Re: [PATCH] fs: exec: apply CLOEXEC before changing dumpable task flags

[Aleksa Sarai]

> > @@ -1287,6 +1287,13 @@ void setup_new_exec(struct linux_binprm * bprm)
> >  	/* This is the point of no return */
> >  	current->sas_ss_sp = current->sas_ss_size = 0;
> >
> > +	/*
> > +	 * We have to apply CLOEXEC before we change whether the process is
> > +	 * dumpable to avoid a race with a process in userspace trying to access
> > +	 * the should-be-closed file descriptors of a process undergoing exec(2).
> > +	 */
> > +	do_close_on_exec(current->files);
>
> Cosmetic, but perhaps this should go into flush_old_exec() then?

Yeah, I was thinking the same thing. Also, I'll cc stable (v3.2+) to the 
patch.

--
Aleksa Sarai
Software Engineer (Containers)
SUSE Linux GmbH
https://www.cyphar.com/