baab13
From af945ff58a698ce00c45059a05994ef53a13e192 Mon Sep 17 00:00:00 2001
baab13
From: Jakub Filak <jfilak@redhat.com>
baab13
Date: Fri, 17 Apr 2015 14:36:45 +0200
baab13
Subject: [ABRT PATCH] ccpp: do not override existing files by compat cores
baab13
baab13
Implement all checks used in kernel's do_coredump() and require
baab13
non-relative path if suid_dumpable is 2.
baab13
baab13
Related: #1212818
baab13
baab13
Signed-off-by: Jakub Filak <jfilak@redhat.com>
baab13
---
baab13
 src/hooks/abrt-hook-ccpp.c | 20 ++++++++++++++++----
baab13
 1 file changed, 16 insertions(+), 4 deletions(-)
baab13
baab13
diff --git a/src/hooks/abrt-hook-ccpp.c b/src/hooks/abrt-hook-ccpp.c
baab13
index 85e0d35..82ff555 100644
baab13
--- a/src/hooks/abrt-hook-ccpp.c
baab13
+++ b/src/hooks/abrt-hook-ccpp.c
baab13
@@ -24,6 +24,8 @@
baab13
 #define  DUMP_SUID_UNSAFE 1
baab13
 #define  DUMP_SUID_SAFE 2
baab13
 
baab13
+static int g_user_core_flags;
baab13
+static int g_need_nonrelative;
baab13
 
baab13
 /* I want to use -Werror, but gcc-4.4 throws a curveball:
baab13
  * "warning: ignoring return value of 'ftruncate', declared with attribute warn_unused_result"
baab13
@@ -337,7 +339,14 @@ static int open_user_core(uid_t uid, uid_t fsuid, pid_t pid, char **percent_valu
baab13
 
baab13
     full_core_basename = core_basename;
baab13
     if (core_basename[0] != '/')
baab13
+    {
baab13
+        if (g_need_nonrelative)
baab13
+        {
baab13
+            error_msg("Current suid_dumpable policy prevents from saving core dumps according to relative core_pattern");
baab13
+            return -1;
baab13
+        }
baab13
         core_basename = concat_path_file(user_pwd, core_basename);
baab13
+    }
baab13
 
baab13
     /* Open (create) compat core file.
baab13
      * man core:
baab13
@@ -372,19 +381,19 @@ static int open_user_core(uid_t uid, uid_t fsuid, pid_t pid, char **percent_valu
baab13
     struct stat sb;
baab13
     errno = 0;
baab13
     /* Do not O_TRUNC: if later checks fail, we do not want to have file already modified here */
baab13
-    int user_core_fd = open(core_basename, O_WRONLY | O_CREAT | O_NOFOLLOW, 0600); /* kernel makes 0600 too */
baab13
+    int user_core_fd = open(core_basename, O_WRONLY | O_CREAT | O_NOFOLLOW | g_user_core_flags, 0600); /* kernel makes 0600 too */
baab13
     xsetegid(0);
baab13
     xseteuid(0);
baab13
     if (user_core_fd < 0
baab13
      || fstat(user_core_fd, &sb) != 0
baab13
      || !S_ISREG(sb.st_mode)
baab13
      || sb.st_nlink != 1
baab13
-    /* kernel internal dumper checks this too: if (inode->i_uid != current->fsuid) <fail>, need to mimic? */
baab13
+     || sb.st_uid != fsuid
baab13
     ) {
baab13
         if (user_core_fd < 0)
baab13
             perror_msg("Can't open '%s'", full_core_basename);
baab13
         else
baab13
-            perror_msg("'%s' is not a regular file with link count 1", full_core_basename);
baab13
+            perror_msg("'%s' is not a regular file with link count 1 owned by UID(%d)", full_core_basename, fsuid);
baab13
         return -1;
baab13
     }
baab13
     if (ftruncate(user_core_fd, 0) != 0) {
baab13
@@ -578,8 +587,11 @@ int main(int argc, char** argv)
baab13
         /* use root for suided apps unless it's explicitly set to UNSAFE */
baab13
         fsuid = 0;
baab13
         if (suid_policy == DUMP_SUID_UNSAFE)
baab13
-        {
baab13
             fsuid = tmp_fsuid;
baab13
+        else
baab13
+        {
baab13
+            g_user_core_flags = O_EXCL;
baab13
+            g_need_nonrelative = 1;
baab13
         }
baab13
     }
baab13
 
baab13
-- 
baab13
1.8.3.1
baab13