From owner-freebsd-security  Thu Feb 20 04:01:14 1997
Return-Path: <owner-security>
Received: (from root@localhost)
          by freefall.freebsd.org (8.8.5/8.8.5) id EAA08325
          for security-outgoing; Thu, 20 Feb 1997 04:01:14 -0800 (PST)
Received: from root.com (implode.root.com [198.145.90.17])
          by freefall.freebsd.org (8.8.5/8.8.5) with ESMTP id EAA08317
          for <security@freebsd.org>; Thu, 20 Feb 1997 04:01:10 -0800 (PST)
Received: from localhost (localhost [127.0.0.1]) by root.com (8.8.5/8.6.5) with SMTP id EAA25095; Thu, 20 Feb 1997 04:01:27 -0800 (PST)
Message-Id: <199702201201.EAA25095@root.com>
X-Authentication-Warning: implode.root.com: localhost [127.0.0.1] didn't use HELO protocol
To: Andrew Kosyakov <caseq@magrathea.chance.ru>
cc: imp@village.org (Warner Losh), marcs@znep.com, security@freebsd.org
Subject: Re: Coredumps and setuids .. interesting.. 
In-reply-to: Your message of "Thu, 20 Feb 1997 14:31:06 +0300."
             <199702201131.OAA14947@magrathea.chance.ru> 
From: David Greenman <dg@root.com>
Reply-To: dg@root.com
Date: Thu, 20 Feb 1997 04:01:27 -0800
Sender: owner-security@freebsd.org
X-Loop: FreeBSD.org
Precedence: bulk

>And I'd like to ask again: is there an official patch for 2.1.* to disable
>P_SUGID process to dump core? Many people can't afford to upgrade the whole
>OS on their production machines :-(

   The patch is attached.

-DG

David Greenman
Core-team/Principal Architect, The FreeBSD Project

Index: sys/kern/kern_exec.c
===================================================================
RCS file: /home/ncvs/src/sys/kern/kern_exec.c,v
retrieving revision 1.21.4.6
diff -c -r1.21.4.6 kern_exec.c
*** kern_exec.c	1996/06/04 02:11:37	1.21.4.6
--- kern_exec.c	1997/02/19 18:13:53
***************
*** 259,265 ****
  			p->p_ucred->cr_groups[0] = attr.va_gid;
  		p->p_flag |= P_SUGID;
  	} else {
! 		p->p_flag &= ~P_SUGID;
  	}
  
  	/*
--- 259,267 ----
  			p->p_ucred->cr_groups[0] = attr.va_gid;
  		p->p_flag |= P_SUGID;
  	} else {
! 	        if (p->p_ucred->cr_uid == p->p_cred->p_ruid &&
! 		    p->p_ucred->cr_gid == p->p_cred->p_rgid)
! 			p->p_flag &= ~P_SUGID;
  	}
  
  	/*
Index: sys/kern/kern_fork.c
===================================================================
RCS file: /home/ncvs/src/sys/kern/kern_fork.c,v
retrieving revision 1.12.4.2
retrieving revision 1.12.4.3
diff -c -r1.12.4.2 -r1.12.4.3
*** kern_fork.c	1996/05/02 12:09:04	1.12.4.2
--- kern_fork.c	1997/02/17 10:58:02	1.12.4.3
***************
*** 252,257 ****
--- 252,261 ----
  		p2->p_limit->p_refcnt++;
  	}
  
+ 	/*
+ 	 * Preserve some flags in subprocess.
+ 	 */
+ 	p2->p_flag |= p1->p_flag & P_SUGID;
  	if (p1->p_session->s_ttyvp != NULL && p1->p_flag & P_CONTROLT)
  		p2->p_flag |= P_CONTROLT;
  	if (isvfork)