[PATCH] setuid core dump

Add a new `suid_dumpable' sysctl:

This value can be used to query and set the core dump mode for setuid
or otherwise protected/tainted binaries. The modes are

0 - (default) - traditional behaviour.  Any process which has changed
    privilege levels or is execute only will not be dumped

1 - (debug) - all processes dump core when possible.  The core dump is
    owned by the current user and no security is applied.  This is intended
    for system debugging situations only.  Ptrace is unchecked.

2 - (suidsafe) - any binary which normally would not be dumped is dumped
    readable by root only.  This allows the end user to remove such a dump but
    not access it directly.  For security reasons core dumps in this mode will
    not overwrite one another or other files.  This mode is appropriate when
    adminstrators are attempting to debug problems in a normal environment.

(akpm:

> > +EXPORT_SYMBOL(suid_dumpable);
>
> EXPORT_SYMBOL_GPL?

No problem to me.

> >  	if (current->euid == current->uid && current->egid == current->gid)
> >  		current->mm->dumpable = 1;
>
> Should this be SUID_DUMP_USER?

Actually the feedback I had from last time was that the SUID_ defines
should go because its clearer to follow the numbers. They can go
everywhere (and there are lots of places where dumpable is tested/used
as a bool in untouched code)

> Maybe this should be renamed to `dump_policy' or something.  Doing that
> would help us catch any code which isn't using the #defines, too.

Fair comment. The patch was designed to be easy to maintain for Red Hat
rather than for merging. Changing that field would create a gigantic
diff because it is used all over the place.

)

Signed-off-by: Alan Cox <alan@redhat.com>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

diff --git a/Documentation/sysctl/kernel.txt b/Documentation/sysctl/kernel.txt
index 35159176997b636d561c441fb974fe241a1c8bc6..9f11d36a8c109a82e928ace49c4394e19ca2d8e2 100644 (file)
--- a/Documentation/sysctl/kernel.txt
+++ b/Documentation/sysctl/kernel.txt
@@ -49,6 +49,7 @@ show up in /proc/sys/kernel:
 - shmmax                      [ sysv ipc ]
 - shmmni
 - stop-a                      [ SPARC only ]
+- suid_dumpable
 - sysrq                       ==> Documentation/sysrq.txt
 - tainted
 - threads-max
@@ -300,6 +301,25 @@ kernel.  This value defaults to SHMMAX.
 
 ==============================================================
 
+suid_dumpable:
+
+This value can be used to query and set the core dump mode for setuid
+or otherwise protected/tainted binaries. The modes are
+
+0 - (default) - traditional behaviour. Any process which has changed
+       privilege levels or is execute only will not be dumped
+1 - (debug) - all processes dump core when possible. The core dump is
+       owned by the current user and no security is applied. This is
+       intended for system debugging situations only. Ptrace is unchecked.
+2 - (suidsafe) - any binary which normally would not be dumped is dumped
+       readable by root only. This allows the end user to remove
+       such a dump but not access it directly. For security reasons
+       core dumps in this mode will not overwrite one another or
+       other files. This mode is appropriate when adminstrators are
+       attempting to debug problems in a normal environment.
+
+==============================================================
+
 tainted: 
 
 Non-zero if the kernel has been tainted.  Numeric values, which

diff --git a/fs/exec.c b/fs/exec.c
index 3a4b35a14c0d4504b0b3b8598c9ffa0d50ad6b40..48871917d3639c2b4d679ddd47d0db10651dc88c 100644 (file)
--- a/fs/exec.c
+++ b/fs/exec.c
@@ -58,6 +58,9 @@
 
 int core_uses_pid;
 char core_pattern[65] = "core";
+int suid_dumpable = 0;
+
+EXPORT_SYMBOL(suid_dumpable);
 /* The maximal length of core_pattern is also specified in sysctl.c */
 
 static struct linux_binfmt *formats;
@@ -864,6 +867,9 @@ int flush_old_exec(struct linux_binprm * bprm)
 
        if (current->euid == current->uid && current->egid == current->gid)
                current->mm->dumpable = 1;
+       else
+               current->mm->dumpable = suid_dumpable;
+
        name = bprm->filename;
 
        /* Copies the binary name from after last slash */
@@ -884,7 +890,7 @@ int flush_old_exec(struct linux_binprm * bprm)
            permission(bprm->file->f_dentry->d_inode,MAY_READ, NULL) ||
            (bprm->interp_flags & BINPRM_FLAGS_ENFORCE_NONDUMP)) {
                suid_keys(current);
-               current->mm->dumpable = 0;
+               current->mm->dumpable = suid_dumpable;
        }
 
        /* An exec changes our domain. We are no longer part of the thread
@@ -1432,6 +1438,8 @@ int do_coredump(long signr, int exit_code, struct pt_regs * regs)
        struct inode * inode;
        struct file * file;
        int retval = 0;
+       int fsuid = current->fsuid;
+       int flag = 0;
 
        binfmt = current->binfmt;
        if (!binfmt || !binfmt->core_dump)
@@ -1441,6 +1449,16 @@ int do_coredump(long signr, int exit_code, struct pt_regs * regs)
                up_write(&mm->mmap_sem);
                goto fail;
        }
+
+       /*
+        *      We cannot trust fsuid as being the "true" uid of the
+        *      process nor do we know its entire history. We only know it
+        *      was tainted so we dump it as root in mode 2.
+        */
+       if (mm->dumpable == 2) {        /* Setuid core dump mode */
+               flag = O_EXCL;          /* Stop rewrite attacks */
+               current->fsuid = 0;     /* Dump root private */
+       }
        mm->dumpable = 0;
        init_completion(&mm->core_done);
        spin_lock_irq(&current->sighand->siglock);
@@ -1466,7 +1484,7 @@ int do_coredump(long signr, int exit_code, struct pt_regs * regs)
        lock_kernel();
        format_corename(corename, core_pattern, signr);
        unlock_kernel();
-       file = filp_open(corename, O_CREAT | 2 | O_NOFOLLOW | O_LARGEFILE, 0600);
+       file = filp_open(corename, O_CREAT | 2 | O_NOFOLLOW | O_LARGEFILE | flag, 0600);
        if (IS_ERR(file))
                goto fail_unlock;
        inode = file->f_dentry->d_inode;
@@ -1491,6 +1509,7 @@ int do_coredump(long signr, int exit_code, struct pt_regs * regs)
 close_fail:
        filp_close(file, NULL);
 fail_unlock:
+       current->fsuid = fsuid;
        complete_all(&mm->core_done);
 fail:
        return retval;

diff --git a/fs/proc/base.c b/fs/proc/base.c
index e31903aadd96f6f3a4cc327c67f9163352da262f..ace151fa487865fd160546d27c07e31384fa17c9 100644 (file)
--- a/fs/proc/base.c
+++ b/fs/proc/base.c
@@ -314,7 +314,7 @@ static int may_ptrace_attach(struct task_struct *task)
             (current->gid != task->gid)) && !capable(CAP_SYS_PTRACE))
                goto out;
        rmb();
-       if (!task->mm->dumpable && !capable(CAP_SYS_PTRACE))
+       if (task->mm->dumpable != 1 && !capable(CAP_SYS_PTRACE))
                goto out;
        if (security_ptrace(current, task))
                goto out;
@@ -1113,7 +1113,9 @@ static int task_dumpable(struct task_struct *task)
        if (mm)
                dumpable = mm->dumpable;
        task_unlock(task);
-       return dumpable;
+       if(dumpable == 1)
+               return 1;
+       return 0;
 }
 
 

diff --git a/include/linux/binfmts.h b/include/linux/binfmts.h
index 7e736e201c46c125eb11a1722f5a5e31fabcd4df..c1e82c51444320f0970162fa76b2065ab3727bf7 100644 (file)
--- a/include/linux/binfmts.h
+++ b/include/linux/binfmts.h
@@ -69,6 +69,11 @@ extern void remove_arg_zero(struct linux_binprm *);
 extern int search_binary_handler(struct linux_binprm *,struct pt_regs *);
 extern int flush_old_exec(struct linux_binprm * bprm);
 
+extern int suid_dumpable;
+#define SUID_DUMP_DISABLE      0       /* No setuid dumping */
+#define SUID_DUMP_USER         1       /* Dump as user of process */
+#define SUID_DUMP_ROOT         2       /* Dump as root */
+
 /* Stack area protections */
 #define EXSTACK_DEFAULT   0    /* Whatever the arch defaults to */
 #define EXSTACK_DISABLE_X 1    /* Disable executable stacks */

diff --git a/include/linux/sched.h b/include/linux/sched.h
index b58afd97a180274bad8b8904b018aac1c08621ef..901742f92389f273723ecad9767768bdd3fff293 100644 (file)
--- a/include/linux/sched.h
+++ b/include/linux/sched.h
@@ -246,7 +246,7 @@ struct mm_struct {
 
        unsigned long saved_auxv[42]; /* for /proc/PID/auxv */
 
-       unsigned dumpable:1;
+       unsigned dumpable:2;
        cpumask_t cpu_vm_mask;
 
        /* Architecture-specific MM context */

diff --git a/include/linux/sysctl.h b/include/linux/sysctl.h
index a17745c80a91a6ce19fdeeb007aa1f529ce440df..614e939c78a4f915d7d58d7789a09f20c156bd58 100644 (file)
--- a/include/linux/sysctl.h
+++ b/include/linux/sysctl.h
@@ -136,6 +136,7 @@ enum
        KERN_UNKNOWN_NMI_PANIC=66, /* int: unknown nmi panic flag */
        KERN_BOOTLOADER_TYPE=67, /* int: boot loader type */
        KERN_RANDOMIZE=68, /* int: randomize virtual address space */
+       KERN_SETUID_DUMPABLE=69, /* int: behaviour of dumps for setuid core */
 };
 
 

diff --git a/kernel/sys.c b/kernel/sys.c
index f006632c2ba70c4493e1340db7c99bcad7ff38c0..0a2c8cda9638f3273a11702c1f0721be0662e4aa 100644 (file)
--- a/kernel/sys.c
+++ b/kernel/sys.c
@@ -525,7 +525,7 @@ asmlinkage long sys_setregid(gid_t rgid, gid_t egid)
        }
        if (new_egid != old_egid)
        {
-               current->mm->dumpable = 0;
+               current->mm->dumpable = suid_dumpable;
                smp_wmb();
        }
        if (rgid != (gid_t) -1 ||
@@ -556,7 +556,7 @@ asmlinkage long sys_setgid(gid_t gid)
        {
                if(old_egid != gid)
                {
-                       current->mm->dumpable=0;
+                       current->mm->dumpable = suid_dumpable;
                        smp_wmb();
                }
                current->gid = current->egid = current->sgid = current->fsgid = gid;
@@ -565,7 +565,7 @@ asmlinkage long sys_setgid(gid_t gid)
        {
                if(old_egid != gid)
                {
-                       current->mm->dumpable=0;
+                       current->mm->dumpable = suid_dumpable;
                        smp_wmb();
                }
                current->egid = current->fsgid = gid;
@@ -596,7 +596,7 @@ static int set_user(uid_t new_ruid, int dumpclear)
 
        if(dumpclear)
        {
-               current->mm->dumpable = 0;
+               current->mm->dumpable = suid_dumpable;
                smp_wmb();
        }
        current->uid = new_ruid;
@@ -653,7 +653,7 @@ asmlinkage long sys_setreuid(uid_t ruid, uid_t euid)
 
        if (new_euid != old_euid)
        {
-               current->mm->dumpable=0;
+               current->mm->dumpable = suid_dumpable;
                smp_wmb();
        }
        current->fsuid = current->euid = new_euid;
@@ -703,7 +703,7 @@ asmlinkage long sys_setuid(uid_t uid)
 
        if (old_euid != uid)
        {
-               current->mm->dumpable = 0;
+               current->mm->dumpable = suid_dumpable;
                smp_wmb();
        }
        current->fsuid = current->euid = uid;
@@ -748,7 +748,7 @@ asmlinkage long sys_setresuid(uid_t ruid, uid_t euid, uid_t suid)
        if (euid != (uid_t) -1) {
                if (euid != current->euid)
                {
-                       current->mm->dumpable = 0;
+                       current->mm->dumpable = suid_dumpable;
                        smp_wmb();
                }
                current->euid = euid;
@@ -798,7 +798,7 @@ asmlinkage long sys_setresgid(gid_t rgid, gid_t egid, gid_t sgid)
        if (egid != (gid_t) -1) {
                if (egid != current->egid)
                {
-                       current->mm->dumpable = 0;
+                       current->mm->dumpable = suid_dumpable;
                        smp_wmb();
                }
                current->egid = egid;
@@ -845,7 +845,7 @@ asmlinkage long sys_setfsuid(uid_t uid)
        {
                if (uid != old_fsuid)
                {
-                       current->mm->dumpable = 0;
+                       current->mm->dumpable = suid_dumpable;
                        smp_wmb();
                }
                current->fsuid = uid;
@@ -875,7 +875,7 @@ asmlinkage long sys_setfsgid(gid_t gid)
        {
                if (gid != old_fsgid)
                {
-                       current->mm->dumpable = 0;
+                       current->mm->dumpable = suid_dumpable;
                        smp_wmb();
                }
                current->fsgid = gid;
@@ -1652,7 +1652,7 @@ asmlinkage long sys_prctl(int option, unsigned long arg2, unsigned long arg3,
                                error = 1;
                        break;
                case PR_SET_DUMPABLE:
-                       if (arg2 != 0 && arg2 != 1) {
+                       if (arg2 < 0 || arg2 > 2) {
                                error = -EINVAL;
                                break;
                        }

diff --git a/kernel/sysctl.c b/kernel/sysctl.c
index 701d12c6306844136a8e525902d06082733127fb..24a4d12d5aa9b40bc8e2ea57dde06f1075e70135 100644 (file)
--- a/kernel/sysctl.c
+++ b/kernel/sysctl.c
@@ -58,6 +58,7 @@ extern int sysctl_overcommit_ratio;
 extern int max_threads;
 extern int sysrq_enabled;
 extern int core_uses_pid;
+extern int suid_dumpable;
 extern char core_pattern[];
 extern int cad_pid;
 extern int pid_max;
@@ -950,6 +951,14 @@ static ctl_table fs_table[] = {
                .proc_handler   = &proc_dointvec,
        },
 #endif
+       {
+               .ctl_name       = KERN_SETUID_DUMPABLE,
+               .procname       = "suid_dumpable",
+               .data           = &suid_dumpable,
+               .maxlen         = sizeof(int),
+               .mode           = 0644,
+               .proc_handler   = &proc_dointvec,
+       },
        { .ctl_name = 0 }
 };
 

diff --git a/security/commoncap.c b/security/commoncap.c
index 849b8c338ee8fd99185188b383b137cad76406f5..04c12f58d656200b29c1e0c60c31e7ac62349741 100644 (file)
--- a/security/commoncap.c
+++ b/security/commoncap.c
@@ -149,7 +149,7 @@ void cap_bprm_apply_creds (struct linux_binprm *bprm, int unsafe)
 
        if (bprm->e_uid != current->uid || bprm->e_gid != current->gid ||
            !cap_issubset (new_permitted, current->cap_permitted)) {
-               current->mm->dumpable = 0;
+               current->mm->dumpable = suid_dumpable;
 
                if (unsafe & ~LSM_UNSAFE_PTRACE_CAP) {
                        if (!capable(CAP_SETUID)) {

diff --git a/security/dummy.c b/security/dummy.c
index b32eff146547112d1b47ed910b0b004d42e97961..6ff887586479546054956d17a2a5e5faba3dce85 100644 (file)
--- a/security/dummy.c
+++ b/security/dummy.c
@@ -130,7 +130,7 @@ static void dummy_bprm_free_security (struct linux_binprm *bprm)
 static void dummy_bprm_apply_creds (struct linux_binprm *bprm, int unsafe)
 {
        if (bprm->e_uid != current->uid || bprm->e_gid != current->gid) {
-               current->mm->dumpable = 0;
+               current->mm->dumpable = suid_dumpable;
 
                if ((unsafe & ~LSM_UNSAFE_PTRACE_CAP) && !capable(CAP_SETUID)) {
                        bprm->e_uid = current->uid;