mirrors/linux
1
0
Fork 1
mirror of https://github.com/torvalds/linux.git synced 2025-11-01 00:58:39 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions

coredump: validate socket name as it is written

Browse source 
In contrast to other parameters written into
/proc/sys/kernel/core_pattern that never fail we can validate enabling
the new AF_UNIX support. This is obviously racy as hell but it's always
been that way.

Link: https://lore.kernel.org/20250516-work-coredump-socket-v8-7-664f3caf2516@kernel.org
Acked-by: Luca Boccassi <luca.boccassi@gmail.com>
Reviewed-by: Jann Horn <jannh@google.com>
Reviewed-by: Alexander Mikhalitsyn <aleksandr.mikhalitsyn@canonical.com>
Signed-off-by: Christian Brauner <brauner@kernel.org>
This commit is contained in:
Christian Brauner 2025-05-16 13:25:34 +02:00
parent c72d914637
commit 16195d2c7d
No known key found for this signature in database
GPG key ID: 91C61BC06578DCA2
1 changed files with 34 additions and 3 deletions
repo.diff.show_diff_stats Download patch file Download diff file Expand all files Collapse all files

37
fs/coredump.c
View file

@ -1236,13 +1236,44 @@ void validate_coredump_safety(void)
}
}
static inline bool check_coredump_socket(void)
{
if (core_pattern[0] != '@')
return true;
/*
* Coredump socket must be located in the initial mount
* namespace. Don't give the impression that anything else is
* supported right now.
*/
if (current->nsproxy->mnt_ns != init_task.nsproxy->mnt_ns)
return false;
/* Must be an absolute path. */
if (*(core_pattern + 1) != '/')
return false;
return true;
}
static int proc_dostring_coredump(const struct ctl_table *table, int write,
void *buffer, size_t *lenp, loff_t *ppos)
{
int error = proc_dostring(table, write, buffer, lenp, ppos);
int error;
ssize_t retval;
char old_core_pattern[CORENAME_MAX_SIZE];
if (!error)
validate_coredump_safety();
retval = strscpy(old_core_pattern, core_pattern, CORENAME_MAX_SIZE);
error = proc_dostring(table, write, buffer, lenp, ppos);
if (error)
return error;
if (!check_coredump_socket()) {
strscpy(core_pattern, old_core_pattern, retval + 1);
return -EINVAL;
}
validate_coredump_safety();
return error;
}