On Thu, May 29, 2025 at 7:44 AM Lorenzo Stoakes <lorenzo.stoakes@xxxxxxxxxx> wrote: > > The behaviour will be tailored to each action taken. > > To begin with, I propose a single flag: > > - MCTL_SET_DEFAULT_EXEC - Persists this behaviour across fork/exec. It's hard to comment without a more complete proposal (*what* behavior is persisted?), but off the top of my head, this isn't so great. First, the name means nothing to me. What's "default exec"? Even aside from that, why are fork and exec the same flag? Beyond this, persisting anything across exec is a giant can of worms. We have PR_SET_NO_NEW_PRIVS to make it less hazardous, but, in general, it's risky and potentially quite confusing to do anything that affects exec'd processes. Oh, and this whole scheme is also potentially nasty for a different reason: it's not thread safe. If one thread wants to spawn a process, it should not interfere with another thread doing something else. So making an mm flag that persists across close can interfere a bit, and persisting it across clone + exec is even gnarlier. For any of these, there should be matching query features -- CRIU, debugging, etc should not be an afterthought.
