7

I've noticed that some procs, such as bash, have their entire /proc/<pid>/ resources readable by the user who created that proc. However other procs, such as chrome or gnome-keyring-daemon, have most of their /proc/<pid>/ resources only accessible by root, despite the process itself being owned by the normal user and no suid being called.

I dug through the kernel a bit and found that the /proc/ stuff gets limited if a task lacks a 'dumpable' flag, however I'm having a hard time understanding under what scenarios a task becomes undumpable (other than the setuid case, which doesn't apply to chrome or gnome-keyring):

https://github.com/torvalds/linux/blob/164c09978cebebd8b5fc198e9243777dbaecdfa0/fs/proc/base.c#L1532

Anyone care to help me understand the underlying mechanism and the reasons for it?

Thanks!

Edit:

Found a good doc on why you wouldn't want to have your SSH agent (such as gnome-keyring-daemon) dumpable by your user. Still not sure how gnome-keyring-daemon is making itself undumpable.

https://github.com/torvalds/linux/blob/164c09978cebebd8b5fc198e9243777dbaecdfa0/Documentation/security/Yama.txt#L30

1 Answer 1

Reset to default
7

Linux has a system call, which will change the dumpable flag. Here is some example code, which I wrote several years ago:

#include <sys/prctl.h>
...
/* The last three arguments are just padding, because the
 * system call requires five arguments.
 */
prctl(PR_SET_DUMPABLE,1,42,42,42);

It may be that gnome-keyring-daemon deliberately set the dumpable flag to zero for security reasons.

5
  • Such a call should show up in strace, correct? All I'm seeing in there is a prctl to PR_SET_NAME.
    – alienth
    May 31, 2014 at 13:18
  • On a side note, regarding your post from several years ago, I believe you can set the fs.suid_dumpable sysctl to 2 to allow setuid binaries to become dumpable.
    – alienth
    May 31, 2014 at 13:33
  • 1
    The dumpable behaviour doesn't just apply to setuid binaries, but setcap binaries too. Try running getcap /usr/bin/gnome-keyring-daemon. Its probably got some file capabilities on it.
    – Matthew Ife
    May 31, 2014 at 13:35
  • This is what getcap says on Ubuntu 12.04: /usr/bin/gnome-keyring-daemon = cap_ipc_lock+ep
    – kasperd
    May 31, 2014 at 13:39
  • 1
    Then it has capabilities to lock memory and thus disables the dumpable flag.
    – Matthew Ife
    May 31, 2014 at 13:42

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .