RGBCube/serenity
1
Fork 0
mirror of https://github.com/RGBCube/serenity synced 2025-10-31 16:02:45 +00:00
Code Issues Activity Actions

Kernel: Allow relaxing cleanup task rules during system shutdown

Browse source 
Once we move to a more proper shutdown procedure, processes other than
the finalizer task must be able to perform cleanup and finalization
duties, not only because the finalizer task itself needs to be cleaned
up by someone. This global variable, mirroring the early boot flags,
allows a future shutdown process to perform cleanup on its own.

Note that while this *could* be considered a weakening in security, the
attack surface is minimal and the results are not dramatic. To exploit
this, an attacker would have to gain a Kernel write primitive to this
global variable (bypassing KASLR among other things) and then gain some
way of calling the relevant functions, all of this only to destroy some
other running process. The same effect can be achieved with LPE which
can often be gained with significantly simpler userspace exploits (e.g.
of setuid binaries).
This commit is contained in:
kleines Filmröllchen 2023-07-10 00:20:48 +02:00 • committed by Jelle Raaijmakers
parent 021fb3ea05
commit 2fd23745a9
6 changed files with 39 additions and 5 deletions
Download patch file Download diff file Expand all files Collapse all files

12
Kernel/Tasks/Process.cpp
View file

@ -46,6 +46,7 @@ namespace Kernel {
static void create_signal_trampoline();
extern ProcessID g_init_pid;
extern bool g_in_system_shutdown;
RecursiveSpinlock<LockRank::None> g_profiling_lock {};
static Atomic<pid_t> next_pid;
@ -749,7 +750,8 @@ ErrorOr<void> Process::dump_perfcore()
void Process::finalize()
{
VERIFY(Thread::current() == g_finalizer);
if (!g_in_system_shutdown)
VERIFY(Thread::current() == g_finalizer);
dbgln_if(PROCESS_DEBUG, "Finalizing process {}", *this);
@ -759,8 +761,12 @@ void Process::finalize()
});
}
if (g_init_pid != 0 && pid() == g_init_pid)
PANIC("Init process quit unexpectedly. Exit code: {}", termination_status());
if (g_init_pid != 0 && pid() == g_init_pid) {
if (g_in_system_shutdown)
dbgln("Init process quitting for shutdown.");
else
PANIC("Init process quit unexpectedly. Exit code: {}", termination_status());
}
if (is_dumpable()) {
if (m_should_generate_coredump) {