lkml.org 
[lkml]   [2007]   [Apr]   [26]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    Date
    From
    Subject[patch 18/33] exec.c: fix coredump to pipe problem and obscure "security hole"
    -stable review patch.  If anyone has any objections, please let us know.

    ------------------
    From: Alan Cox <alan@lxorguk.ukuu.org.uk>

    exec.c: fix coredump to pipe problem and obscure "security hole"

    The patch checks for "|" in the pattern not the output and doesn't nail a
    pid on to a piped name (as it is a program name not a file)

    Also fixes a very very obscure security corner case. If you happen to have
    decided on a core pattern that starts with the program name then the user
    can run a program called "|myevilhack" as it stands. I doubt anyone does
    this.

    Signed-off-by: Alan Cox <alan@redhat.com>
    Confirmed-by: Christopher S. Aker <caker@theshore.net>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

    ---
    fs/exec.c | 18 +++++++++++-------
    1 file changed, 11 insertions(+), 7 deletions(-)

    --- a/fs/exec.c
    +++ b/fs/exec.c
    @@ -1246,13 +1246,17 @@ EXPORT_SYMBOL(set_binfmt);
    * name into corename, which must have space for at least
    * CORENAME_MAX_SIZE bytes plus one byte for the zero terminator.
    */
    -static void format_corename(char *corename, const char *pattern, long signr)
    +static int format_corename(char *corename, const char *pattern, long signr)
    {
    const char *pat_ptr = pattern;
    char *out_ptr = corename;
    char *const out_end = corename + CORENAME_MAX_SIZE;
    int rc;
    int pid_in_pattern = 0;
    + int ispipe = 0;
    +
    + if (*pattern == '|')
    + ispipe = 1;

    /* Repeat as long as we have more pattern to process and more output
    space */
    @@ -1343,8 +1347,8 @@ static void format_corename(char *corena
    *
    * If core_pattern does not include a %p (as is the default)
    * and core_uses_pid is set, then .%pid will be appended to
    - * the filename */
    - if (!pid_in_pattern
    + * the filename. Do not do this for piped commands. */
    + if (!ispipe && !pid_in_pattern
    && (core_uses_pid || atomic_read(&current->mm->mm_users) != 1)) {
    rc = snprintf(out_ptr, out_end - out_ptr,
    ".%d", current->tgid);
    @@ -1352,8 +1356,9 @@ static void format_corename(char *corena
    goto out;
    out_ptr += rc;
    }
    - out:
    +out:
    *out_ptr = 0;
    + return ispipe;
    }

    static void zap_process(struct task_struct *start)
    @@ -1504,16 +1509,15 @@ int do_coredump(long signr, int exit_cod
    * uses lock_kernel()
    */
    lock_kernel();
    - format_corename(corename, core_pattern, signr);
    + ispipe = format_corename(corename, core_pattern, signr);
    unlock_kernel();
    - if (corename[0] == '|') {
    + if (ispipe) {
    /* SIGPIPE can happen, but it's just never processed */
    if(call_usermodehelper_pipe(corename+1, NULL, NULL, &file)) {
    printk(KERN_INFO "Core dump to %s pipe failed\n",
    corename);
    goto fail_unlock;
    }
    - ispipe = 1;
    } else
    file = filp_open(corename,
    O_CREAT | 2 | O_NOFOLLOW | O_LARGEFILE | flag,
    --
    -
    To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
    the body of a message to majordomo@vger.kernel.org
    More majordomo info at http://vger.kernel.org/majordomo-info.html
    Please read the FAQ at http://www.tux.org/lkml/

    \
     
     \ /
      Last update: 2007-04-26 19:09    [W:0.024 / U:29.756 seconds]
    ©2003-2016 Jasper Spaans. hosted at Digital OceanAdvertise on this site