Merge remote-tracking branch 'systemd-security/coredump-d'

src/shared/coredump-util.c

@@ -1,9 +1,11 @@
 /* SPDX-License-Identifier: LGPL-2.1-or-later */
 
 #include <elf.h>
+#include <sys/prctl.h>
 
 #include "alloc-util.h"
 #include "coredump-util.h"
+#include "errno-util.h"
 #include "extract-word.h"
 #include "fileio.h"
 #include "log.h"
@@ -14,6 +16,11 @@
 #include "unaligned.h"
 #include "virt.h"
 
+int set_dumpable(SuidDumpMode mode) {
+        /* Cast mode explicitly to long, because prctl wants longs but is varargs. */
+        return RET_NERRNO(prctl(PR_SET_DUMPABLE, (long) mode));
+}
+
 static const char *const coredump_filter_table[_COREDUMP_FILTER_MAX] = {
         [COREDUMP_FILTER_PRIVATE_ANONYMOUS]   = "private-anonymous",
         [COREDUMP_FILTER_SHARED_ANONYMOUS]    = "shared-anonymous",

src/shared/coredump-util.h

@@ -25,6 +25,15 @@ typedef enum CoredumpFilter {
 /* The kernel doesn't like UINT64_MAX and returns ERANGE, use UINT32_MAX to support future new flags */
 #define COREDUMP_FILTER_MASK_ALL UINT32_MAX
 
+typedef enum SuidDumpMode {
+        SUID_DUMP_DISABLE = 0,  /* PR_SET_DUMPABLE(2const) */
+        SUID_DUMP_USER    = 1,  /* PR_SET_DUMPABLE(2const) */
+        SUID_DUMP_SAFE    = 2,  /* https://www.kernel.org/doc/html/latest/admin-guide/sysctl/fs.html#suid-dumpable */
+        _SUID_DUMP_MODE_MAX,
+} SuidDumpMode;
+
+int set_dumpable(SuidDumpMode mode);
+
 const char* coredump_filter_to_string(CoredumpFilter i) _const_;
 CoredumpFilter coredump_filter_from_string(const char *s) _pure_;
 int coredump_filter_mask_from_string(const char *s, uint64_t *ret);

src/shared/elf-util.c

@@ -6,12 +6,12 @@
 #include <elfutils/libdwfl.h>
 #include <libelf.h>
 #endif
-#include <sys/prctl.h>
 #include <unistd.h>
 
 #include "sd-json.h"
 
 #include "alloc-util.h"
+#include "coredump-util.h"
 #include "dlfcn-util.h"
 #include "elf-util.h"
 #include "errno-util.h"
@@ -829,7 +829,7 @@ int parse_elf_object(int fd, const char *executable, const char *root, bool fork
         if (r == 0) {
                 /* We want to avoid loops, given this can be called from systemd-coredump */
                 if (fork_disable_dump) {
-                        r = RET_NERRNO(prctl(PR_SET_DUMPABLE, 0));
+                        r = set_dumpable(SUID_DUMP_DISABLE);
                         if (r < 0)
                                 report_errno_and_exit(error_pipe[1], r);
                 }

src/shared/tests.c

@@ -17,6 +17,7 @@
 #include "bus-wait-for-jobs.h"
 #include "cgroup-setup.h"
 #include "cgroup-util.h"
+#include "coredump-util.h"
 #include "env-file.h"
 #include "env-util.h"
 #include "errno-util.h"
@@ -436,7 +437,8 @@ int assert_signal_internal(void) {
 
         if (r == 0) {
                 /* Speed things up by never even attempting to generate a coredump */
-                (void) prctl(PR_SET_DUMPABLE, 0);
+                (void) set_dumpable(SUID_DUMP_DISABLE);
+
                 /* But still set an rlimit just in case */
                 (void) setrlimit(RLIMIT_CORE, &RLIMIT_MAKE_CONST(0));
                 return 0;