Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit e579d2c2 authored by Kees Cook's avatar Kees Cook Committed by Linus Torvalds
Browse files

coredump: remove redundant defines for dumpable states 



The existing SUID_DUMP_* defines duplicate the newer SUID_DUMPABLE_*
defines introduced in 54b50199 ("coredump: warn about unsafe
suid_dumpable / core_pattern combo").  Remove the new ones, and use the
prior values instead.

Signed-off-by: default avatarKees Cook <keescook@chromium.org>
Reported-by: default avatarChen Gang <gang.chen@asianux.com>
Cc: Alexander Viro <viro@zeniv.linux.org.uk>
Cc: Alan Cox <alan@linux.intel.com>
Cc: "Eric W. Biederman" <ebiederm@xmission.com>
Cc: Doug Ledford <dledford@redhat.com>
Cc: Serge Hallyn <serge.hallyn@canonical.com>
Cc: James Morris <james.l.morris@oracle.com>
Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
parent 5d1fadc1

fs/coredump.c

+1 −1
Original line number Diff line number Diff line
@@ -501,7 +501,7 @@ void do_coredump(siginfo_t *siginfo) 
	 * so we dump it as root in mode 2, and only into a controlled

	 * environment (pipe handler or fully qualified path).

	 */

	if (__get_dumpable(cprm.mm_flags) == SUID_DUMPABLE_SAFE) {

	if (__get_dumpable(cprm.mm_flags) == SUID_DUMP_ROOT) {

		/* Setuid core dump mode */

		flag = O_EXCL;		/* Stop rewrite attacks */

		cred->fsuid = GLOBAL_ROOT_UID;	/* Dump root private */

fs/exec.c

+5 −5
Original line number Diff line number Diff line
@@ -1111,7 +1111,7 @@ void setup_new_exec(struct linux_binprm * bprm) 
	current->sas_ss_sp = current->sas_ss_size = 0;



	if (uid_eq(current_euid(), current_uid()) && gid_eq(current_egid(), current_gid()))

		set_dumpable(current->mm, SUID_DUMPABLE_ENABLED);

		set_dumpable(current->mm, SUID_DUMP_USER);

	else

		set_dumpable(current->mm, suid_dumpable);
@@ -1639,17 +1639,17 @@ EXPORT_SYMBOL(set_binfmt); 
void set_dumpable(struct mm_struct *mm, int value)

{

	switch (value) {

	case SUID_DUMPABLE_DISABLED:

	case SUID_DUMP_DISABLE:

		clear_bit(MMF_DUMPABLE, &mm->flags);

		smp_wmb();

		clear_bit(MMF_DUMP_SECURELY, &mm->flags);

		break;

	case SUID_DUMPABLE_ENABLED:

	case SUID_DUMP_USER:

		set_bit(MMF_DUMPABLE, &mm->flags);

		smp_wmb();

		clear_bit(MMF_DUMP_SECURELY, &mm->flags);

		break;

	case SUID_DUMPABLE_SAFE:

	case SUID_DUMP_ROOT:

		set_bit(MMF_DUMP_SECURELY, &mm->flags);

		smp_wmb();

		set_bit(MMF_DUMPABLE, &mm->flags);
@@ -1662,7 +1662,7 @@ int __get_dumpable(unsigned long mm_flags) 
	int ret;



	ret = mm_flags & MMF_DUMPABLE_MASK;

	return (ret > SUID_DUMPABLE_ENABLED) ? SUID_DUMPABLE_SAFE : ret;

	return (ret > SUID_DUMP_USER) ? SUID_DUMP_ROOT : ret;

}



int get_dumpable(struct mm_struct *mm)

fs/proc/internal.h

+2 −1
Original line number Diff line number Diff line
@@ -11,6 +11,7 @@ 


#include <linux/sched.h>

#include <linux/proc_fs.h>

#include <linux/binfmts.h>

struct  ctl_table_header;

struct  mempolicy;
@@ -108,7 +109,7 @@ static inline int task_dumpable(struct task_struct *task) 
	if (mm)

		dumpable = get_dumpable(mm);

	task_unlock(task);

	if (dumpable == SUID_DUMPABLE_ENABLED)

	if (dumpable == SUID_DUMP_USER)

		return 1;

	return 0;

}

include/linux/sched.h

+0 −5
Original line number Diff line number Diff line
@@ -346,11 +346,6 @@ static inline void arch_pick_mmap_layout(struct mm_struct *mm) {} 
extern void set_dumpable(struct mm_struct *mm, int value);

extern int get_dumpable(struct mm_struct *mm);



/* get/set_dumpable() values */

#define SUID_DUMPABLE_DISABLED	0

#define SUID_DUMPABLE_ENABLED	1

#define SUID_DUMPABLE_SAFE	2



/* mm flags */

/* dumpable bits */

#define MMF_DUMPABLE      0  /* core dump is permitted */

kernel/sysctl.c

+1 −1
Original line number Diff line number Diff line
@@ -2095,7 +2095,7 @@ int proc_dointvec_minmax(struct ctl_table *table, int write, 
static void validate_coredump_safety(void)

{

#ifdef CONFIG_COREDUMP

	if (suid_dumpable == SUID_DUMPABLE_SAFE &&

	if (suid_dumpable == SUID_DUMP_ROOT &&

	    core_pattern[0] != '/' && core_pattern[0] != '|') {

		printk(KERN_WARNING "Unsafe core_pattern used with "\

			"suid_dumpable=2. Pipe handler or fully qualified "\