The patch titled
do_coredump() and not stopping rewrite attacks?
has been added to the -mm tree. Its filename is
do_coredump-and-not-stopping-rewrite-attacks.patch
See http://www.zip.com.au/~akpm/linux/patches/stuff/added-to-mm.txt to find
out what to do about this
------------------------------------------------------
Subject: do_coredump() and not stopping rewrite attacks?
From: Alexey Dobriyan <adobriyan@xxxxxxxxx>
On Sat, Dec 02, 2006 at 11:47:44PM +0300, Alexey Dobriyan wrote:
> David Binderman compiled 2.6.19 with icc and grepped for "was set but never
> used". Many warnings are on
> http://coderock.org/kj/unused-2.6.19-fs
Heh, the very first line:
fs/exec.c(1465): remark #593: variable "flag" was set but never used
fs/exec.c:
1477 /*
1478 * We cannot trust fsuid as being the "true" uid of the
1479 * process nor do we know its entire history. We only know it
1480 * was tainted so we dump it as root in mode 2.
1481 */
1482 if (mm->dumpable == 2) { /* Setuid core dump mode */
1483 flag = O_EXCL; /* Stop rewrite attacks */
1484 current->fsuid = 0; /* Dump root private */
1485 }
And then filp_open follows with "flag" totally ignored.
(akpm: this restores the code to Alan's original version. Andi's "Support
piping into commands in /proc/sys/kernel/core_pattern" (cset d025c9db) broke
it).
Cc: Alan Cox <alan@xxxxxxxxxxxxxxxxxxx>
Cc: <stable@xxxxxxxxxx>
Cc: Andi Kleen <ak@xxxxxxx>
Signed-off-by: Andrew Morton <akpm@xxxxxxxx>
---
fs/exec.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff -puN fs/exec.c~do_coredump-and-not-stopping-rewrite-attacks fs/exec.c
--- a/fs/exec.c~do_coredump-and-not-stopping-rewrite-attacks
+++ a/fs/exec.c
@@ -1515,7 +1515,8 @@ int do_coredump(long signr, int exit_cod
ispipe = 1;
} else
file = filp_open(corename,
- O_CREAT | 2 | O_NOFOLLOW | O_LARGEFILE, 0600);
+ O_CREAT | 2 | O_NOFOLLOW | O_LARGEFILE | flag,
+ 0600);
if (IS_ERR(file))
goto fail_unlock;
inode = file->f_dentry->d_inode;
_
Patches currently in -mm which might be from adobriyan@xxxxxxxxx are
origin.patch
git-cpufreq.patch
git-gfs2-nmw.patch
git-ieee1394.patch
git-mtd.patch
megaraid-fix-warnings-when-config_proc_fs=n.patch
security-keys-user-kmemdup.patch
paride-rename-pi_register-and-pi_unregister.patch
paride_register-shuffle-return-values.patch
compile-time-check-re-world-writeable-module-params.patch
fs-trivial-vsnprintf-conversion.patch
hpfs-bring-hpfs_error-into-shape.patch
hpfs-fix-printk-format-warnings.patch
drivers-cdrom-trivial-vsnprintf-conversion.patch
do_coredump-and-not-stopping-rewrite-attacks.patch
drivers-isdn-trivial-vsnprintf-conversion.patch
drivers-video-use-kmemdup.patch
-
To unsubscribe from this list: send the line "unsubscribe mm-commits" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
