[RFC PATCH v2 03/12] Add *kill, pidfd_send_signal syscalls to %process class

[Ákos Uzonyi]

On Mon, 15 Jun 2020 at 01:50, Dmitry V. Levin <ldv at altlinux.org> wrote:
> On Fri, Jun 12, 2020 at 09:46:11PM +0200, Ákos Uzonyi wrote:
> > On Fri, 12 Jun 2020 at 21:28, Dmitry V. Levin wrote:
> > > On Fri, Jun 12, 2020 at 08:23:57PM +0200, Ákos Uzonyi wrote:
> > > > Since rt_tgsigqueueinfo is part of the %process class, it is reasonable
> > > > to include all other syscalls that send a signal to a process.
> > >
> > > It's still unclear what is the criteria for including syscalls in %process
> > > class.  For example, what about rt_sigqueueinfo?
> >
> > Oh yes, I forgot about rt_sigqueueinfo, thanks. I think after adding
> > rt_sigqueueinfo the criteria I wrote is fulfilled.
>
> The manual page describes %process class as "all system calls which
> involve process management.  This is useful for watching the fork, wait,
> and exec steps of a process."  This description is rather vague,
> and the class currently includes the following system calls:
> - arch_prctl
> - clone
> - clone2
> - clone3
> - execv
> - execve
> - execveat
> - exit
> - exit_group
> - fork
> - rt_tgsigqueueinfo
> - unshare
> - vfork
> - wait4
> - waitid
> - waitpid
>
> It's not obvious why rt_tgsigqueueinfo or any other syscall that sends
> signals to processes should belong to "involve process management" class.

The reason I sent this patch is I noticed that rt_tgsigqueueinfo is
part of the %process class, and if it is, then other signal sending
syscalls should also be included. Also, I think it's a good idea to
include signal sending syscalls, as they relate quite closely to exit*
and wait* syscalls.

But right, the %process class' syscall list is very inconsistent with
the description and even with itself too. So it definitely needs some
rethink. I would suggest that we could rephrase the class description
to something like: "all system calls associated with process lifecycle
(creation, exec, termination)". And the following syscalls would be
included:
* creation:
clone, clone2, clone3, fork, vfork
* exec:
execv, execve, execveat
* termination:
exit, exit_group, rt_tgsigqueueinfo, kill, tkill, pkill,
pidfd_send_signal, wait4, waitid, waitpid

So I think arch_prctl and unshare should be removed, and kill, tkill,
pkill, pidfd_send_signal should be added to this class.