Re: [PATCH v4] fs: make dumpable=2 only write to a pipe

[Kees Cook]

On Sat, Jun 23, 2012 at 4:21 PM, Eric W. Biederman
<ebiederm@xxxxxxxxxxxx> wrote:
> Kees Cook <keescook@xxxxxxxxxxxx> writes:
>
>> When the suid_dumpable sysctl is set to "2", and there is no core
>> dump pipe defined in the core_pattern sysctl, a local user can cause
>> core files to be written to root-writable directories, potentially
>> with user-controlled content. This means an admin can unknowningly
>> reintroduce a variation of CVE-2006-2451, allowing local users to gain
>> root privileges.
>
> Is there a security exploit possible if a path is defined in the
> core_pattern?
>
> From the description of the problem so far I don't think there is.
> Requiring a program when a simple path will do seems excessive.

Having a fully qualified path would be sufficient, yes. Looking at how
%e and %E are handled, I'm satisfied (for example, no additional "/"
characters can be injected via argv0). In this case, then, I'll adjust
this to require either a pipe or a fully qualified core_pattern (i.e.
core_pattern must start with "!" or "/" for mode 2). How does that
sound?

-Kees

-- 
Kees Cook
Chrome OS Security
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/