diff options
| author | Roland McGrath <roland@redhat.com> | 2007-11-11 19:13:43 -0800 |
|---|---|---|
| committer | Linus Torvalds <torvalds@woody.linux-foundation.org> | 2007-11-12 10:32:29 -0800 |
| commit | 00ec99da43a7c2aed46c6595aa271b84bb1b1462 (patch) | |
| tree | 88eec24facdcba422db6a13206d4586daef9e1ad /fs/exec.c | |
| parent | 6e800af233e0bdf108efb7bd23c11ea6fa34cdeb (diff) | |
| download | linux-00ec99da43a7c2aed46c6595aa271b84bb1b1462.tar.gz linux-00ec99da43a7c2aed46c6595aa271b84bb1b1462.tar.bz2 linux-00ec99da43a7c2aed46c6595aa271b84bb1b1462.zip | |
core dump: remain dumpable
The coredump code always calls set_dumpable(0) when it starts (even
if RLIMIT_CORE prevents any core from being dumped). The effect of
this (via task_dumpable) is to make /proc/pid/* files owned by root
instead of the user, so the user can no longer examine his own
process--in a case where there was never any privileged data to
protect. This affects e.g. auxv, environ, fd; in Fedora (execshield)
kernels, also maps. In practice, you can only notice this when a
debugger has requested PTRACE_EVENT_EXIT tracing.
set_dumpable was only used in do_coredump for synchronization and not
intended for any security purpose. (It doesn't secure anything that wasn't
already unsecured when a process dies by SIGTERM instead of SIGQUIT.)
This changes do_coredump to check the core_waiters count as the means of
synchronization, which is sufficient. Now we leave the "dumpable" bits alone.
Signed-off-by: Roland McGrath <roland@redhat.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Diffstat (limited to 'fs/exec.c')
| -rw-r--r-- | fs/exec.c | 6 |
1 files changed, 4 insertions, 2 deletions
diff --git a/fs/exec.c b/fs/exec.c index 2c942e2d14ea..4ccaaa4b13b2 100644 --- a/fs/exec.c +++ b/fs/exec.c @@ -1692,7 +1692,10 @@ int do_coredump(long signr, int exit_code, struct pt_regs * regs) if (!binfmt || !binfmt->core_dump) goto fail; down_write(&mm->mmap_sem); - if (!get_dumpable(mm)) { + /* + * If another thread got here first, or we are not dumpable, bail out. + */ + if (mm->core_waiters || !get_dumpable(mm)) { up_write(&mm->mmap_sem); goto fail; } @@ -1706,7 +1709,6 @@ int do_coredump(long signr, int exit_code, struct pt_regs * regs) flag = O_EXCL; /* Stop rewrite attacks */ current->fsuid = 0; /* Dump root private */ } - set_dumpable(mm, 0); retval = coredump_wait(exit_code); if (retval < 0) |