mirror of
https://github.com/morgan9e/systemd
synced 2026-04-14 00:14:32 +09:00
0c49e0049b
The kernel provides %d which is documented as "dump mode—same as value returned by prctl(2) PR_GET_DUMPABLE". We already query /proc/pid/auxv for this information, but unfortunately this check is subject to a race, because the crashed process may be replaced by an attacker before we read this data, for example replacing a SUID process that was killed by a signal with another process that is not SUID, tricking us into making the coredump of the original process readable by the attacker. With this patch, we effectively add one more check to the list of conditions that need be satisfied if we are to make the coredump accessible to the user. Reportedy-by: Qualys Security Advisory <qsa@qualys.com> In principle, %d might return a value other than 0, 1, or 2 in the future. Thus, we accept those, but emit a notice.
Files in this directory contain configuration for systemd-sysctl.service, a service to configure sysctl kernel parameters. See man:sysctl.d(5) for explanation of the configuration file format, and man:sysctl(8) and man:systemd-sysctl.service(8) for a description of when and how this configuration is applied. Use 'systemd-analyze cat-config sysctl.d' to display the effective config.