Gitweb:     
http://git.kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=c4bbafda70a0fc95c6595bffd6825ef264050d01
Commit:     c4bbafda70a0fc95c6595bffd6825ef264050d01
Parent:     c4b7e8754e3198eb5392568e523da6440143c2cd
Author:     Alan Cox <[EMAIL PROTECTED]>
AuthorDate: Mon Apr 16 22:53:13 2007 -0700
Committer:  Linus Torvalds <[EMAIL PROTECTED]>
CommitDate: Tue Apr 17 16:36:26 2007 -0700

    exec.c: fix coredump to pipe problem and obscure "security hole"
    
    The patch checks for "|" in the pattern not the output and doesn't nail a
    pid on to a piped name (as it is a program name not a file)
    
    Also fixes a very very obscure security corner case.  If you happen to have
    decided on a core pattern that starts with the program name then the user
    can run a program called "|myevilhack" as it stands.  I doubt anyone does
    this.
    
    Signed-off-by: Alan Cox <[EMAIL PROTECTED]>
    Confirmed-by: Christopher S. Aker <[EMAIL PROTECTED]>
    Cc: <[EMAIL PROTECTED]>
    Signed-off-by: Andrew Morton <[EMAIL PROTECTED]>
    Signed-off-by: Linus Torvalds <[EMAIL PROTECTED]>
---
 fs/exec.c |   18 +++++++++++-------
 1 files changed, 11 insertions(+), 7 deletions(-)

diff --git a/fs/exec.c b/fs/exec.c
index 7e36c6f..3155e91 100644
--- a/fs/exec.c
+++ b/fs/exec.c
@@ -1244,13 +1244,17 @@ EXPORT_SYMBOL(set_binfmt);
  * name into corename, which must have space for at least
  * CORENAME_MAX_SIZE bytes plus one byte for the zero terminator.
  */
-static void format_corename(char *corename, const char *pattern, long signr)
+static int format_corename(char *corename, const char *pattern, long signr)
 {
        const char *pat_ptr = pattern;
        char *out_ptr = corename;
        char *const out_end = corename + CORENAME_MAX_SIZE;
        int rc;
        int pid_in_pattern = 0;
+       int ispipe = 0;
+
+       if (*pattern == '|')
+               ispipe = 1;
 
        /* Repeat as long as we have more pattern to process and more output
           space */
@@ -1341,8 +1345,8 @@ static void format_corename(char *corename, const char 
*pattern, long signr)
         *
         * If core_pattern does not include a %p (as is the default)
         * and core_uses_pid is set, then .%pid will be appended to
-        * the filename */
-       if (!pid_in_pattern
+        * the filename. Do not do this for piped commands. */
+       if (!ispipe && !pid_in_pattern
             && (core_uses_pid || atomic_read(&current->mm->mm_users) != 1)) {
                rc = snprintf(out_ptr, out_end - out_ptr,
                              ".%d", current->tgid);
@@ -1350,8 +1354,9 @@ static void format_corename(char *corename, const char 
*pattern, long signr)
                        goto out;
                out_ptr += rc;
        }
-      out:
+out:
        *out_ptr = 0;
+       return ispipe;
 }
 
 static void zap_process(struct task_struct *start)
@@ -1502,16 +1507,15 @@ int do_coredump(long signr, int exit_code, struct 
pt_regs * regs)
         * uses lock_kernel()
         */
        lock_kernel();
-       format_corename(corename, core_pattern, signr);
+       ispipe = format_corename(corename, core_pattern, signr);
        unlock_kernel();
-       if (corename[0] == '|') {
+       if (ispipe) {
                /* SIGPIPE can happen, but it's just never processed */
                if(call_usermodehelper_pipe(corename+1, NULL, NULL, &file)) {
                        printk(KERN_INFO "Core dump to %s pipe failed\n",
                               corename);
                        goto fail_unlock;
                }
-               ispipe = 1;
        } else
                file = filp_open(corename,
                                 O_CREAT | 2 | O_NOFOLLOW | O_LARGEFILE | flag,
-
To unsubscribe from this list: send the line "unsubscribe git-commits-head" in
the body of a message to [EMAIL PROTECTED]
More majordomo info at  http://vger.kernel.org/majordomo-info.html

Reply via email to