Public bug reported:
Package: procps, Ubuntu 24.04 amd64
Affected versions tested: 2:4.0.4-4ubuntu3.2 and 2:4.0.4-4ubuntu3.3
[ Impact ]
Without `--`, procps `kill` truncates a negative PID to its first digit.
Arguments `-TERM -1443247` therefore target PID -1, signaling all permitted
processes instead of group 1443247. This can terminate a desktop session during
ordinary process-group cleanup.
A test-cleanup incident led to this investigation. The original syscall was
not recorded; the parsing defect was subsequently reproduced with signal
delivery blocked.
[ Test Plan ]
On Noble with strace installed, run:
/usr/bin/strace -e trace=kill -e inject=kill:error=EPERM
/usr/bin/kill -0 -1443247
The affected package reports `kill(-1, 0)`; the fixed package must report
`kill(-1443247, 0)`. Signal 0 only checks permissions, and strace additionally
blocks the syscall. Both traces should show EPERM and `(INJECTED)`.
Run `python3 debian/tests/kill-negative-pids` against the installed package.
All 18 cases must pass. They cover single- and multi-digit targets, following
operands, signal options, explicit `--`, positive PIDs, and malformed input.
Local results: amd64 package build succeeds; 133 existing checks pass, three
are untested and one is unsupported. All 12 autopkgtests pass, including the
18-case test; stack-limit is marked superficial. Testing used a Noble container
with an init process and a Bash parent. Detailed logs are available.
[ Where problems could occur ]
Selecting the wrong argv entry could reject a valid PID or signal another
target. The upstream fix alone has this problem for single-digit operands:
`-0 -2` is rejected, and `-0 -1 123` targets 123. The backport accounts for
getopt_long advancing past a complete single-digit option. Both cases are
tested.
The existing early exit after the first negative target is preserved.
[ Other Info ]
Based on [upstream commit
bfbaf43](https://gitlab.com/procps-ng/procps/-/commit/bfbaf43acade8c9de38737e87f4fc535991c8359)
([issue 354](https://gitlab.com/procps-ng/procps/-/issues/354)), with the
single-digit
adjustment described above. The multi-digit fix is already present in the
inspected Resolute source; Noble's 2:4.0.4-4ubuntu3.3 still lacks it.
** Affects: procps (Ubuntu)
Importance: Undecided
Status: New
** Tags: noble
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/2166756
Title:
[Noble SRU] procps kill truncates negative PIDs
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/procps/+bug/2166756/+subscriptions
--
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
