From 7a29e0bf968602fc2fad59089875a31daa81fd40 Mon Sep 17 00:00:00 2001 From: Konstantin Belousov Date: Sun, 23 Jun 2019 18:35:11 +0000 Subject: [PATCH] coredump: avoid writing to core files not owned by the real user. Reported by: blake frantz PR: 68905 admbugs: 358 Sponsored by: The FreeBSD Foundation MFC after: 1 week --- sys/kern/kern_sig.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/sys/kern/kern_sig.c b/sys/kern/kern_sig.c index 8dbcb87698bc..f40aad4b3869 100644 --- a/sys/kern/kern_sig.c +++ b/sys/kern/kern_sig.c @@ -3597,10 +3597,11 @@ coredump(struct thread *td) /* * Don't dump to non-regular files or files with links. - * Do not dump into system files. + * Do not dump into system files. Real user must own the corefile. */ if (vp->v_type != VREG || VOP_GETATTR(vp, &vattr, cred) != 0 || - vattr.va_nlink != 1 || (vp->v_vflag & VV_SYSTEM) != 0) { + vattr.va_nlink != 1 || (vp->v_vflag & VV_SYSTEM) != 0 || + vattr.va_uid != cred->cr_ruid) { VOP_UNLOCK(vp, 0); error = EFAULT; goto out;