Kernel+LibC: Introduce a "dumpable" flag for processes

This new flag controls two things:
- Whether the kernel will generate core dumps for the process
- Whether the EUID:EGID should own the process's files in /proc

Processes are automatically made non-dumpable when their EUID or EGID is
changed, either via syscalls that specifically modify those ID's, or via
sys$execve(), when a set-uid or set-gid program is executed.

A process can change its own dumpable flag at any time by calling the
new sys$prctl(PR_SET_DUMPABLE) syscall.

Fixes SerenityOS#4504.

Kernel/API/Syscall.h

@@ -195,7 +195,8 @@ namespace Kernel {
  S(set_process_name) \
  S(disown) \
  S(adjtime) \
- S(allocate_tls)
+ S(allocate_tls) \
+ S(prctl)
 
 namespace Syscall {
 

Kernel/CMakeLists.txt

@@ -136,6 +136,7 @@ set(KERNEL_SOURCES
  Syscalls/perf_event.cpp
  Syscalls/pipe.cpp
  Syscalls/pledge.cpp
+ Syscalls/prctl.cpp
  Syscalls/process.cpp
  Syscalls/profiling.cpp
  Syscalls/ptrace.cpp

Kernel/CoreDump.cpp

@@ -42,6 +42,11 @@ namespace Kernel {
 
 OwnPtr<CoreDump> CoreDump::create(Process& process, const String& output_path)
 {
+ if (!process.is_dumpable()) {
+ dbgln("Refusing to generate CoreDump for non-dumpable process {}", process.pid().value());
+ return nullptr;
+ }
+
  auto fd = create_target_file(process, output_path);
  if (!fd)
  return nullptr;

Kernel/FileSystem/ProcFS.cpp

@@ -879,6 +879,7 @@ static OwnPtr<KBuffer> procfs$all(InodeIdentifier)
  process_object.add("amount_purgeable_volatile", process.amount_purgeable_volatile());
  process_object.add("amount_purgeable_nonvolatile", process.amount_purgeable_nonvolatile());
  process_object.add("icon_id", process.icon_id());
+ process_object.add("dumpable", process.is_dumpable());
  auto thread_array = process_object.add_array("threads");
  process.for_each_thread([&](const Thread& thread) {
  auto thread_object = thread_array.add_object();
@@ -1137,22 +1138,20 @@ InodeMetadata ProcFSInode::metadata() const
  if (is_process_related_file(identifier())) {
  ProcessID pid = to_pid(identifier());
  auto process = Process::from_pid(pid);
- if (process) {
+ if (process && process->is_dumpable()) {
  metadata.uid = process->euid();
  metadata.gid = process->egid();
  } else {
- // TODO: How to handle this?
  metadata.uid = 0;
  metadata.gid = 0;
  }
  } else if (is_thread_related_file(identifier())) {
  ThreadID tid = to_tid(identifier());
  auto thread = Thread::from_tid(tid);
- if (thread) {
+ if (thread && thread->process().is_dumpable()) {
  metadata.uid = thread->process().euid();
  metadata.gid = thread->process().egid();
  } else {
- // TODO: How to handle this?
  metadata.uid = 0;
  metadata.gid = 0;
  }

Kernel/Process.h

@@ -192,6 +192,9 @@ class Process
  gid_t sgid() const { return m_sgid; }
  ProcessID ppid() const { return m_ppid; }
 
+ bool is_dumpable() const { return m_dumpable; }
+ void set_dumpable(bool dumpable) { m_dumpable = dumpable; }
+
  ThreadID exec_tid() const { return m_exec_tid; }
 
  mode_t umask() const { return m_umask; }
@@ -371,6 +374,7 @@ class Process
  long sys$sysconf(int name);
  int sys$disown(ProcessID);
  void* sys$allocate_tls(size_t);
+ int sys$prctl(int option, FlatPtr arg1, FlatPtr arg2);
 
  template<bool sockname, typename Params>
  int get_sock_or_peer_name(const Params&);
@@ -627,6 +631,8 @@ class Process
  ProcessID m_ppid { 0 };
  mode_t m_umask { 022 };
 
+ bool m_dumpable { true };
+
  Vector<gid_t> m_extra_gids;
 
  WeakPtr<Region> m_master_tls_region;

Kernel/Ptrace.cpp

@@ -59,6 +59,9 @@ KResultOr<u32> handle_syscall(const Kernel::Syscall::SC_ptrace_params& params, P
  || (peer->process().uid() != peer->process().euid())) // Disallow tracing setuid processes
  return KResult(-EACCES);
 
+ if (!peer->process().is_dumpable())
+ return KResult(-EACCES);
+
  auto& peer_process = peer->process();
  if (params.request == PT_ATTACH) {
  if (peer_process.tracer()) {

Kernel/Syscalls/execve.cpp

@@ -363,19 +363,25 @@ int Process::do_exec(NonnullRefPtr<FileDescription> main_program_description, Ve
  auto old_suid = m_suid;
  auto old_egid = m_egid;
  auto old_sgid = m_sgid;
+ auto was_dumpable = is_dumpable();
 
  ArmedScopeGuard cred_restore_guard = [&] {
  m_euid = old_euid;
  m_suid = old_suid;
  m_egid = old_egid;
  m_sgid = old_sgid;
+ set_dumpable(was_dumpable);
  };
 
  if (!(main_program_description->custody()->mount_flags() & MS_NOSUID)) {
- if (main_program_metadata.is_setuid())
+ if (main_program_metadata.is_setuid()) {
+ set_dumpable(false);
  m_euid = m_suid = main_program_metadata.uid;
- if (main_program_metadata.is_setgid())
+ }
+ if (main_program_metadata.is_setgid()) {
+ set_dumpable(false);
  m_egid = m_sgid = main_program_metadata.gid;
+ }
  }
 
  auto load_result_or_error = load(main_program_description, interpreter_description);

Kernel/Syscalls/prctl.cpp

@@ -0,0 +1,46 @@
+/*
+ * Copyright (c) 2020, Andreas Kling <[email protected]>
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright notice, this
+ * list of conditions and the following disclaimer.
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright notice,
+ * this list of conditions and the following disclaimer in the documentation
+ * and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+ * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+ * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+ * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include <Kernel/Process.h>
+#include <LibC/sys/prctl_numbers.h>
+
+namespace Kernel {
+
+int Process::sys$prctl(int option, FlatPtr arg1, [[maybe_unused]] FlatPtr arg2)
+{
+ switch (option) {
+ case PR_GET_DUMPABLE:
+ return is_dumpable();
+ case PR_SET_DUMPABLE:
+ set_dumpable(arg1);
+ return 0;
+ default:
+ return -EINVAL;
+ }
+ return 0;
+}
+
+}

Kernel/Syscalls/setuid.cpp

@@ -35,6 +35,8 @@ int Process::sys$seteuid(uid_t euid)
  if (euid != m_uid && euid != m_suid && !is_superuser())
  return -EPERM;
 
+ if (m_euid != euid)
+ set_dumpable(false);
  m_euid = euid;
  return 0;
 }
@@ -46,6 +48,9 @@ int Process::sys$setegid(gid_t egid)
  if (egid != m_gid && egid != m_sgid && !is_superuser())
  return -EPERM;
 
+ if (m_egid != egid)
+ set_dumpable(false);
+
  m_egid = egid;
  return 0;
 }
@@ -57,6 +62,9 @@ int Process::sys$setuid(uid_t uid)
  if (uid != m_uid && uid != m_euid && !is_superuser())
  return -EPERM;
 
+ if (m_euid != uid)
+ set_dumpable(false);
+
  m_uid = uid;
  m_euid = uid;
  m_suid = uid;
@@ -70,6 +78,9 @@ int Process::sys$setgid(gid_t gid)
  if (gid != m_gid && gid != m_egid && !is_superuser())
  return -EPERM;
 
+ if (m_egid != gid)
+ set_dumpable(false);
+
  m_gid = gid;
  m_egid = gid;
  m_sgid = gid;
@@ -91,6 +102,9 @@ int Process::sys$setresuid(uid_t ruid, uid_t euid, uid_t suid)
  if ((!ok(ruid) || !ok(euid) || !ok(suid)) && !is_superuser())
  return -EPERM;
 
+ if (m_euid != euid)
+ set_dumpable(false);
+
  m_uid = ruid;
  m_euid = euid;
  m_suid = suid;
@@ -112,6 +126,9 @@ int Process::sys$setresgid(gid_t rgid, gid_t egid, gid_t sgid)
  if ((!ok(rgid) || !ok(egid) || !ok(sgid)) && !is_superuser())
  return -EPERM;
 
+ if (m_egid != egid)
+ set_dumpable(false);
+
  m_gid = rgid;
  m_egid = egid;
  m_sgid = sgid;

Libraries/LibC/CMakeLists.txt

@@ -31,6 +31,7 @@ set(LIBC_SOURCES
  string.cpp
  strings.cpp
  syslog.cpp
+ sys/prctl.cpp
  sys/ptrace.cpp
  sys/select.cpp
  sys/socket.cpp

Libraries/LibC/sys/prctl.cpp

@@ -0,0 +1,40 @@
+/*
+ * Copyright (c) 2020, Andreas Kling <[email protected]>
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright notice, this
+ * list of conditions and the following disclaimer.
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright notice,
+ * this list of conditions and the following disclaimer in the documentation
+ * and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+ * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+ * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+ * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include <Kernel/API/Syscall.h>
+#include <errno.h>
+#include <stdarg.h>
+#include <stdio.h>
+#include <sys/prctl.h>
+
+extern "C" {
+
+int prctl(int option, uintptr_t arg1, uintptr_t arg2)
+{
+ int rc = syscall(SC_prctl, option, arg1, arg2);
+ __RETURN_WITH_ERRNO(rc, rc, -1);
+}
+}

Libraries/LibC/sys/prctl.h

@@ -0,0 +1,37 @@
+/*
+ * Copyright (c) 2020, Andreas Kling <[email protected]>
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright notice, this
+ * list of conditions and the following disclaimer.
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright notice,
+ * this list of conditions and the following disclaimer in the documentation
+ * and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+ * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+ * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+ * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#include <sys/cdefs.h>
+#include <sys/prctl_numbers.h>
+#include <sys/types.h>
+
+__BEGIN_DECLS
+
+int prctl(int option, uintptr_t arg1, uintptr_t arg2);
+
+__END_DECLS

Libraries/LibC/sys/prctl_numbers.h

@@ -0,0 +1,30 @@
+/*
+ * Copyright (c) 2020, Andreas Kling <[email protected]>
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright notice, this
+ * list of conditions and the following disclaimer.
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright notice,
+ * this list of conditions and the following disclaimer in the documentation
+ * and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+ * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+ * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+ * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#define PR_SET_DUMPABLE 1
+#define PR_GET_DUMPABLE 2