[GIT PULL RESEND] pidfd changes for v5.1-rc1
From: Jonathon Kowalski
Date: Wed Mar 13 2019 - 01:00:55 EST
Thanks for the work on this system call! I am interested in making use
of it in my process supervisor. It works pretty well and avoids the
long-standing issue of PID reuse.
One thing that instantly came to mind is to be able to delegate killing
to some third process depending on the confguration. However, I don't
see that permissions are attached to the open file description, but
seemed to be checked when calling pidfd_send_signal as they are with
kill(2). Is there any particular reason this was avoided? For instance,
if a process with CAP_KILL opens the procfd, shouldn't any process that
uses a descriptor pointing to this same file description be permitted to
send signals? It would be a lot more useful that way.
There doesn't seem to much benefit of using file descriptors for
processes otherwise if cannot use them that way, apart from PID reuse.
So, is something like this on the roadmap in the future, and if not,
what was the reason it was avoided? I don't see a problem with using
CAP_KILL to not check permissions at call time, otherwise I can see why
it would be a problem in general (because processes can change credentials).