From: Kevin Darbyshire-Bryant Date: Mon, 4 Sep 2017 12:13:24 +0000 (+0100) Subject: basefiles: allow suid coredumps X-Git-Tag: v18.06.0-rc1~2267 X-Git-Url: http://git.cdn.openwrt.org/?a=commitdiff_plain;h=7765e442d04e4c19690f81084a9726776aea8b76;p=openwrt%2Fstaging%2Fchunkeey.git basefiles: allow suid coredumps Set sysctl fs.suid_dumpable = 2 This allows suid processes to dump core according to kernel.core_pattern setting. LEDE typically uses suid to drop root priviledge rather than gain it but without this setting any suid process would be unable to produce coredumps (e.g. dnsmasq) Processes still need to set a non zero core file process limit ('ulimit -c unlimited' or if procd used 'procd_set_param limits core="unlimited"') in order to produce a core. This setting removes an obscure stumbling block along the way. >From https://www.kernel.org/doc/Documentation/sysctl/fs.txt suid_dumpable: This value can be used to query and set the core dump mode for setuid or otherwise protected/tainted binaries. The modes are 0 - (default) - traditional behaviour. Any process which has changed privilege levels or is execute only will not be dumped. 1 - (debug) - all processes dump core when possible. The core dump is owned by the current user and no security is applied. This is intended for system debugging situations only. Ptrace is unchecked. This is insecure as it allows regular users to examine the memory contents of privileged processes. 2 - (suidsafe) - any binary which normally would not be dumped is dumped anyway, but only if the "core_pattern" kernel sysctl is set to either a pipe handler or a fully qualified path. (For more details on this limitation, see CVE-2006-2451.) This mode is appropriate when administrators are attempting to debug problems in a normal environment, and either have a core dump pipe handler that knows to treat privileged core dumps with care, or specific directory defined for catching core dumps. If a core dump happens without a pipe handler or fully qualifid path, a message will be emitted to syslog warning about the lack of a correct setting. Signed-off-by: Kevin Darbyshire-Bryant Signed-off-by: Hans Dedecker [PKG_RELEASE increase] --- diff --git a/package/base-files/Makefile b/package/base-files/Makefile index d92069ec76..d8ee46eaff 100644 --- a/package/base-files/Makefile +++ b/package/base-files/Makefile @@ -11,7 +11,7 @@ include $(INCLUDE_DIR)/kernel.mk include $(INCLUDE_DIR)/version.mk PKG_NAME:=base-files -PKG_RELEASE:=174 +PKG_RELEASE:=175 PKG_FLAGS:=nonshared PKG_FILE_DEPENDS:=$(PLATFORM_DIR)/ $(GENERIC_PLATFORM_DIR)/base-files/ diff --git a/package/base-files/files/etc/sysctl.conf b/package/base-files/files/etc/sysctl.conf index 91a3ac9a02..ddc7a9bf69 100644 --- a/package/base-files/files/etc/sysctl.conf +++ b/package/base-files/files/etc/sysctl.conf @@ -1,5 +1,6 @@ kernel.panic=3 kernel.core_pattern=/tmp/%e.%t.%p.%s.core +fs.suid_dumpable=2 net.ipv4.conf.default.arp_ignore=1 net.ipv4.conf.all.arp_ignore=1