lkml.org 
[lkml]   [2016]   [Oct]   [29]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
From
Date
SubjectRe: [PATCH] coredump: clarify "unsafe core_pattern" warning
On Sat, Oct 29, 2016 at 8:21 AM, Alexey Dobriyan <adobriyan@gmail.com> wrote:
> I was amused to find "unsafe core_pattern" warning having these lines
> in /etc/sysctl.conf:
>
> fs.suid_dumpable=2
> kernel.core_pattern=/core/core-%e-%p-%E
> kernel.core_uses_pid=0
>
> Turns out kernel is formally right. Default core_pattern is just "core",
> which doesn't qualify for secure path while setting suid.dumpable.
>
> Hint admins about solution, clarify sysctl names, delete unnecessary '\'
> characters (string literals are concatenated regardless) and reformat
> for easier grepping.
>
> Signed-off-by: Alexey Dobriyan <adobriyan@gmail.com>

Ah, yes, order of operations mattered. :) I like the rephrasing, thanks!

Acked-by: Kees Cook <keescook@chromium.org>

-Kees

> ---
>
> kernel/sysctl.c | 8 +++++---
> 1 file changed, 5 insertions(+), 3 deletions(-)
>
> commit ba93b14a4f61e4563134abab5d81bb8b53c60df9
> Author: Alexey Dobriyan <adobriyan@gmail.com>
> Date: Sat Oct 29 18:13:57 2016 +0300
>
> kernel.core_dump
>
> --- a/kernel/sysctl.c
> +++ b/kernel/sysctl.c
> @@ -2403,9 +2403,11 @@ static void validate_coredump_safety(void)
> #ifdef CONFIG_COREDUMP
> if (suid_dumpable == SUID_DUMP_ROOT &&
> core_pattern[0] != '/' && core_pattern[0] != '|') {
> - printk(KERN_WARNING "Unsafe core_pattern used with "\
> - "suid_dumpable=2. Pipe handler or fully qualified "\
> - "core dump path required.\n");
> + printk(KERN_WARNING
> +"Unsafe core_pattern used with fs.suid_dumpable=2.\n"
> +"Pipe handler or fully qualified core dump path required.\n"
> +"Set kernel.core_pattern before fs.suid_dumpable.\n"
> + );
> }
> #endif
> }



--
Kees Cook
Nexus Security

\
 
 \ /
  Last update: 2016-10-29 18:01    [W:2.939 / U:0.008 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site