Ah, if it's this particular feature, arbitrary credential changes rather than just resetting effective ids back to real ones, then there are concerns like in this thread about tasks with different credentials sharing same VM space. However, I think since there's no opportunity to control execution in the child until after execve, it can probably be made safe; if not, CLONE_VM could be omitted when the relevant attribute is used. Rich