10 files changed, 74 insertions, 18 deletions

diff --git a/Documentation/sysctl/kernel.txt b/Documentation/sysctl/kernel.txt
index 35159176997b..9f11d36a8c10 100644
--- a/Documentation/sysctl/kernel.txt
+++ b/Documentation/sysctl/kernel.txt
@@ -49,6 +49,7 @@ show up in /proc/sys/kernel:
 - shmmax                      [ sysv ipc ]
 - shmmni
 - stop-a                      [ SPARC only ]
+- suid_dumpable
 - sysrq                       ==> Documentation/sysrq.txt
 - tainted
 - threads-max
@@ -300,6 +301,25 @@ kernel.  This value defaults to SHMMAX.
 
 ==============================================================
 
+suid_dumpable:
+
+This value can be used to query and set the core dump mode for setuid
+or otherwise protected/tainted binaries. The modes are
+
+0 - (default) - traditional behaviour. Any process which has changed
+        privilege levels or is execute only will not be dumped
+1 - (debug) - all processes dump core when possible. The core dump is
+        owned by the current user and no security is applied. This is
+        intended for system debugging situations only. Ptrace is unchecked.
+2 - (suidsafe) - any binary which normally would not be dumped is dumped
+        readable by root only. This allows the end user to remove
+        such a dump but not access it directly. For security reasons
+        core dumps in this mode will not overwrite one another or
+        other files. This mode is appropriate when adminstrators are
+        attempting to debug problems in a normal environment.
+
+==============================================================
+
 tainted: 
 
 Non-zero if the kernel has been tainted.  Numeric values, which
diff --git a/fs/exec.c b/fs/exec.c
index 3a4b35a14c0d..48871917d363 100644
--- a/fs/exec.c
+++ b/fs/exec.c
@@ -58,6 +58,9 @@
 
 int core_uses_pid;
 char core_pattern[65] = "core";
+int suid_dumpable = 0;
+
+EXPORT_SYMBOL(suid_dumpable);
 /* The maximal length of core_pattern is also specified in sysctl.c */
 
 static struct linux_binfmt *formats;
@@ -864,6 +867,9 @@ int flush_old_exec(struct linux_binprm * bprm)
 
         if (current->euid == current->uid && current->egid == current->gid)
                 current->mm->dumpable = 1;
+        else
+                current->mm->dumpable = suid_dumpable;
+
         name = bprm->filename;
 
         /* Copies the binary name from after last slash */
@@ -884,7 +890,7 @@ int flush_old_exec(struct linux_binprm * bprm)
             permission(bprm->file->f_dentry->d_inode,MAY_READ, NULL) ||
             (bprm->interp_flags & BINPRM_FLAGS_ENFORCE_NONDUMP)) {
                 suid_keys(current);
-                current->mm->dumpable = 0;
+                current->mm->dumpable = suid_dumpable;
         }
 
         /* An exec changes our domain. We are no longer part of the thread
@@ -1432,6 +1438,8 @@ int do_coredump(long signr, int exit_code, struct pt_regs * regs)
         struct inode * inode;
         struct file * file;
         int retval = 0;
+        int fsuid = current->fsuid;
+        int flag = 0;
 
         binfmt = current->binfmt;
         if (!binfmt || !binfmt->core_dump)
@@ -1441,6 +1449,16 @@ int do_coredump(long signr, int exit_code, struct pt_regs * regs)
                 up_write(&mm->mmap_sem);
                 goto fail;
         }
+
+        /*
+         *      We cannot trust fsuid as being the "true" uid of the
+         *      process nor do we know its entire history. We only know it
+         *      was tainted so we dump it as root in mode 2.
+         */
+        if (mm->dumpable == 2) {        /* Setuid core dump mode */
+                flag = O_EXCL;          /* Stop rewrite attacks */
+                current->fsuid = 0;     /* Dump root private */
+        }
         mm->dumpable = 0;
         init_completion(&mm->core_done);
         spin_lock_irq(&current->sighand->siglock);
@@ -1466,7 +1484,7 @@ int do_coredump(long signr, int exit_code, struct pt_regs * regs)
         lock_kernel();
         format_corename(corename, core_pattern, signr);
         unlock_kernel();
-        file = filp_open(corename, O_CREAT | 2 | O_NOFOLLOW | O_LARGEFILE, 0600);
+        file = filp_open(corename, O_CREAT | 2 | O_NOFOLLOW | O_LARGEFILE | flag, 0600);
         if (IS_ERR(file))
                 goto fail_unlock;
         inode = file->f_dentry->d_inode;
@@ -1491,6 +1509,7 @@ int do_coredump(long signr, int exit_code, struct pt_regs * regs)
 close_fail:
         filp_close(file, NULL);
 fail_unlock:
+        current->fsuid = fsuid;
         complete_all(&mm->core_done);
 fail:
         return retval;
diff --git a/fs/proc/base.c b/fs/proc/base.c
index e31903aadd96..ace151fa4878 100644
--- a/fs/proc/base.c
+++ b/fs/proc/base.c
@@ -314,7 +314,7 @@ static int may_ptrace_attach(struct task_struct *task)
              (current->gid != task->gid)) && !capable(CAP_SYS_PTRACE))
                 goto out;
         rmb();
-        if (!task->mm->dumpable && !capable(CAP_SYS_PTRACE))
+        if (task->mm->dumpable != 1 && !capable(CAP_SYS_PTRACE))
                 goto out;
         if (security_ptrace(current, task))
                 goto out;
@@ -1113,7 +1113,9 @@ static int task_dumpable(struct task_struct *task)
         if (mm)
                 dumpable = mm->dumpable;
         task_unlock(task);
-        return dumpable;
+        if(dumpable == 1)
+                return 1;
+        return 0;
 }
 
 
diff --git a/include/linux/binfmts.h b/include/linux/binfmts.h
index 7e736e201c46..c1e82c514443 100644
--- a/include/linux/binfmts.h
+++ b/include/linux/binfmts.h
@@ -69,6 +69,11 @@ extern void remove_arg_zero(struct linux_binprm *);
 extern int search_binary_handler(struct linux_binprm *,struct pt_regs *);
 extern int flush_old_exec(struct linux_binprm * bprm);
 
+extern int suid_dumpable;
+#define SUID_DUMP_DISABLE       0       /* No setuid dumping */
+#define SUID_DUMP_USER          1       /* Dump as user of process */
+#define SUID_DUMP_ROOT          2       /* Dump as root */
+
 /* Stack area protections */
 #define EXSTACK_DEFAULT   0     /* Whatever the arch defaults to */
 #define EXSTACK_DISABLE_X 1     /* Disable executable stacks */
diff --git a/include/linux/sched.h b/include/linux/sched.h
index b58afd97a180..901742f92389 100644
--- a/include/linux/sched.h
+++ b/include/linux/sched.h
@@ -246,7 +246,7 @@ struct mm_struct {
 
         unsigned long saved_auxv[42]; /* for /proc/PID/auxv */
 
-        unsigned dumpable:1;
+        unsigned dumpable:2;
         cpumask_t cpu_vm_mask;
 
         /* Architecture-specific MM context */
diff --git a/include/linux/sysctl.h b/include/linux/sysctl.h
index a17745c80a91..614e939c78a4 100644
--- a/include/linux/sysctl.h
+++ b/include/linux/sysctl.h
@@ -136,6 +136,7 @@ enum
         KERN_UNKNOWN_NMI_PANIC=66, /* int: unknown nmi panic flag */
         KERN_BOOTLOADER_TYPE=67, /* int: boot loader type */
         KERN_RANDOMIZE=68, /* int: randomize virtual address space */
+        KERN_SETUID_DUMPABLE=69, /* int: behaviour of dumps for setuid core */
 };
 
 
diff --git a/kernel/sys.c b/kernel/sys.c
index f006632c2ba7..0a2c8cda9638 100644
--- a/kernel/sys.c
+++ b/kernel/sys.c
@@ -525,7 +525,7 @@ asmlinkage long sys_setregid(gid_t rgid, gid_t egid)
         }
         if (new_egid != old_egid)
         {
-                current->mm->dumpable = 0;
+                current->mm->dumpable = suid_dumpable;
                 smp_wmb();
         }
         if (rgid != (gid_t) -1 ||
@@ -556,7 +556,7 @@ asmlinkage long sys_setgid(gid_t gid)
         {
                 if(old_egid != gid)
                 {
-                        current->mm->dumpable=0;
+                        current->mm->dumpable = suid_dumpable;
                         smp_wmb();
                 }
                 current->gid = current->egid = current->sgid = current->fsgid = gid;
@@ -565,7 +565,7 @@ asmlinkage long sys_setgid(gid_t gid)
         {
                 if(old_egid != gid)
                 {
-                        current->mm->dumpable=0;
+                        current->mm->dumpable = suid_dumpable;
                         smp_wmb();
                 }
                 current->egid = current->fsgid = gid;
@@ -596,7 +596,7 @@ static int set_user(uid_t new_ruid, int dumpclear)
 
         if(dumpclear)
         {
-                current->mm->dumpable = 0;
+                current->mm->dumpable = suid_dumpable;
                 smp_wmb();
         }
         current->uid = new_ruid;
@@ -653,7 +653,7 @@ asmlinkage long sys_setreuid(uid_t ruid, uid_t euid)
 
         if (new_euid != old_euid)
         {
-                current->mm->dumpable=0;
+                current->mm->dumpable = suid_dumpable;
                 smp_wmb();
         }
         current->fsuid = current->euid = new_euid;
@@ -703,7 +703,7 @@ asmlinkage long sys_setuid(uid_t uid)
 
         if (old_euid != uid)
         {
-                current->mm->dumpable = 0;
+                current->mm->dumpable = suid_dumpable;
                 smp_wmb();
         }
         current->fsuid = current->euid = uid;
@@ -748,7 +748,7 @@ asmlinkage long sys_setresuid(uid_t ruid, uid_t euid, uid_t suid)
         if (euid != (uid_t) -1) {
                 if (euid != current->euid)
                 {
-                        current->mm->dumpable = 0;
+                        current->mm->dumpable = suid_dumpable;
                         smp_wmb();
                 }
                 current->euid = euid;
@@ -798,7 +798,7 @@ asmlinkage long sys_setresgid(gid_t rgid, gid_t egid, gid_t sgid)
         if (egid != (gid_t) -1) {
                 if (egid != current->egid)
                 {
-                        current->mm->dumpable = 0;
+                        current->mm->dumpable = suid_dumpable;
                         smp_wmb();
                 }
                 current->egid = egid;
@@ -845,7 +845,7 @@ asmlinkage long sys_setfsuid(uid_t uid)
         {
                 if (uid != old_fsuid)
                 {
-                        current->mm->dumpable = 0;
+                        current->mm->dumpable = suid_dumpable;
                         smp_wmb();
                 }
                 current->fsuid = uid;
@@ -875,7 +875,7 @@ asmlinkage long sys_setfsgid(gid_t gid)
         {
                 if (gid != old_fsgid)
                 {
-                        current->mm->dumpable = 0;
+                        current->mm->dumpable = suid_dumpable;
                         smp_wmb();
                 }
                 current->fsgid = gid;
@@ -1652,7 +1652,7 @@ asmlinkage long sys_prctl(int option, unsigned long arg2, unsigned long arg3,
                                 error = 1;
                         break;
                 case PR_SET_DUMPABLE:
-                        if (arg2 != 0 && arg2 != 1) {
+                        if (arg2 < 0 || arg2 > 2) {
                                 error = -EINVAL;
                                 break;
                         }
diff --git a/kernel/sysctl.c b/kernel/sysctl.c
index 701d12c63068..24a4d12d5aa9 100644
--- a/kernel/sysctl.c
+++ b/kernel/sysctl.c
@@ -58,6 +58,7 @@ extern int sysctl_overcommit_ratio;
 extern int max_threads;
 extern int sysrq_enabled;
 extern int core_uses_pid;
+extern int suid_dumpable;
 extern char core_pattern[];
 extern int cad_pid;
 extern int pid_max;
@@ -950,6 +951,14 @@ static ctl_table fs_table[] = {
                 .proc_handler   = &proc_dointvec,
         },
 #endif
+        {
+                .ctl_name       = KERN_SETUID_DUMPABLE,
+                .procname       = "suid_dumpable",
+                .data           = &suid_dumpable,
+                .maxlen         = sizeof(int),
+                .mode           = 0644,
+                .proc_handler   = &proc_dointvec,
+        },
         { .ctl_name = 0 }
 };
 
diff --git a/security/commoncap.c b/security/commoncap.c
index 849b8c338ee8..04c12f58d656 100644
--- a/security/commoncap.c
+++ b/security/commoncap.c
@@ -149,7 +149,7 @@ void cap_bprm_apply_creds (struct linux_binprm *bprm, int unsafe)
 
         if (bprm->e_uid != current->uid || bprm->e_gid != current->gid ||
             !cap_issubset (new_permitted, current->cap_permitted)) {
-                current->mm->dumpable = 0;
+                current->mm->dumpable = suid_dumpable;
 
                 if (unsafe & ~LSM_UNSAFE_PTRACE_CAP) {
                         if (!capable(CAP_SETUID)) {
diff --git a/security/dummy.c b/security/dummy.c
index b32eff146547..6ff887586479 100644
--- a/security/dummy.c
+++ b/security/dummy.c
@@ -130,7 +130,7 @@ static void dummy_bprm_free_security (struct linux_binprm *bprm)
 static void dummy_bprm_apply_creds (struct linux_binprm *bprm, int unsafe)
 {
         if (bprm->e_uid != current->uid || bprm->e_gid != current->gid) {
-                current->mm->dumpable = 0;
+                current->mm->dumpable = suid_dumpable;
 
                 if ((unsafe & ~LSM_UNSAFE_PTRACE_CAP) && !capable(CAP_SETUID)) {
                         bprm->e_uid = current->uid;