fs/coredump: prevent fsuid=0 dumps into user-controlled directories

This commit fixes the following security hole affecting systems where all of the following conditions are fulfilled: - The fs.suid_dumpable sysctl is set to 2. - The kernel.core_pattern sysctl's value starts with "/". (Systems where kernel.core_pattern starts with "|/" are not affected.) - Unprivileged user namespace creation is permitted. (This is true on Linux >=3.8, but some distributions disallow it by default using a distro patch.) Under these conditions, if a program executes under secure exec rules, causing it to run with the SUID_DUMP_ROOT flag, then unshares its user namespace, changes its root directory and crashes, the coredump will be written using fsuid=0 and a path derived from kernel.core_pattern - but this path is interpreted relative to the root directory of the process, allowing the attacker to control where a coredump will be written with root privileges. To fix the security issue, always interpret core_pattern for dumps that are written under SUID_DUMP_ROOT relative to the root directory of init.

Jann Horn committed 10 years ago

Commit 378c6521 parent 1333ab06 files · +32 −12Browse files

Showing the changes to kernel/sysctl_binary.c (1 of 6 files). Show all

Unified · Split

kernel/sysctl_binary.c+1−1

@@ -1321,7 +1321,7 @@ static ssize_t binary_sysctl(const int *name, int nlen, · 1320 unmodified lines
1321	1321	}
1322	1322
1323	1323	mnt = task_active_pid_ns(current)->proc_mnt;
1324		− file = file_open_root(mnt->mnt_root, mnt, pathname, flags);
	1324	+ file = file_open_root(mnt->mnt_root, mnt, pathname, flags, 0);
1325	1325	result = PTR_ERR(file);
1326	1326	if (IS_ERR(file))
1327	1327	goto out_putname;