LinuxQuestions.org
Welcome to the most active Linux Forum on the web.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Security
User Name
Password
Linux - Security This forum is for all security related questions.
Questions, tips, system compromises, firewalls, etc. are all included here.

Notices

Closed Thread
 
Search this Thread
Old 11-28-2006, 06:52 PM   #1
pgrodt
LQ Newbie
 
Registered: Nov 2006
Distribution: RHEL 4 - 2.6.9-42.0.10
Posts: 11

Rep: Reputation: 0
Obtaining core from SUID program


Hi all, first post!

I cannot seem to force an SUID program to drop a core on segfault (or presumably any other fault) when run by an unprivilged user. I've searched about and set everything I could think to set. The kernel.core_setuid_ok seemed most promising, but that hasn't seemed to work either. I saw reference to a bug in sysctl.c for my kernel version related to that variable, but I don't see evidence that it directly relates to my problem. Anyone have any ideas? The output below is obtained immediately after a full reboot. I'm using RedHat Enterprise 3, linux 2.4.21-40, and unable to upgrade to 2.6 at this time.

[root@---- root]# cat /etc/sysctl.conf
# Kernel sysctl configuration file for Red Hat Linux
#
# For binary values, 0 is disabled, 1 is enabled. See sysctl(8) and
# sysctl.conf(5) for more details.

# Controls IP packet forwarding
net.ipv4.ip_forward = 0

# Controls source route verification
net.ipv4.conf.default.rp_filter = 1

# Controls the System Request debugging functionality of the kernel
kernel.sysrq = 0

# Controls whether core dumps will append the PID to the core filename.
# Useful for debugging multi-threaded applications.
kernel.core_uses_pid = 1
kernel.core_setuid_ok = 1
kernel.core_pattern = core.%e.%p


[root@---- root]# cat /etc/profile
//snipped
# No core files by default
#ulimit -S -c 0 > /dev/null 2>&1 //Commented out
//snipped
[root@---- root]# ulimit -a
core file size (blocks, -c) unlimited
data seg size (kbytes, -d) unlimited
file size (blocks, -f) unlimited
max locked memory (kbytes, -l) 4
max memory size (kbytes, -m) unlimited
open files (-n) 1024
pipe size (512 bytes, -p) 8
stack size (kbytes, -s) 10240
cpu time (seconds, -t) unlimited
max user processes (-u) 7168
virtual memory (kbytes, -v) unlimited

[user@---- ~]$ ulimit -a
core file size (blocks, -c) unlimited
data seg size (kbytes, -d) unlimited
file size (blocks, -f) unlimited
max locked memory (kbytes, -l) 4
max memory size (kbytes, -m) unlimited
open files (-n) 1024
pipe size (512 bytes, -p) 8
stack size (kbytes, -s) 10240
cpu time (seconds, -t) unlimited
max user processes (-u) 7168
virtual memory (kbytes, -v) unlimited

[user@---- user]$ cat /etc/security/limits.conf
# End of file
[user@---- user]$ cat /proc/sys/kernel/core_setuid_ok
1
[user@---- user]$cat testcase.cpp
[HTML]
<code>
//file testcase.cpp
#include<sys/resource.h>
#include<unistd.h>
int main(int args, char *argv[])
{
seteuid(getuid());
struct rlimit rlp;
struct rlimit newRlp = {RLIM_INFINITY, RLIM_INFINITY};
getrlimit(RLIMIT_CORE, &rlp);
setrlimit(RLIMIT_CORE, &newRlp);

int *badPtr = NULL;
*badPtr = 5; //forces segfault

return 0; //shouldn't happen
}
</code>
[/HTML]
[user@---- user]$ g++ -g -Wall testcase.cpp -o testcase
[user@---- user]$ su
[root@---- user]# chown root testcase
[root@---- user]# chmod u+s testcase
[root@---- user]# ./testcase
Segmentation fault (core dumped)
[root@---- user]# exit
[user@---- user]$ ./testcase
Segmentation fault
[user@---- user]$ echo 'Dangit, why wont you drop core!?!?'
 
Old 11-30-2006, 06:29 AM   #2
unSpawn
Moderator
 
Registered: May 2001
Posts: 27,666
Blog Entries: 54

Rep: Reputation: 2952Reputation: 2952Reputation: 2952Reputation: 2952Reputation: 2952Reputation: 2952Reputation: 2952Reputation: 2952Reputation: 2952Reputation: 2952Reputation: 2952
Hello and welcome to LQ. Hope you like it here.

Can't see anything wrong in your specs, and on my RHEL-3 equivalent box it works:
Code:
]$ uname -r
2.4.33

]$ /sbin/sysctl -a | grep l.core
kernel.core_pattern = /tmp/.core
kernel.core_setuid_ok = 1
kernel.core_uses_pid = 1

]$ UIDMIN=(`grep UID_MI /etc/login.defs`); [ `id -g` -gt ${UIDMIN[1]} ] && ulimit -S
unlimited

]$ strace -v -egetrlimit /tmp/testcase
getrlimit(RLIMIT_CORE, {rlim_cur=0, rlim_max=RLIM_INFINITY}) = 0
--- SIGSEGV (Segmentation fault) @ 0 (0) ---
+++ killed by SIGSEGV (core dumped) +++
Process 81131 detached

]$ gdb /tmp/testcase /tmp/.core.81131
Core was generated by `/tmp/testcase'.
Program terminated with signal 11, Segmentation fault.
Reading symbols (etc)
Loaded symbols (etc)
(etc)
#0  0x080484b5 in main (args=1, argv=0xbffffbc4) at /tmp/testcase.cpp:12
12          *badPtr = 5;        //forces segfault
What's the difference in strace as root and strace as unpriv user?
 
Old 11-30-2006, 10:47 AM   #3
pgrodt
LQ Newbie
 
Registered: Nov 2006
Distribution: RHEL 4 - 2.6.9-42.0.10
Posts: 11

Original Poster
Rep: Reputation: 0
Excluding timestamps and hex values related to old_mmap and base addresses, the only diff of 'strace -v ./testcase' between root and unpriv user is:
Code:
325,326c325,326
< getuid32()                              = 11264
< setresuid32(-1, 11264, -1)              = 0
---
> getuid32()                              = 0
> setresuid32(-1, 0, -1)                  = 0
330c330
< +++ killed by SIGSEGV +++
---
> +++ killed by SIGSEGV (core dumped) +++
 
Old 11-30-2006, 04:20 PM   #4
pgrodt
LQ Newbie
 
Registered: Nov 2006
Distribution: RHEL 4 - 2.6.9-42.0.10
Posts: 11

Original Poster
Rep: Reputation: 0
So after putting this on hold and moving onto my next task, I happened to stumble accross an article mentioning prctl(8). I inserted the line
Code:
prctl(PR_SET_DUMPABLE, 1);
into my test code and it properly dumped a core. So now my questions are:

1) Is this a proper thing to do? Assuming the rest of the code is secure, are there any glaring reasons why I shouldn't release such code into the field?

2) Does this new information shed any light onto why kernel.core_setuid_ok didn't work for me?

Any other information related to the design mentality for suid fault proceedure, or an explaination of the process the OS follows, be it a description or a link to good information would be greatly appreciated. I'm quite keen on security, but I've still got a lot to learn.
 
Old 09-29-2010, 05:31 PM   #5
Ivo.Raisr
LQ Newbie
 
Registered: Sep 2010
Distribution: RHEL 5
Posts: 1

Rep: Reputation: 0
Talking Obtaining core from SUID program

Oh yeah,
you did great job with prctl.
Quoting 'man 2 prctl' on PR_SET_DUMPABLE:

"Since Linux 2.4) Set the state of the flag determining whether core dumps are
produced for this process upon delivery of a signal whose default behaviour is
to produce a core dump. (Normally this flag is set for a process by default, but it is cleared when a set-user-ID or set-group-ID program is executed and
also by various system calls that manipulate process UIDs and GIDs). ..."
 
Old 09-29-2010, 07:42 PM   #6
win32sux
Guru
 
Registered: Jul 2003
Location: Los Angeles
Distribution: Ubuntu
Posts: 9,870

Rep: Reputation: 371Reputation: 371Reputation: 371Reputation: 371
Ivo.Raisr, please don't resurrect dead threads. Check the dates before you post. Closed.
 
  


Closed Thread

Tags
coredump, setuid, suid, sysctl, ulimit


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
suid java program- a quick fix? lightningdan Linux - General 1 06-01-2006 03:29 PM
Core system program source techrolla Linux - General 1 11-16-2005 11:44 PM
How to compile a C program in Fedora Core 4 SeniorSE Programming 3 09-13-2005 10:20 PM
obtaining program execution trace? arjunsub Programming 2 02-20-2005 10:17 AM
SUID file drops suid bit on append? c_coder Programming 1 03-12-2004 08:59 AM


All times are GMT -5. The time now is 07:46 PM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
identi.ca: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration