Home
Reading
Searching
Subscribe
Sponsors
Statistics
Posting
Contact
Spam
Lists
Links
About
Hosting
Filtering
Features Download
Marketing
Archives
FAQ
Blog
 
Gmane
From: Linux Kernel Mailing List <linux-kernel <at> vger.kernel.org>
Subject: [PATCH] do_coredump() and not stopping rewrite attacks?
Newsgroups: gmane.linux.kernel.commits.head
Date: Thursday 7th December 2006 17:03:10 UTC (over 10 years ago)
Gitweb:     http://git.kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=6d4df677f8a60ea6bc0ef1a596c1a3a79b1d4882
Commit:     6d4df677f8a60ea6bc0ef1a596c1a3a79b1d4882
Parent:     7d1362c0d05b8543807ab403ac8ce813cab41fa4
Author:     Alexey Dobriyan 
AuthorDate: Wed Dec 6 20:40:39 2006 -0800
Committer:  Linus Torvalds 
CommitDate: Thu Dec 7 08:39:46 2006 -0800

    [PATCH] do_coredump() and not stopping rewrite attacks?
    
    On Sat, Dec 02, 2006 at 11:47:44PM +0300, Alexey Dobriyan wrote:
    > David Binderman compiled 2.6.19 with icc and grepped for "was set but
never
    > used". Many warnings are on
    > 	http://coderock.org/kj/unused-2.6.19-fs
    
    Heh, the very first line:
    fs/exec.c(1465): remark #593: variable "flag" was set but never used
    
    fs/exec.c:
      1477		/*
      1478		 *	We cannot trust fsuid as being the "true" uid of the
      1479		 *	process nor do we know its entire history. We only know it
      1480		 *	was tainted so we dump it as root in mode 2.
      1481		 */
      1482		if (mm->dumpable == 2) {	/* Setuid core dump mode */
      1483			flag = O_EXCL;		/* Stop rewrite attacks */
      1484			current->fsuid = 0;	/* Dump root private */
      1485		}
    
    And then filp_open follows with "flag" totally ignored.
    
    (akpm: this restores the code to Alan's original version.  Andi's
"Support
    piping into commands in /proc/sys/kernel/core_pattern" (cset d025c9db)
broke
    it).
    
    Cc: Alan Cox 
    Cc: 
    Cc: Andi Kleen 
    Signed-off-by: Andrew Morton 
    Signed-off-by: Linus Torvalds 
---
 fs/exec.c |    3 ++-
 1 files changed, 2 insertions(+), 1 deletions(-)

diff --git a/fs/exec.c b/fs/exec.c
index 2092bd2..add0e03 100644
--- a/fs/exec.c
+++ b/fs/exec.c
@@ -1515,7 +1515,8 @@ int do_coredump(long signr, int exit_cod
 		ispipe = 1;
  	} else
  		file = filp_open(corename,
-				 O_CREAT | 2 | O_NOFOLLOW | O_LARGEFILE, 0600);
+				 O_CREAT | 2 | O_NOFOLLOW | O_LARGEFILE | flag,
+				 0600);
 	if (IS_ERR(file))
 		goto fail_unlock;
 	inode = file->f_dentry->d_inode;
 
CD: 3ms