• David Herrmann's avatar
    fork: record start_time late · 7b558513
    David Herrmann authored
    This changes the fork(2) syscall to record the process start_time after
    initializing the basic task structure but still before making the new
    process visible to user-space.
    
    Technically, we could record the start_time anytime during fork(2).  But
    this might lead to scenarios where a start_time is recorded long before
    a process becomes visible to user-space.  For instance, with
    userfaultfd(2) and TLS, user-space can delay the execution of fork(2)
    for an indefinite amount of time (and will, if this causes network
    access, or similar).
    
    By recording the start_time late, it much closer reflects the point in
    time where the process becomes live and can be observed by other
    processes.
    
    Lastly, this makes it much harder for user-space to predict and control
    the start_time they get assigned.  Previously, user-space could fork a
    process and stall it in copy_thread_tls() before its pid is allocated,
    but after its start_time is recorded.  This can be misused to later-on
    cycle through PIDs and resume the stalled fork(2) yielding a process
    that has the same pid and start_time as a process that existed before.
    This can be used to circumvent security systems that identify processes
    by their pid+start_time combination.
    
    Even though user-space was always aware that start_time recording is
    flaky (but several projects are known to still rely on start_time-based
    identification), changing the start_time to be recorded late will help
    mitigate existing attacks and make it much harder for user-space to
    control the start_time a process gets assigned.
    Reported-by: default avatarJann Horn <jannh@google.com>
    Signed-off-by: default avatarTom Gundersen <teg@jklm.no>
    Signed-off-by: default avatarDavid Herrmann <dh.herrmann@gmail.com>
    Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
    7b558513
fork.c 63.3 KB