From owner-svn-src-head@FreeBSD.ORG Tue Mar 24 02:35:47 2015 Return-Path: Delivered-To: svn-src-head@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:1900:2254:206a::19:1]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by hub.freebsd.org (Postfix) with ESMTPS id 86330D09; Tue, 24 Mar 2015 02:35:47 +0000 (UTC) Received: from st11p02mm-asmtp001.mac.com (st11p02mm-asmtp001.mac.com [17.172.220.236]) (using TLSv1.2 with cipher DHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (Client did not present a certificate) by mx1.freebsd.org (Postfix) with ESMTPS id 58F95658; Tue, 24 Mar 2015 02:35:47 +0000 (UTC) Received: from fukuyama.hsd1.ca.comcast.net (unknown [73.162.13.215]) by st11p02mm-asmtp001.mac.com (Oracle Communications Messaging Server 7.0.5.35.0 64bit (built Dec 4 2014)) with ESMTPSA id <0NLP00LO837I0E40@st11p02mm-asmtp001.mac.com>; Tue, 24 Mar 2015 02:35:45 +0000 (GMT) X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10432:5.13.68,1.0.33,0.0.0000 definitions=2015-03-23_05:2015-03-23,2015-03-23,1970-01-01 signatures=0 X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 spamscore=0 suspectscore=0 phishscore=0 adultscore=0 bulkscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=7.0.1-1412110000 definitions=main-1503240024 Content-type: text/plain; charset=us-ascii MIME-version: 1.0 (Mac OS X Mail 8.2 \(2070.6\)) Subject: Re: svn commit: r280410 - head/sys/kern From: Rui Paulo In-reply-to: <5510CB0E.5010208@FreeBSD.org> Date: Mon, 23 Mar 2015 19:35:42 -0700 Content-transfer-encoding: quoted-printable Message-id: <29715C14-0AC2-43A2-A718-E89AC3C57AC0@me.com> References: <201503240217.t2O2HHgU052651@svn.freebsd.org> <5510CB0E.5010208@FreeBSD.org> To: Bryan Drewery X-Mailer: Apple Mail (2.2070.6) Cc: svn-src-head@freebsd.org, svn-src-all@freebsd.org, src-committers@freebsd.org, Rui Paulo X-BeenThere: svn-src-head@freebsd.org X-Mailman-Version: 2.1.18-1 Precedence: list List-Id: SVN commit messages for the src tree for head/-current List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 24 Mar 2015 02:35:47 -0000 On Mar 23, 2015, at 19:25, Bryan Drewery wrote: >=20 > On 3/23/15 9:17 PM, Rui Paulo wrote: >> Author: rpaulo >> Date: Tue Mar 24 02:17:17 2015 >> New Revision: 280410 >> URL: https://svnweb.freebsd.org/changeset/base/280410 >>=20 >> Log: >> Disable coredump_devctl because it could lead to leaking paths to >> jails. >>=20 >> Modified: >> head/sys/kern/kern_sig.c >>=20 >> Modified: head/sys/kern/kern_sig.c >> = =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D >> --- head/sys/kern/kern_sig.c Tue Mar 24 01:32:46 2015 = (r280409) >> +++ head/sys/kern/kern_sig.c Tue Mar 24 02:17:17 2015 = (r280410) >> @@ -180,7 +180,7 @@ static int set_core_nodump_flag =3D 0; >> SYSCTL_INT(_kern, OID_AUTO, nodump_coredump, CTLFLAG_RW, = &set_core_nodump_flag, >> 0, "Enable setting the NODUMP flag on coredump files"); >>=20 >> -static int coredump_devctl =3D 1; >> +static int coredump_devctl =3D 0; >> SYSCTL_INT(_kern, OID_AUTO, coredump_devctl, CTLFLAG_RW, = &coredump_devctl, >> 0, "Generate a devctl notification when processes coredump"); >>=20 >>=20 >=20 > If there is a security concern about this feature I think more needs = to be done than just flipping the default. It could easily be forgotten = about and make a release. Sure, but to be honest there are already sysctls that make your system = insecure and we've been making releases with them for many years. -- Rui Paulo