On 03/07/2014 03:57 PM, Tom Lane wrote:
> I think Florian's right that there's a risk there, but it seems pretty
> remote, and I don't see any reliable way to detect the case anyhow.
> (Process start time? Where would you get that from portably?)
I don't think there's a portable source for that. On Linux, you'd have
to use /proc.
> It's not a reason not to do something about the much larger chance of
> this happening in a direct child process, which certainly won't have a
> matching PID.
Indeed. Checking getppid() in addition might narrow things down further.
On Linux, linking against pthread_atfork currently requires linking
against pthread (although this is about to change), and it might incur
the pthread-induced overhead on some configurations.
--
Florian Weimer / Red Hat Product Security Team