Re: Patch for comment: setuid core dumps

[Chris Wright <chrisw@osdl.org>]

* Alan Cox (alan@redhat.com) wrote:
>  
> +suid_dumpable:
> +
> +This value can be used to query and set the core dump mode for setuid
> +or otherwise protected/tainted binaries. The modes are
> +
> +0 - (default) - traditional behaviour. Any process which has changed
> +	privilege levels or is execute only will not be dumped
> +1 - (debug) - all processes dump core when possible. The core dump is
> +	owned by the current user and no security is applied. This is
> +	intended for system debugging situations only.

This looks alright, since it keeps 0 and 1 with same meaning (for any
user of prctl).

> +2 - (suidsafe) - any binary which normally not be dumped is dumped
> +	readable by root only. This allows the end user to remove
> +	such a dump but not access it directly. For security reasons
> +	core dumps in this mode will not overwrite one another or 
> +	other files. This mode is appropriate when adminstrators are
> +	attempting to debug problems in a normal environment.
> +

But, in general, did you double check how this plays with /proc
(task_dumpable) and ptrace_attach type stuff?  That seems sketchy.

thanks,
-chris
-- 
Linux Security Modules     http://lsm.immunix.org     http://lsm.bkbits.net