I setup my environment to create a core dump of everything that crashes, however when I run an program with SUID set on a different user than the executing user it doesn't create a core dump. Any idea's why this might be? I couldn't find it anywhere on the web, I think it's some sort of security feature but I would like to have it disabled...
$ cd /tmp $ cat /etc/security/limits.conf | grep core * - core unlimited root - core unlimited $ ls -l ohai -rwsr-sr-x 1 root root 578988 2011-06-23 23:29 ohai $ ./ohai ... Floating point exception $ sudo -i # ./ohai ... Floating point exception (core dumped) # chmod -s ohai # exit $ ./ohai ... Floating point exception (core dumped)
Edit: To make it work as secure as possible I now have the following script to setup the environment:
mkdir -p /var/coredumps/ chown root:adm /var/coredumps/ chmod 772 /var/coredumps/ echo "kernel.core_pattern = /var/coredumps/core.%u.%e.%p" >> /etc/sysctrl.conf echo "fs.suid_dumpable = 2" >> /etc/sysctl.conf echo -e "*\t-\tcore\tunlimited" >> /etc/security/limits.conf echo -e "root\t-\tcore\tunlimited" >> /etc/security/limits.conf
Now all that's left to do is add ACL to /var/coredumps so users can only add files and don't modify nor read them ever again. The only downsize is that I would still have a problem with chroot'ed applications which would need a
bind mount or something like that.