mirror/freebsd
1
0
Fork 0
mirror of https://git.FreeBSD.org/src.git synced 2025-02-01 17:00:36 +00:00
Code Issues Releases Activity

Add kern.capmode_coredump sysctl/tunable to allow processes in capability mode

Browse Source 
to dump core.

Reviewed by:	rwatson
Obtained from:	WHEEL Systems
MFC after:	2 weeks
This commit is contained in:
Pawel Jakub Dawidek 2012-11-27 10:38:11 +00:00
parent f121e3e81d
commit b0c9d4d70e
Notes: svn2git 2020-12-20 02:59:44 +00:00 
svn path=/head/; revision=243613
1 changed files with 13 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

15
sys/kern/kern_sig.c
View File

@ -175,6 +175,11 @@ TUNABLE_INT("kern.sugid_coredump", &sugid_coredump);
SYSCTL_INT(_kern, OID_AUTO, sugid_coredump, CTLFLAG_RW,
&sugid_coredump, 0, "Allow setuid and setgid processes to dump core");
static int capmode_coredump;
TUNABLE_INT("kern.capmode_coredump", &capmode_coredump);
SYSCTL_INT(_kern, OID_AUTO, capmode_coredump, CTLFLAG_RW,
&capmode_coredump, 0, "Allow processes in capability mode to dump core");
static int do_coredump = 1;
SYSCTL_INT(_kern, OID_AUTO, coredump, CTLFLAG_RW,
&do_coredump, 0, "Enable/Disable coredumps");
@ -3134,12 +3139,17 @@ expand_name(const char *name, uid_t uid, pid_t pid, struct thread *td,
int error, n;
int flags = O_CREAT | O_EXCL | FWRITE | O_NOFOLLOW;
int cmode = S_IRUSR | S_IWUSR | S_IRGRP | S_IWGRP;
int oflags = 0;
if (capmode_coredump)
oflags = VN_OPEN_NOCAPCHECK;
for (n = 0; n < num_cores; n++) {
temp[indexpos] = '0' + n;
NDINIT(&nd, LOOKUP, NOFOLLOW, UIO_SYSSPACE,
temp, td);
error = vn_open(&nd, &flags, cmode, NULL);
error = vn_open_cred(&nd, &flags, cmode, oflags,
td->td_ucred, NULL);
if (error) {
if (error == EEXIST)
continue;
@ -3241,7 +3251,8 @@ coredump(struct thread *td)
restart:
NDINIT(&nd, LOOKUP, NOFOLLOW, UIO_SYSSPACE, name, td);
flags = O_CREAT | FWRITE | O_NOFOLLOW;
error = vn_open_cred(&nd, &flags, S_IRUSR | S_IWUSR, VN_OPEN_NOAUDIT,
error = vn_open_cred(&nd, &flags, S_IRUSR | S_IWUSR,
VN_OPEN_NOAUDIT | (capmode_coredump ? VN_OPEN_NOCAPCHECK : 0),
cred, NULL);
if (error) {
#ifdef AUDIT