Bug 193921

Summary: /proc/timer_list leaks the real pids of the associated processes
Product: Timers Reporter: Xing Gao (xgao01)
Component: OtherAssignee: john stultz (john.stultz)
Status: NEW ---    
Severity: normal    
Priority: P1    
Hardware: All   
OS: Linux   
Kernel Version: 4.9 Subsystem:
Regression: No Bisected commit-id:

Description Xing Gao 2017-02-03 21:46:15 UTC 
The pseudo file /proc/timer_list leaks the real pids of the associated processes. 

The function print_timer(kernel/time/timer_list.c) displays timer->start_pid, which is set inside the function __timer_stats_timer_set_start_info (kernel/time/timer.c). This is the real pid, rather than the pid in the pid namespace. If the user within a container retrieves the content of /proc/timer_list, this file will leak the real pid of the associated process. 

Docker has blocked the read access to /proc/timer_list. But there should be a kernel fix to address this information leakage.
Comment 1 john stultz 2017-02-03 21:51:34 UTC 
Please send this to lkml and add Thomas Gleixner <tglx@linutronix.de> and Kees Cook <keescook@google.com> to the cc.