Commit:     00ec99da43a7c2aed46c6595aa271b84bb1b1462
Parent:     6e800af233e0bdf108efb7bd23c11ea6fa34cdeb
Author:     Roland McGrath <[EMAIL PROTECTED]>
AuthorDate: Sun Nov 11 19:13:43 2007 -0800
Committer:  Linus Torvalds <[EMAIL PROTECTED]>
CommitDate: Mon Nov 12 10:32:29 2007 -0800

    core dump: remain dumpable
    The coredump code always calls set_dumpable(0) when it starts (even
    if RLIMIT_CORE prevents any core from being dumped).  The effect of
    this (via task_dumpable) is to make /proc/pid/* files owned by root
    instead of the user, so the user can no longer examine his own
    process--in a case where there was never any privileged data to
    protect.  This affects e.g. auxv, environ, fd; in Fedora (execshield)
    kernels, also maps.  In practice, you can only notice this when a
    debugger has requested PTRACE_EVENT_EXIT tracing.
    set_dumpable was only used in do_coredump for synchronization and not
    intended for any security purpose.  (It doesn't secure anything that wasn't
    already unsecured when a process dies by SIGTERM instead of SIGQUIT.)
    This changes do_coredump to check the core_waiters count as the means of
    synchronization, which is sufficient.  Now we leave the "dumpable" bits 
    Signed-off-by: Roland McGrath <[EMAIL PROTECTED]>
    Signed-off-by: Linus Torvalds <[EMAIL PROTECTED]>
 fs/exec.c |    6 ++++--
 1 files changed, 4 insertions(+), 2 deletions(-)

diff --git a/fs/exec.c b/fs/exec.c
index 2c942e2..4ccaaa4 100644
--- a/fs/exec.c
+++ b/fs/exec.c
@@ -1692,7 +1692,10 @@ int do_coredump(long signr, int exit_code, struct 
pt_regs * regs)
        if (!binfmt || !binfmt->core_dump)
                goto fail;
-       if (!get_dumpable(mm)) {
+       /*
+        * If another thread got here first, or we are not dumpable, bail out.
+        */
+       if (mm->core_waiters || !get_dumpable(mm)) {
                goto fail;
@@ -1706,7 +1709,6 @@ int do_coredump(long signr, int exit_code, struct pt_regs 
* regs)
                flag = O_EXCL;          /* Stop rewrite attacks */
                current->fsuid = 0;     /* Dump root private */
-       set_dumpable(mm, 0);
        retval = coredump_wait(exit_code);
        if (retval < 0)
To unsubscribe from this list: send the line "unsubscribe git-commits-head" in
the body of a message to [EMAIL PROTECTED]
More majordomo info at

Reply via email to