On Sat, Oct 29, 2016 at 8:21 AM, Alexey Dobriyan <adobri...@gmail.com> wrote:
> I was amused to find "unsafe core_pattern" warning having these lines
> in /etc/sysctl.conf:
>
> fs.suid_dumpable=2
> kernel.core_pattern=/core/core-%e-%p-%E
> kernel.core_uses_pid=0
>
> Turns out kernel is formally right. Default core_pattern is just "core",
> which doesn't qualify for secure path while setting suid.dumpable.
>
> Hint admins about solution, clarify sysctl names, delete unnecessary '\'
> characters (string literals are concatenated regardless) and reformat
> for easier grepping.
>
> Signed-off-by: Alexey Dobriyan <adobri...@gmail.com>
Ah, yes, order of operations mattered. :) I like the rephrasing, thanks!
Acked-by: Kees Cook <keesc...@chromium.org>
-Kees
> ---
>
> kernel/sysctl.c | 8 +++++---
> 1 file changed, 5 insertions(+), 3 deletions(-)
>
> commit ba93b14a4f61e4563134abab5d81bb8b53c60df9
> Author: Alexey Dobriyan <adobri...@gmail.com>
> Date: Sat Oct 29 18:13:57 2016 +0300
>
> kernel.core_dump
>
> --- a/kernel/sysctl.c
> +++ b/kernel/sysctl.c
> @@ -2403,9 +2403,11 @@ static void validate_coredump_safety(void)
> #ifdef CONFIG_COREDUMP
> if (suid_dumpable == SUID_DUMP_ROOT &&
> core_pattern[0] != '/' && core_pattern[0] != '|') {
> - printk(KERN_WARNING "Unsafe core_pattern used with "\
> - "suid_dumpable=2. Pipe handler or fully qualified "\
> - "core dump path required.\n");
> + printk(KERN_WARNING
> +"Unsafe core_pattern used with fs.suid_dumpable=2.\n"
> +"Pipe handler or fully qualified core dump path required.\n"
> +"Set kernel.core_pattern before fs.suid_dumpable.\n"
> + );
> }
> #endif
> }
--
Kees Cook
Nexus Security
