mirror of
https://github.com/systemd/systemd.git
synced 2026-11-06 05:17:24 +00:00
Zbigniew Jędrzejewski-Szmek
19d439189a
The kernel provides %d which is documented as "dump mode—same as value returned by prctl(2) PR_GET_DUMPABLE". We already query /proc/pid/auxv for this information, but unfortunately this check is subject to a race, because the crashed process may be replaced by an attacker before we read this data, for example replacing a SUID process that was killed by a signal with another process that is not SUID, tricking us into making the coredump of the original process readable by the attacker. With this patch, we effectively add one more check to the list of conditions that need be satisfied if we are to make the coredump accessible to the user. Reportedy-by: Qualys Security Advisory <qsa@qualys.com> (cherry-picked from0c49e0049b) (cherry-picked fromc58a8a6ec9)
Files in this directory contain configuration for systemd-sysctl.service, a service to configure sysctl kernel parameters. See man:sysctl.d(5) for explanation of the configuration file format, and man:sysctl(8) and man:systemd-sysctl.service(8) for a description of when and how this configuration is applied. Use 'systemd-analyze cat-config sysctl.d' to display the effective config.