I read that the process descriptor in Linux (on x86) is stored in the kernel data segment but at an address below PAGE_OFFSET (i.e. in user address space). Since the kernel data segment and user data segments both cover the full 4GB address space, then presumably it would be possible to access the process descriptor through the user data segment, if its address was known to user code. Is this correct, and if so, is it not a security hole?
A related question: there was an assertion that the linear address of the process descriptor can serve as a unique process ID. However, as linear addresses get translated using the page table, and the page table is different for every process for addresses below PAGE_OFFSET, then couldn't two processes store their process descriptors at the same linear address?
In linux, the "process descriptor" is struct task_struct [and some others]. These are stored in kernel address space [above PAGE_OFFSET] and not in userspace.
This is more relevant to 32 bit kernels where PAGE_OFFSET is set to 0xc0000000.
In a 32 bit kernel, a user process virtual address space was limited to PAGE_OFFSET
64 bit kernels are somewhat different and the limit doesn't matter as much. PAGE_OFFSET is 0xffff880000000000
Also, the kernel has a single address space mapping of its own.
Each process/thread has its own virtual address space, that, barring shared memory for .so libraries and shared memory for threads is unique. It does not map to anything in kernel address space.
Even with [if there were] a common address space mapping the kernel pages are read/write protected from the user process.
A related question:
This is really two questions
there was an assertion that the linear address of the process descriptor can serve as a unique process ID.
No. This can not be done for a few reasons.
Only the kernel has access to (i.e. "knows") the task_struct address.
Secondly, if a process terminates, it is a zombie until the parent process "reaps" it via wait. The kernel must remember which processes are zombies (i.e. their pids will not be reused for a new process) until the parent reaps them.
The task_struct is rather large, though. So, when a process enters zombie, the kernel grabs a small portion of the task_struct data (e.g. pid and status) and saves them in a "zombie" struct. The kernel can then reuse the task_struct [using a different pid] almost immediately.
For example, while a process with pid 37 may have had a task struct at address (e.g.) 0x1000 while it was running, after termination, but before reap, pid 37 has no task struct address and the task struct at 0x1000 could already be assigned to pid 23727
However, as linear addresses get translated using the page table, and the page table is different for every process for addresses below PAGE_OFFSET, then couldn't two processes store their process descriptors at the same linear address?
Once again, no.