[PATCH RFC v3 72/90] coredump: let no core dump leave a cell

[Josef Bacik]

A core dump that goes to a file is written in the context of the crashing
task, with its credentials. A core dump that goes to a pipe or a socket is
handed to a program of the host. That program runs as root and parses what
was in the memory of the crashed task.

After the previous patch, the helper at the end of a pipe is no longer run
for a task of a cell. But that is treated as a failure and logged every
time. A socket is still connected to, and the task then waits for the
other end. If the listener does not answer, a cell whose init has crashed
never dies.

Skip both kinds of core dump silently for a task of a cell. Whoever set
core_pattern may not have had cells in mind, and what a cell hands to the
host is for its builder to decide.

Signed-off-by: Josef Bacik <josef@xxxxxxxxxxxxxx>
---
 fs/coredump.c | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/fs/coredump.c b/fs/coredump.c
index 82ef9d115999..6b091807aef1 100644
--- a/fs/coredump.c
+++ b/fs/coredump.c
@@ -17,6 +17,7 @@
 #include <linux/key.h>
 #include <linux/personality.h>
 #include <linux/binfmts.h>
+#include <linux/cell_ids.h>
 #include <linux/coredump.h>
 #include <linux/sort.h>
 #include <linux/sched/coredump.h>
@@ -1210,6 +1211,13 @@ static noinline_for_stack void do_coredump(struct core_name *cn,
 		return;
 	}
 
+	/*
+	 * A file is written where the task is, as the task. Anything else hands what
+	 * was in its memory to a program of the host, which is root there.
+	 */
+	if (cn->core_type != COREDUMP_FILE && userns_is_cell(current_user_ns()))
+		return;
+
 	switch (cn->core_type) {
 	case COREDUMP_FILE:
 		if (!coredump_file(cn, cprm, binfmt))

-- 
2.55.0