Re: Re: patch to fix [omkmigd] <defunct>
tab-mTI/[email protected] (Vincent Hanquez)
| Newsgroups | gmane.linux.cluster.openmosix.devel |
|---|---|
| Message-ID | <[email protected]> |
On Mon, Apr 24, 2006 at 04:13:24PM +0200, Ralf Oelschlaegel wrote: > okay, it works:-) > May be we have a security problem now. A user start a job, root migrate the > job to a remote node and appears as omkmigd process of root. On the home > node we can see the process with [job] of the user. > If the job migrate home, we have no <defunct> - nice, but the UID for this > job on home node is root!! Don't know that the job has realy rootrights > (user may kill this job). ff yes theire is a problem. > The next migration show the process with [job] for root. reparent_to_init overwrite some value here and there, so it should had been done before setting data from the migration. Now I don't think that's very important that the migrated process on the remote node run with the correct UID. that shouldn't matter in a perfect world since the migrated process is running in an isolated namespace. However if the process that migrate home is really root, then that's a problem. in mig_do_receive_proc_context, if the process is DDEPUTY, it should not get some of those value from the remote node. Specially since it already have the original p->uid, p->gid, ... -- Vincent Hanquez ------------------------------------------------------- Using Tomcat but need to do more? Need to support web services, security? Get stuff done quickly with pre-integrated technology to make your job easier Download IBM WebSphere Application Server v.1.0.1 based on Apache Geronimo http://sel.as-us.falkag.net/sel?cmd=lnk&kid=120709&bid=263057&dat=121642