doczkal / rpms / abrt

Forked from rpms/abrt 4 years ago
Clone

Blame SOURCES/0096-ccpp-do-not-use-value-of-proc-PID-cwd-for-chdir.patch

a60cd7
From 806bb07571b698d90169c3b73cb65cd09c900284 Mon Sep 17 00:00:00 2001
a60cd7
From: Jakub Filak <jfilak@redhat.com>
a60cd7
Date: Fri, 17 Apr 2015 14:40:20 +0200
a60cd7
Subject: [ABRT PATCH] ccpp: do not use value of /proc/PID/cwd for chdir
a60cd7
a60cd7
Avoid symlink resolutions.
a60cd7
a60cd7
This issue was discovered by Florian Weimer of Red Hat Product Security.
a60cd7
a60cd7
Signed-off-by: Jakub Filak <jfilak@redhat.com>
a60cd7
---
a60cd7
 src/hooks/abrt-hook-ccpp.c | 85 +++++++++++++++++++++++-----------------------
a60cd7
 1 file changed, 42 insertions(+), 43 deletions(-)
a60cd7
a60cd7
diff --git a/src/hooks/abrt-hook-ccpp.c b/src/hooks/abrt-hook-ccpp.c
a60cd7
index 82ff555..d600bb7 100644
a60cd7
--- a/src/hooks/abrt-hook-ccpp.c
a60cd7
+++ b/src/hooks/abrt-hook-ccpp.c
a60cd7
@@ -144,6 +144,7 @@ static off_t copyfd_sparse(int src_fd, int dst_fd1, int dst_fd2, off_t size2)
a60cd7
 /* Global data */
a60cd7
 
a60cd7
 static char *user_pwd;
a60cd7
+static DIR *proc_cwd;
a60cd7
 static char *proc_pid_status;
a60cd7
 static struct dump_dir *dd;
a60cd7
 static int user_core_fd = -1;
a60cd7
@@ -163,13 +164,6 @@ static int user_core_fd = -1;
a60cd7
  */
a60cd7
 static const char percent_specifiers[] = "%scpugteh";
a60cd7
 static char *core_basename = (char*) "core";
a60cd7
-/*
a60cd7
- * Used for error messages only.
a60cd7
- * It is either the same as core_basename if it is absolute,
a60cd7
- * or $PWD/core_basename.
a60cd7
- */
a60cd7
-static char *full_core_basename;
a60cd7
-
a60cd7
 
a60cd7
 static char* get_executable(pid_t pid, int *fd_p)
a60cd7
 {
a60cd7
@@ -198,6 +192,18 @@ static char* get_executable(pid_t pid, int *fd_p)
a60cd7
     return executable;
a60cd7
 }
a60cd7
 
a60cd7
+static DIR *open_cwd(pid_t pid)
a60cd7
+{
a60cd7
+    char buf[sizeof("/proc/%lu/cwd") + sizeof(long)*3];
a60cd7
+    sprintf(buf, "/proc/%lu/cwd", (long)pid);
a60cd7
+
a60cd7
+    DIR *cwd = opendir(buf);
a60cd7
+    if (cwd == NULL)
a60cd7
+        perror_msg("Can't open process's CWD for CompatCore");
a60cd7
+
a60cd7
+    return cwd;
a60cd7
+}
a60cd7
+
a60cd7
 static char* get_cwd(pid_t pid)
a60cd7
 {
a60cd7
     char buf[sizeof("/proc/%lu/cwd") + sizeof(long)*3];
a60cd7
@@ -268,13 +274,9 @@ static int dump_suid_policy()
a60cd7
 
a60cd7
 static int open_user_core(uid_t uid, uid_t fsuid, pid_t pid, char **percent_values)
a60cd7
 {
a60cd7
-    errno = 0;
a60cd7
-    if (user_pwd == NULL
a60cd7
-     || chdir(user_pwd) != 0
a60cd7
-    ) {
a60cd7
-        perror_msg("Can't cd to '%s'", user_pwd);
a60cd7
+    proc_cwd = open_cwd(pid);
a60cd7
+    if (proc_cwd == NULL)
a60cd7
         return -1;
a60cd7
-    }
a60cd7
 
a60cd7
     struct passwd* pw = getpwuid(uid);
a60cd7
     gid_t gid = pw ? pw->pw_gid : uid;
a60cd7
@@ -337,15 +339,10 @@ static int open_user_core(uid_t uid, uid_t fsuid, pid_t pid, char **percent_valu
a60cd7
         }
a60cd7
     }
a60cd7
 
a60cd7
-    full_core_basename = core_basename;
a60cd7
-    if (core_basename[0] != '/')
a60cd7
+    if (g_need_nonrelative && core_basename[0] != '/')
a60cd7
     {
a60cd7
-        if (g_need_nonrelative)
a60cd7
-        {
a60cd7
-            error_msg("Current suid_dumpable policy prevents from saving core dumps according to relative core_pattern");
a60cd7
-            return -1;
a60cd7
-        }
a60cd7
-        core_basename = concat_path_file(user_pwd, core_basename);
a60cd7
+        error_msg("Current suid_dumpable policy prevents from saving core dumps according to relative core_pattern");
a60cd7
+        return -1;
a60cd7
     }
a60cd7
 
a60cd7
     /* Open (create) compat core file.
a60cd7
@@ -381,7 +378,7 @@ static int open_user_core(uid_t uid, uid_t fsuid, pid_t pid, char **percent_valu
a60cd7
     struct stat sb;
a60cd7
     errno = 0;
a60cd7
     /* Do not O_TRUNC: if later checks fail, we do not want to have file already modified here */
a60cd7
-    int user_core_fd = open(core_basename, O_WRONLY | O_CREAT | O_NOFOLLOW | g_user_core_flags, 0600); /* kernel makes 0600 too */
a60cd7
+    int user_core_fd = openat(dirfd(proc_cwd), core_basename, O_WRONLY | O_CREAT | O_NOFOLLOW | g_user_core_flags, 0600); /* kernel makes 0600 too */
a60cd7
     xsetegid(0);
a60cd7
     xseteuid(0);
a60cd7
     if (user_core_fd < 0
a60cd7
@@ -391,15 +388,15 @@ static int open_user_core(uid_t uid, uid_t fsuid, pid_t pid, char **percent_valu
a60cd7
      || sb.st_uid != fsuid
a60cd7
     ) {
a60cd7
         if (user_core_fd < 0)
a60cd7
-            perror_msg("Can't open '%s'", full_core_basename);
a60cd7
+            perror_msg("Can't open '%s' at '%s'", core_basename, user_pwd);
a60cd7
         else
a60cd7
-            perror_msg("'%s' is not a regular file with link count 1 owned by UID(%d)", full_core_basename, fsuid);
a60cd7
+            perror_msg("'%s' at '%s' is not a regular file with link count 1 owned by UID(%d)", core_basename, user_pwd, fsuid);
a60cd7
         return -1;
a60cd7
     }
a60cd7
     if (ftruncate(user_core_fd, 0) != 0) {
a60cd7
         /* perror first, otherwise unlink may trash errno */
a60cd7
-        perror_msg("Can't truncate '%s' to size 0", full_core_basename);
a60cd7
-        unlink(core_basename);
a60cd7
+        perror_msg("Can't truncate '%s' at '%s' to size 0", core_basename, user_pwd);
a60cd7
+        unlinkat(dirfd(proc_cwd), core_basename, /*unlink file*/0);
a60cd7
         return -1;
a60cd7
     }
a60cd7
 
a60cd7
@@ -466,10 +463,8 @@ static int create_or_die(const char *filename)
a60cd7
     if (dd)
a60cd7
         dd_delete(dd);
a60cd7
     if (user_core_fd >= 0)
a60cd7
-    {
a60cd7
-        xchdir(user_pwd);
a60cd7
-        unlink(core_basename);
a60cd7
-    }
a60cd7
+        unlinkat(dirfd(proc_cwd), core_basename, /*unlink file*/0);
a60cd7
+
a60cd7
     errno = sv_errno;
a60cd7
     perror_msg_and_die("Can't open '%s'", filename);
a60cd7
 }
a60cd7
@@ -573,7 +568,7 @@ int main(int argc, char** argv)
a60cd7
                         (long)pid, executable);
a60cd7
     }
a60cd7
 
a60cd7
-    user_pwd = get_cwd(pid); /* may be NULL on error */
a60cd7
+    user_pwd = get_cwd(pid);
a60cd7
     log_notice("user_pwd:'%s'", user_pwd);
a60cd7
 
a60cd7
     sprintf(path, "/proc/%lu/status", (long)pid);
a60cd7
@@ -672,6 +667,8 @@ int main(int argc, char** argv)
a60cd7
             error_msg_and_die("Error saving '%s'", path);
a60cd7
         }
a60cd7
         log("Saved core dump of pid %lu (%s) to %s (%llu bytes)", (long)pid, executable, path, (long long)core_size);
a60cd7
+        if (proc_cwd != NULL)
a60cd7
+            closedir(proc_cwd);
a60cd7
         return 0;
a60cd7
     }
a60cd7
 
a60cd7
@@ -791,10 +788,7 @@ int main(int argc, char** argv)
a60cd7
             unlink(path);
a60cd7
             dd_delete(dd);
a60cd7
             if (user_core_fd >= 0)
a60cd7
-            {
a60cd7
-                xchdir(user_pwd);
a60cd7
-                unlink(core_basename);
a60cd7
-            }
a60cd7
+                unlinkat(dirfd(proc_cwd), core_basename, /*unlink file*/0);
a60cd7
             /* copyfd_sparse logs the error including errno string,
a60cd7
              * but it does not log file name */
a60cd7
             error_msg_and_die("Error writing '%s'", path);
a60cd7
@@ -807,8 +801,7 @@ int main(int argc, char** argv)
a60cd7
             )
a60cd7
         ) {
a60cd7
             /* nuke it (silently) */
a60cd7
-            xchdir(user_pwd);
a60cd7
-            unlink(core_basename);
a60cd7
+            unlinkat(dirfd(proc_cwd), core_basename, /*unlink file*/0);
a60cd7
         }
a60cd7
 
a60cd7
 /* Because of #1211835 and #1126850 */
a60cd7
@@ -879,6 +872,8 @@ int main(int argc, char** argv)
a60cd7
         }
a60cd7
 
a60cd7
         free(rootdir);
a60cd7
+        if (proc_cwd != NULL)
a60cd7
+            closedir(proc_cwd);
a60cd7
         return 0;
a60cd7
     }
a60cd7
 
a60cd7
@@ -890,19 +885,23 @@ int main(int argc, char** argv)
a60cd7
         if (fsync(user_core_fd) != 0 || close(user_core_fd) != 0 || core_size < 0)
a60cd7
         {
a60cd7
             /* perror first, otherwise unlink may trash errno */
a60cd7
-            perror_msg("Error writing '%s'", full_core_basename);
a60cd7
-            xchdir(user_pwd);
a60cd7
-            unlink(core_basename);
a60cd7
+            perror_msg("Error writing '%s' at '%s'", core_basename, user_pwd);
a60cd7
+            unlinkat(dirfd(proc_cwd), core_basename, /*unlink file*/0);
a60cd7
+            if (proc_cwd != NULL)
a60cd7
+                closedir(proc_cwd);
a60cd7
             return 1;
a60cd7
         }
a60cd7
         if (ulimit_c == 0 || core_size > ulimit_c)
a60cd7
         {
a60cd7
-            xchdir(user_pwd);
a60cd7
-            unlink(core_basename);
a60cd7
+            unlinkat(dirfd(proc_cwd), core_basename, /*unlink file*/0);
a60cd7
+            if (proc_cwd != NULL)
a60cd7
+                closedir(proc_cwd);
a60cd7
             return 1;
a60cd7
         }
a60cd7
-        log("Saved core dump of pid %lu to %s (%llu bytes)", (long)pid, full_core_basename, (long long)core_size);
a60cd7
+        log("Saved core dump of pid %lu to %s at %s (%llu bytes)", (long)pid, core_basename, user_pwd, (long long)core_size);
a60cd7
     }
a60cd7
 
a60cd7
+    if (proc_cwd != NULL)
a60cd7
+        closedir(proc_cwd);
a60cd7
     return 0;
a60cd7
 }
a60cd7
-- 
a60cd7
1.8.3.1
a60cd7