7

I've noticed that some procs, such as bash, have their entire /proc/<pid>/ resources readable by the user who created that proc. However other procs, such as chrome or gnome-keyring-daemon, have most of their /proc/<pid>/ resources only accessible by root, despite the process itself being owned by the normal user and no suid being called.

I dug through the kernel a bit and found that the /proc/ stuff gets limited if a task lacks a 'dumpable' flag, however I'm having a hard time understanding under what scenarios a task becomes undumpable (other than the setuid case, which doesn't apply to chrome or gnome-keyring):

https://github.com/torvalds/linux/blob/164c09978cebebd8b5fc198e9243777dbaecdfa0/fs/proc/base.c#L1532

Anyone care to help me understand the underlying mechanism and the reasons for it?

Thanks!

Edit:

Found a good doc on why you wouldn't want to have your SSH agent (such as gnome-keyring-daemon) dumpable by your user. Still not sure how gnome-keyring-daemon is making itself undumpable.

https://github.com/torvalds/linux/blob/164c09978cebebd8b5fc198e9243777dbaecdfa0/Documentation/security/Yama.txt#L30

migrated from serverfault.com Jun 1 '14 at 8:42

This question came from our site for system and network administrators.

7

Linux has a system call, which will change the dumpable flag. Here is some example code, which I wrote several years ago:

#include <sys/prctl.h>
...
/* The last three arguments are just padding, because the
 * system call requires five arguments.
 */
prctl(PR_SET_DUMPABLE,1,42,42,42);

It may be that gnome-keyring-daemon deliberately set the dumpable flag to zero for security reasons.

  • Such a call should show up in strace, correct? All I'm seeing in there is a prctl to PR_SET_NAME. – alienth May 31 '14 at 13:18
  • On a side note, regarding your post from several years ago, I believe you can set the fs.suid_dumpable sysctl to 2 to allow setuid binaries to become dumpable. – alienth May 31 '14 at 13:33
  • 1
    The dumpable behaviour doesn't just apply to setuid binaries, but setcap binaries too. Try running getcap /usr/bin/gnome-keyring-daemon. Its probably got some file capabilities on it. – Matthew Ife May 31 '14 at 13:35
  • This is what getcap says on Ubuntu 12.04: /usr/bin/gnome-keyring-daemon = cap_ipc_lock+ep – kasperd May 31 '14 at 13:39
  • 1
    Then it has capabilities to lock memory and thus disables the dumpable flag. – Matthew Ife May 31 '14 at 13:42

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.