aboutsummaryrefslogtreecommitdiffstats
path: root/fs/exec.c
diff options
context:
space:
mode:
authorAlan Cox <alan@lxorguk.ukuu.org.uk>2007-04-17 01:53:13 -0400
committerLinus Torvalds <torvalds@woody.linux-foundation.org>2007-04-17 19:36:26 -0400
commitc4bbafda70a0fc95c6595bffd6825ef264050d01 (patch)
tree92860180bea4f2e1fd515432bb165c7ae628d2af /fs/exec.c
parentc4b7e8754e3198eb5392568e523da6440143c2cd (diff)
exec.c: fix coredump to pipe problem and obscure "security hole"
The patch checks for "|" in the pattern not the output and doesn't nail a pid on to a piped name (as it is a program name not a file) Also fixes a very very obscure security corner case. If you happen to have decided on a core pattern that starts with the program name then the user can run a program called "|myevilhack" as it stands. I doubt anyone does this. Signed-off-by: Alan Cox <alan@redhat.com> Confirmed-by: Christopher S. Aker <caker@theshore.net> Cc: <stable@kernel.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Diffstat (limited to 'fs/exec.c')
-rw-r--r--fs/exec.c18
1 files changed, 11 insertions, 7 deletions
diff --git a/fs/exec.c b/fs/exec.c
index 7e36c6f6f538..3155e915307a 100644
--- a/fs/exec.c
+++ b/fs/exec.c
@@ -1244,13 +1244,17 @@ EXPORT_SYMBOL(set_binfmt);
1244 * name into corename, which must have space for at least 1244 * name into corename, which must have space for at least
1245 * CORENAME_MAX_SIZE bytes plus one byte for the zero terminator. 1245 * CORENAME_MAX_SIZE bytes plus one byte for the zero terminator.
1246 */ 1246 */
1247static void format_corename(char *corename, const char *pattern, long signr) 1247static int format_corename(char *corename, const char *pattern, long signr)
1248{ 1248{
1249 const char *pat_ptr = pattern; 1249 const char *pat_ptr = pattern;
1250 char *out_ptr = corename; 1250 char *out_ptr = corename;
1251 char *const out_end = corename + CORENAME_MAX_SIZE; 1251 char *const out_end = corename + CORENAME_MAX_SIZE;
1252 int rc; 1252 int rc;
1253 int pid_in_pattern = 0; 1253 int pid_in_pattern = 0;
1254 int ispipe = 0;
1255
1256 if (*pattern == '|')
1257 ispipe = 1;
1254 1258
1255 /* Repeat as long as we have more pattern to process and more output 1259 /* Repeat as long as we have more pattern to process and more output
1256 space */ 1260 space */
@@ -1341,8 +1345,8 @@ static void format_corename(char *corename, const char *pattern, long signr)
1341 * 1345 *
1342 * If core_pattern does not include a %p (as is the default) 1346 * If core_pattern does not include a %p (as is the default)
1343 * and core_uses_pid is set, then .%pid will be appended to 1347 * and core_uses_pid is set, then .%pid will be appended to
1344 * the filename */ 1348 * the filename. Do not do this for piped commands. */
1345 if (!pid_in_pattern 1349 if (!ispipe && !pid_in_pattern
1346 && (core_uses_pid || atomic_read(&current->mm->mm_users) != 1)) { 1350 && (core_uses_pid || atomic_read(&current->mm->mm_users) != 1)) {
1347 rc = snprintf(out_ptr, out_end - out_ptr, 1351 rc = snprintf(out_ptr, out_end - out_ptr,
1348 ".%d", current->tgid); 1352 ".%d", current->tgid);
@@ -1350,8 +1354,9 @@ static void format_corename(char *corename, const char *pattern, long signr)
1350 goto out; 1354 goto out;
1351 out_ptr += rc; 1355 out_ptr += rc;
1352 } 1356 }
1353 out: 1357out:
1354 *out_ptr = 0; 1358 *out_ptr = 0;
1359 return ispipe;
1355} 1360}
1356 1361
1357static void zap_process(struct task_struct *start) 1362static void zap_process(struct task_struct *start)
@@ -1502,16 +1507,15 @@ int do_coredump(long signr, int exit_code, struct pt_regs * regs)
1502 * uses lock_kernel() 1507 * uses lock_kernel()
1503 */ 1508 */
1504 lock_kernel(); 1509 lock_kernel();
1505 format_corename(corename, core_pattern, signr); 1510 ispipe = format_corename(corename, core_pattern, signr);
1506 unlock_kernel(); 1511 unlock_kernel();
1507 if (corename[0] == '|') { 1512 if (ispipe) {
1508 /* SIGPIPE can happen, but it's just never processed */ 1513 /* SIGPIPE can happen, but it's just never processed */
1509 if(call_usermodehelper_pipe(corename+1, NULL, NULL, &file)) { 1514 if(call_usermodehelper_pipe(corename+1, NULL, NULL, &file)) {
1510 printk(KERN_INFO "Core dump to %s pipe failed\n", 1515 printk(KERN_INFO "Core dump to %s pipe failed\n",
1511 corename); 1516 corename);
1512 goto fail_unlock; 1517 goto fail_unlock;
1513 } 1518 }
1514 ispipe = 1;
1515 } else 1519 } else
1516 file = filp_open(corename, 1520 file = filp_open(corename,
1517 O_CREAT | 2 | O_NOFOLLOW | O_LARGEFILE | flag, 1521 O_CREAT | 2 | O_NOFOLLOW | O_LARGEFILE | flag,