Re: [PATCH 1/9] exec: add a global execve counter

[Oleg Nesterov <oleg@xxxxxxxxxx>]

On 03/11, Djalal Harouni wrote:
>
> --- a/include/linux/sched.h
> +++ b/include/linux/sched.h
> @@ -1420,6 +1420,9 @@ struct task_struct {
>  #endif
>  	seccomp_t seccomp;
>
> +/* Execve counter: will be used to check if objects belong to the appropriate
> + * process image */
> +	atomic64_t exec_id;
>  /* Thread group tracking */
>     	u32 parent_exec_id;
>     	u32 self_exec_id;

Well, I don't think it is right to add this counter into task_struct.

It should be per-process, signal_struct makes more sense. Or may be
mm_struct.

Btw this is also true for parent_exec_id/self_exec_id, but this is
another story.

Oleg.

--
To unsubscribe from this list: send the line "unsubscribe linux-security-module" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html