Commit a9289728 authored by Eric W. Biederman's avatar Eric W. Biederman Committed by Linus Torvalds

[PATCH] Don't uselessly export task_struct to userspace in core dumps

task_struct is an internal structure to the kernel with a lot of good
information, that is probably interesting in core dumps.  However there is
no way for user space to know what format that information is in making it
useless.

I grepped the GDB 6.3 source code and NT_TASKSTRUCT while defined is not
used anywhere else.  So I would be surprised if anyone notices it is
missing.

In addition exporting kernel pointers to all the interesting kernel data
structures sounds like the very definition of an information leak.  I
haven't a clue what someone with evil intentions could do with that
information, but in any attack against the kernel it looks like this is the
perfect tool for aiming that attack.

So since NT_TASKSTRUCT is useless as currently defined and is potentially
dangerous, let's just not export it.

(akpm: Daniel Jacobowitz <dan@debian.org> "would be amazed" if anything was
using NT_TASKSTRUCT).
Signed-off-by: default avatarEric W. Biederman <ebiederm@xmission.com>
Signed-off-by: default avatarAndrew Morton <akpm@osdl.org>
Signed-off-by: default avatarLinus Torvalds <torvalds@osdl.org>
parent dfc4f94d
...@@ -1077,8 +1077,8 @@ static int irix_core_dump(long signr, struct pt_regs * regs, struct file *file) ...@@ -1077,8 +1077,8 @@ static int irix_core_dump(long signr, struct pt_regs * regs, struct file *file)
struct elfhdr elf; struct elfhdr elf;
off_t offset = 0, dataoff; off_t offset = 0, dataoff;
int limit = current->signal->rlim[RLIMIT_CORE].rlim_cur; int limit = current->signal->rlim[RLIMIT_CORE].rlim_cur;
int numnote = 4; int numnote = 3;
struct memelfnote notes[4]; struct memelfnote notes[3];
struct elf_prstatus prstatus; /* NT_PRSTATUS */ struct elf_prstatus prstatus; /* NT_PRSTATUS */
elf_fpregset_t fpu; /* NT_PRFPREG */ elf_fpregset_t fpu; /* NT_PRFPREG */
struct elf_prpsinfo psinfo; /* NT_PRPSINFO */ struct elf_prpsinfo psinfo; /* NT_PRPSINFO */
...@@ -1211,20 +1211,15 @@ static int irix_core_dump(long signr, struct pt_regs * regs, struct file *file) ...@@ -1211,20 +1211,15 @@ static int irix_core_dump(long signr, struct pt_regs * regs, struct file *file)
} }
strlcpy(psinfo.pr_fname, current->comm, sizeof(psinfo.pr_fname)); strlcpy(psinfo.pr_fname, current->comm, sizeof(psinfo.pr_fname));
notes[2].name = "CORE";
notes[2].type = NT_TASKSTRUCT;
notes[2].datasz = sizeof(*current);
notes[2].data = current;
/* Try to dump the FPU. */ /* Try to dump the FPU. */
prstatus.pr_fpvalid = dump_fpu (regs, &fpu); prstatus.pr_fpvalid = dump_fpu (regs, &fpu);
if (!prstatus.pr_fpvalid) { if (!prstatus.pr_fpvalid) {
numnote--; numnote--;
} else { } else {
notes[3].name = "CORE"; notes[2].name = "CORE";
notes[3].type = NT_PRFPREG; notes[2].type = NT_PRFPREG;
notes[3].datasz = sizeof(fpu); notes[2].datasz = sizeof(fpu);
notes[3].data = &fpu; notes[2].data = &fpu;
} }
/* Write notes phdr entry. */ /* Write notes phdr entry. */
......
...@@ -1502,9 +1502,7 @@ static int elf_core_dump(long signr, struct pt_regs * regs, struct file * file) ...@@ -1502,9 +1502,7 @@ static int elf_core_dump(long signr, struct pt_regs * regs, struct file * file)
fill_psinfo(psinfo, current->group_leader, current->mm); fill_psinfo(psinfo, current->group_leader, current->mm);
fill_note(notes +1, "CORE", NT_PRPSINFO, sizeof(*psinfo), psinfo); fill_note(notes +1, "CORE", NT_PRPSINFO, sizeof(*psinfo), psinfo);
fill_note(notes +2, "CORE", NT_TASKSTRUCT, sizeof(*current), current); numnote = 2;
numnote = 3;
auxv = (elf_addr_t *) current->mm->saved_auxv; auxv = (elf_addr_t *) current->mm->saved_auxv;
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment