Commit c4bbafda authored by Alan Cox's avatar Alan Cox Committed by Linus Torvalds

exec.c: fix coredump to pipe problem and obscure "security hole"

The patch checks for "|" in the pattern not the output and doesn't nail a
pid on to a piped name (as it is a program name not a file)

Also fixes a very very obscure security corner case.  If you happen to have
decided on a core pattern that starts with the program name then the user
can run a program called "|myevilhack" as it stands.  I doubt anyone does
this.
Signed-off-by: default avatarAlan Cox <alan@redhat.com>
Confirmed-by: default avatarChristopher S. Aker <caker@theshore.net>
Cc: <stable@kernel.org>
Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
parent c4b7e875
...@@ -1244,13 +1244,17 @@ EXPORT_SYMBOL(set_binfmt); ...@@ -1244,13 +1244,17 @@ EXPORT_SYMBOL(set_binfmt);
* name into corename, which must have space for at least * name into corename, which must have space for at least
* CORENAME_MAX_SIZE bytes plus one byte for the zero terminator. * CORENAME_MAX_SIZE bytes plus one byte for the zero terminator.
*/ */
static void format_corename(char *corename, const char *pattern, long signr) static int format_corename(char *corename, const char *pattern, long signr)
{ {
const char *pat_ptr = pattern; const char *pat_ptr = pattern;
char *out_ptr = corename; char *out_ptr = corename;
char *const out_end = corename + CORENAME_MAX_SIZE; char *const out_end = corename + CORENAME_MAX_SIZE;
int rc; int rc;
int pid_in_pattern = 0; int pid_in_pattern = 0;
int ispipe = 0;
if (*pattern == '|')
ispipe = 1;
/* Repeat as long as we have more pattern to process and more output /* Repeat as long as we have more pattern to process and more output
space */ space */
...@@ -1341,8 +1345,8 @@ static void format_corename(char *corename, const char *pattern, long signr) ...@@ -1341,8 +1345,8 @@ static void format_corename(char *corename, const char *pattern, long signr)
* *
* If core_pattern does not include a %p (as is the default) * If core_pattern does not include a %p (as is the default)
* and core_uses_pid is set, then .%pid will be appended to * and core_uses_pid is set, then .%pid will be appended to
* the filename */ * the filename. Do not do this for piped commands. */
if (!pid_in_pattern if (!ispipe && !pid_in_pattern
&& (core_uses_pid || atomic_read(&current->mm->mm_users) != 1)) { && (core_uses_pid || atomic_read(&current->mm->mm_users) != 1)) {
rc = snprintf(out_ptr, out_end - out_ptr, rc = snprintf(out_ptr, out_end - out_ptr,
".%d", current->tgid); ".%d", current->tgid);
...@@ -1350,8 +1354,9 @@ static void format_corename(char *corename, const char *pattern, long signr) ...@@ -1350,8 +1354,9 @@ static void format_corename(char *corename, const char *pattern, long signr)
goto out; goto out;
out_ptr += rc; out_ptr += rc;
} }
out: out:
*out_ptr = 0; *out_ptr = 0;
return ispipe;
} }
static void zap_process(struct task_struct *start) static void zap_process(struct task_struct *start)
...@@ -1502,16 +1507,15 @@ int do_coredump(long signr, int exit_code, struct pt_regs * regs) ...@@ -1502,16 +1507,15 @@ int do_coredump(long signr, int exit_code, struct pt_regs * regs)
* uses lock_kernel() * uses lock_kernel()
*/ */
lock_kernel(); lock_kernel();
format_corename(corename, core_pattern, signr); ispipe = format_corename(corename, core_pattern, signr);
unlock_kernel(); unlock_kernel();
if (corename[0] == '|') { if (ispipe) {
/* SIGPIPE can happen, but it's just never processed */ /* SIGPIPE can happen, but it's just never processed */
if(call_usermodehelper_pipe(corename+1, NULL, NULL, &file)) { if(call_usermodehelper_pipe(corename+1, NULL, NULL, &file)) {
printk(KERN_INFO "Core dump to %s pipe failed\n", printk(KERN_INFO "Core dump to %s pipe failed\n",
corename); corename);
goto fail_unlock; goto fail_unlock;
} }
ispipe = 1;
} else } else
file = filp_open(corename, file = filp_open(corename,
O_CREAT | 2 | O_NOFOLLOW | O_LARGEFILE | flag, O_CREAT | 2 | O_NOFOLLOW | O_LARGEFILE | flag,
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment