1
Fork 0
mirror of https://github.com/RGBCube/serenity synced 2025-07-26 02:57:36 +00:00

Kernel: Make Credentials the authority on process SID

The SID was duplicated between the process credentials and protected
data. And to make matters worse, the credentials SID was not updated in
sys$setsid.

This patch fixes this by removing the SID from protected data and
updating the credentials SID everywhere.
This commit is contained in:
Andreas Kling 2023-04-04 16:49:42 +02:00
parent f764b8b113
commit 84ac957d7a
3 changed files with 20 additions and 11 deletions

View file

@ -114,7 +114,6 @@ class Process final
public: public:
ProcessID pid { 0 }; ProcessID pid { 0 };
ProcessID ppid { 0 }; ProcessID ppid { 0 };
SessionID sid { 0 };
// FIXME: This should be a NonnullRefPtr // FIXME: This should be a NonnullRefPtr
RefPtr<Credentials> credentials; RefPtr<Credentials> credentials;
RefPtr<ProcessGroup> process_group; RefPtr<ProcessGroup> process_group;
@ -233,10 +232,7 @@ public:
{ {
return with_protected_data([](auto& protected_data) { return protected_data.pid; }); return with_protected_data([](auto& protected_data) { return protected_data.pid; });
} }
SessionID sid() const SessionID sid() const { return credentials()->sid(); }
{
return with_protected_data([](auto& protected_data) { return protected_data.sid; });
}
bool is_session_leader() const { return sid().value() == pid().value(); } bool is_session_leader() const { return sid().value() == pid().value(); }
ProcessGroupID pgid() const ProcessGroupID pgid() const
{ {

View file

@ -103,7 +103,6 @@ ErrorOr<FlatPtr> Process::sys$fork(RegisterState& regs)
child_protected_data.execpromises = my_protected_data.execpromises.load(); child_protected_data.execpromises = my_protected_data.execpromises.load();
child_protected_data.has_promises = my_protected_data.has_promises.load(); child_protected_data.has_promises = my_protected_data.has_promises.load();
child_protected_data.has_execpromises = my_protected_data.has_execpromises.load(); child_protected_data.has_execpromises = my_protected_data.has_execpromises.load();
child_protected_data.sid = my_protected_data.sid;
child_protected_data.credentials = my_protected_data.credentials; child_protected_data.credentials = my_protected_data.credentials;
child_protected_data.umask = my_protected_data.umask; child_protected_data.umask = my_protected_data.umask;
child_protected_data.signal_trampoline = my_protected_data.signal_trampoline; child_protected_data.signal_trampoline = my_protected_data.signal_trampoline;

View file

@ -32,12 +32,26 @@ ErrorOr<FlatPtr> Process::sys$setsid()
// NOTE: ProcessGroup::create_if_unused_pgid() will fail with EPERM // NOTE: ProcessGroup::create_if_unused_pgid() will fail with EPERM
// if a process group with the same PGID already exists. // if a process group with the same PGID already exists.
auto process_group = TRY(ProcessGroup::create_if_unused_pgid(ProcessGroupID(pid().value()))); auto process_group = TRY(ProcessGroup::create_if_unused_pgid(ProcessGroupID(pid().value())));
return with_mutable_protected_data([&](auto& protected_data) -> ErrorOr<FlatPtr> {
auto new_sid = SessionID(pid().value());
auto credentials = this->credentials();
auto new_credentials = TRY(Credentials::create(
credentials->uid(),
credentials->gid(),
credentials->euid(),
credentials->egid(),
credentials->suid(),
credentials->sgid(),
credentials->extra_gids(),
new_sid,
credentials->pgid()));
with_mutable_protected_data([&](auto& protected_data) {
protected_data.tty = nullptr; protected_data.tty = nullptr;
protected_data.process_group = move(process_group); protected_data.process_group = move(process_group);
protected_data.sid = pid().value(); protected_data.credentials = move(new_credentials);
return protected_data.sid.value();
}); });
return new_sid.value();
} }
ErrorOr<FlatPtr> Process::sys$getpgid(pid_t pid) ErrorOr<FlatPtr> Process::sys$getpgid(pid_t pid)
@ -114,7 +128,7 @@ ErrorOr<FlatPtr> Process::sys$setpgid(pid_t specified_pid, pid_t specified_pgid)
} }
// FIXME: There are more EPERM conditions to check for here.. // FIXME: There are more EPERM conditions to check for here..
auto process_group = TRY(ProcessGroup::find_or_create(new_pgid)); auto process_group = TRY(ProcessGroup::find_or_create(new_pgid));
return process->with_mutable_protected_data([&process, &process_group, new_sid, new_pgid](auto& protected_data) -> ErrorOr<FlatPtr> { return process->with_mutable_protected_data([&process, &process_group, new_pgid](auto& protected_data) -> ErrorOr<FlatPtr> {
auto credentials = process->credentials(); auto credentials = process->credentials();
auto new_credentials = TRY(Credentials::create( auto new_credentials = TRY(Credentials::create(
@ -125,7 +139,7 @@ ErrorOr<FlatPtr> Process::sys$setpgid(pid_t specified_pid, pid_t specified_pgid)
credentials->suid(), credentials->suid(),
credentials->sgid(), credentials->sgid(),
credentials->extra_gids(), credentials->extra_gids(),
new_sid, credentials->sid(),
new_pgid)); new_pgid));
protected_data.credentials = move(new_credentials); protected_data.credentials = move(new_credentials);