[PATCH v8 7/9] coredump: validate socket name as it is written
Christian Brauner
brauner at kernel.org
Fri May 16 11:25:34 UTC 2025
In contrast to other parameters written into
/proc/sys/kernel/core_pattern that never fail we can validate enabling
the new AF_UNIX support. This is obviously racy as hell but it's always
been that way.
Acked-by: Luca Boccassi <luca.boccassi at gmail.com>
Reviewed-by: Jann Horn <jannh at google.com>
Reviewed-by: Alexander Mikhalitsyn <aleksandr.mikhalitsyn at canonical.com>
Signed-off-by: Christian Brauner <brauner at kernel.org>
---
fs/coredump.c | 37 ++++++++++++++++++++++++++++++++++---
1 file changed, 34 insertions(+), 3 deletions(-)
diff --git a/fs/coredump.c b/fs/coredump.c
index 7b9a659683fc..c5c57e8e496f 100644
--- a/fs/coredump.c
+++ b/fs/coredump.c
@@ -1215,13 +1215,44 @@ void validate_coredump_safety(void)
}
}
+static inline bool check_coredump_socket(void)
+{
+ if (core_pattern[0] != '@')
+ return true;
+
+ /*
+ * Coredump socket must be located in the initial mount
+ * namespace. Don't give the impression that anything else is
+ * supported right now.
+ */
+ if (current->nsproxy->mnt_ns != init_task.nsproxy->mnt_ns)
+ return false;
+
+ /* Must be an absolute path. */
+ if (*(core_pattern + 1) != '/')
+ return false;
+
+ return true;
+}
+
static int proc_dostring_coredump(const struct ctl_table *table, int write,
void *buffer, size_t *lenp, loff_t *ppos)
{
- int error = proc_dostring(table, write, buffer, lenp, ppos);
+ int error;
+ ssize_t retval;
+ char old_core_pattern[CORENAME_MAX_SIZE];
+
+ retval = strscpy(old_core_pattern, core_pattern, CORENAME_MAX_SIZE);
+
+ error = proc_dostring(table, write, buffer, lenp, ppos);
+ if (error)
+ return error;
+ if (!check_coredump_socket()) {
+ strscpy(core_pattern, old_core_pattern, retval + 1);
+ return -EINVAL;
+ }
- if (!error)
- validate_coredump_safety();
+ validate_coredump_safety();
return error;
}
--
2.47.2
More information about the Linux-security-module-archive
mailing list