Re: Re: patch to fix [omkmigd] <defunct>

tab-mTI/[email protected] (Vincent Hanquez)
Newsgroups gmane.linux.cluster.openmosix.devel
Message-ID <[email protected]>
On Mon, Apr 24, 2006 at 04:13:24PM +0200, Ralf Oelschlaegel wrote:
> okay, it works:-)
> May be we have a security problem now. A user start a job, root migrate the 
> job to a remote node and appears as omkmigd process of root. On the home 
> node we can see the process with [job] of the user.
> If the job migrate home, we have no <defunct> - nice, but the UID for this 
> job on home node is root!! Don't know that the job has realy rootrights 
> (user may kill this job). ff yes theire is a problem.
> The next migration show the process with [job] for root.

reparent_to_init overwrite some value here and there, so it should had
been done before setting data from the migration.

Now I don't think that's very important that the migrated process on the
remote node run with the correct UID. that shouldn't matter in a perfect
world since the migrated process is running in an isolated namespace.

However if the process that migrate home is really root, then that's a
problem.

in mig_do_receive_proc_context, if the process is DDEPUTY, it should not
get some of those value from the remote node. Specially since it already
have the original p->uid, p->gid, ...

-- 
Vincent Hanquez


-------------------------------------------------------
Using Tomcat but need to do more? Need to support web services, security?
Get stuff done quickly with pre-integrated technology to make your job easier
Download IBM WebSphere Application Server v.1.0.1 based on Apache Geronimo
http://sel.as-us.falkag.net/sel?cmd=lnk&kid=120709&bid=263057&dat=121642
lmpx.com only provides a reader for public news (NNTP) servers. It is not affiliated with the servers or forums shown here and is not responsible for the content of articles, which is written by their respective authors.