2010-06-14 20:45:59

by Lei Sun

Subject: fs/exec.c core dumping on NFS mounted directory

Hi :
? In 2.6.3x, I am logging in as a root and running app from NFS
mounted directory. The app crashed with 0 bytes core file (I have set
"ulimit -c unlimited", so it's not an issue).
The following code in fs/exec.c is causing this:

? ?/*
? ? * Dont allow local users get cute and trick others to coredump
? ? * into their pre-created files:
? ? * Note, this is not relevant for pipes
? ? */
? ?if (!ispipe && (inode->i_uid != current_fsuid()))
? ? ? ?goto close_fail;

What is the intention of above piece of code? ?If it's security
concern, ?it clearly break the NFS mounted (different uid) core
dumping logic.

P.S. CC to my email, i am not on the list.

Thanks
lei

2010-06-25 19:32:45

by Lei Sun

Subject: Fwd: fs/exec.c core dumping on NFS mounted directory

? In 2.6.3x, I am logging in as a root and running app from NFS
mounted directory. The app crashed with 0 bytes core file (I have set
"ulimit -c unlimited", so it's not an issue).

Proposed patch:

--- exec.c 2010-05-19 17:33:16.000000000 -0700
+++ exec.c.new 2010-05-19 17:33:07.000000000 -0700
@@ -1859,7 +1859,7 @@
* Dont allow local users get cute and trick others to coredump
* into their pre-created files:
*/
- if (inode->i_uid != current_fsuid())
+ if (inode->i_bytes != 0 && inode->i_uid != current_fsuid())
goto close_fail;

if (!file->f_op)


P.S. CC to my email, i am not on the list.

Thanks
lei

2010-06-25 20:01:23

by Trond Myklebust

Subject: Re: Fwd: fs/exec.c core dumping on NFS mounted directory

On Fri, 2010-06-25 at 12:32 -0700, Lei Sun wrote:
> In 2.6.3x, I am logging in as a root and running app from NFS
> mounted directory. The app crashed with 0 bytes core file (I have set
> "ulimit -c unlimited", so it's not an issue).
>
> Proposed patch:
>
> --- exec.c 2010-05-19 17:33:16.000000000 -0700
> +++ exec.c.new 2010-05-19 17:33:07.000000000 -0700
> @@ -1859,7 +1859,7 @@
> * Dont allow local users get cute and trick others to coredump
> * into their pre-created files:
> */
> - if (inode->i_uid != current_fsuid())
> + if (inode->i_bytes != 0 && inode->i_uid != current_fsuid())
> goto close_fail;
>
> if (!file->f_op)
>
... which would go ahead and reintroduce bugzilla entry 3043, but only
for those filesystems that set inode->i_bytes to zero:
https://bugzilla.kernel.org/show_bug.cgi?id=3043

NACKed...

Trond