Home | History | Annotate | Line # | Download | only in kern
kern_core.c revision 1.27 
      1 /*	$NetBSD: kern_core.c,v 1.27 2019/11/10 14:20:50 pgoyette Exp $	*/
      2 
      3 /*
      4  * Copyright (c) 1982, 1986, 1989, 1991, 1993
      5  *	The Regents of the University of California.  All rights reserved.
      6  * (c) UNIX System Laboratories, Inc.
      7  * All or some portions of this file are derived from material licensed
      8  * to the University of California by American Telephone and Telegraph
      9  * Co. or Unix System Laboratories, Inc. and are reproduced herein with
     10  * the permission of UNIX System Laboratories, Inc.
     11  *
     12  * Redistribution and use in source and binary forms, with or without
     13  * modification, are permitted provided that the following conditions
     14  * are met:
     15  * 1. Redistributions of source code must retain the above copyright
     16  *    notice, this list of conditions and the following disclaimer.
     17  * 2. Redistributions in binary form must reproduce the above copyright
     18  *    notice, this list of conditions and the following disclaimer in the
     19  *    documentation and/or other materials provided with the distribution.
     20  * 3. Neither the name of the University nor the names of its contributors
     21  *    may be used to endorse or promote products derived from this software
     22  *    without specific prior written permission.
     23  *
     24  * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
     25  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
     26  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
     27  * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
     28  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
     29  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
     30  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
     31  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
     32  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
     33  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
     34  * SUCH DAMAGE.
     35  *
     36  *	@(#)kern_sig.c	8.14 (Berkeley) 5/14/95
     37  */
     38 
     39 #include <sys/cdefs.h>
     40 __KERNEL_RCSID(0, "$NetBSD: kern_core.c,v 1.27 2019/11/10 14:20:50 pgoyette Exp $");
     41 
     42 #include <sys/param.h>
     43 #include <sys/vnode.h>
     44 #include <sys/namei.h>
     45 #include <sys/acct.h>
     46 #include <sys/file.h>
     47 #include <sys/stat.h>
     48 #include <sys/proc.h>
     49 #include <sys/exec.h>
     50 #include <sys/filedesc.h>
     51 #include <sys/kauth.h>
     52 #include <sys/module.h>
     53 #include <sys/compat_stub.h>
     54 
     55 MODULE(MODULE_CLASS_MISC, coredump, NULL);
     56 
     57 struct coredump_iostate {
     58 	struct lwp *io_lwp;
     59 	struct vnode *io_vp;
     60 	kauth_cred_t io_cred;
     61 	off_t io_offset;
     62 };
     63 
     64 static int	coredump(struct lwp *, const char *);
     65 static int	coredump_buildname(struct proc *, char *, const char *, size_t);
     66 
     67 static int
     68 coredump_modcmd(modcmd_t cmd, void *arg)
     69 {
     70 
     71 	switch (cmd) {
     72 	case MODULE_CMD_INIT:
     73 		MODULE_HOOK_SET(coredump_hook, "coredump", coredump);
     74 		return 0;
     75 	case MODULE_CMD_FINI:
     76 		/*
     77 		 * In theory we don't need to UNSET this, as the various
     78 		 * exec formats depend on this module.  If this module has
     79 		 * no references, and so can be unloaded, no user programs
     80 		 * can be running and so nothing can call *coredump_vec.
     81 		 */
     82 
     83 		MODULE_HOOK_UNSET(coredump_hook);
     84 		return 0;
     85 	default:
     86 		return ENOTTY;
     87 	}
     88 }
     89 
     90 /*
     91  * Dump core, into a file named "progname.core" or "core" (depending on the
     92  * value of shortcorename), unless the process was setuid/setgid.
     93  */
     94 static int
     95 coredump(struct lwp *l, const char *pattern)
     96 {
     97 	struct vnode		*vp;
     98 	struct proc		*p;
     99 	struct vmspace		*vm;
    100 	kauth_cred_t		cred;
    101 	struct pathbuf		*pb;
    102 	struct nameidata	nd;
    103 	struct vattr		vattr;
    104 	struct coredump_iostate	io;
    105 	struct plimit		*lim;
    106 	int			error, error1;
    107 	char			*name, *lastslash;
    108 
    109 	name = PNBUF_GET();
    110 
    111 	p = l->l_proc;
    112 	vm = p->p_vmspace;
    113 
    114 	mutex_enter(proc_lock);		/* p_session */
    115 	mutex_enter(p->p_lock);
    116 
    117 	/*
    118 	 * Refuse to core if the data + stack + user size is larger than
    119 	 * the core dump limit.  XXX THIS IS WRONG, because of mapped
    120 	 * data.
    121 	 */
    122 	if (USPACE + ctob(vm->vm_dsize + vm->vm_ssize) >=
    123 	    p->p_rlimit[RLIMIT_CORE].rlim_cur) {
    124 		error = EFBIG;		/* better error code? */
    125 		mutex_exit(p->p_lock);
    126 		mutex_exit(proc_lock);
    127 		goto done;
    128 	}
    129 
    130 	/*
    131 	 * It may well not be curproc, so grab a reference to its current
    132 	 * credentials.
    133 	 */
    134 	kauth_cred_hold(p->p_cred);
    135 	cred = p->p_cred;
    136 
    137 	/*
    138 	 * Make sure the process has not set-id, to prevent data leaks,
    139 	 * unless it was specifically requested to allow set-id coredumps.
    140 	 */
    141 	if (p->p_flag & PK_SUGID) {
    142 		if (!security_setidcore_dump) {
    143 			error = EPERM;
    144 			mutex_exit(p->p_lock);
    145 			mutex_exit(proc_lock);
    146 			goto done;
    147 		}
    148 		pattern = security_setidcore_path;
    149 	}
    150 
    151 	/* Lock, as p_limit and pl_corename might change. */
    152 	lim = p->p_limit;
    153 	mutex_enter(&lim->pl_lock);
    154 	if (pattern == NULL) {
    155 		pattern = lim->pl_corename;
    156 	}
    157 	error = coredump_buildname(p, name, pattern, MAXPATHLEN);
    158 	mutex_exit(&lim->pl_lock);
    159 
    160 	if (error) {
    161 		mutex_exit(p->p_lock);
    162 		mutex_exit(proc_lock);
    163 		goto done;
    164 	}
    165 
    166 	/*
    167 	 * On a simple filename, see if the filesystem allow us to write
    168 	 * core dumps there.
    169 	 */
    170 	lastslash = strrchr(name, '/');
    171 	if (!lastslash) {
    172 		vp = p->p_cwdi->cwdi_cdir;
    173 		if (vp->v_mount == NULL ||
    174 		    (vp->v_mount->mnt_flag & MNT_NOCOREDUMP) != 0)
    175 			error = EPERM;
    176 	}
    177 
    178 	mutex_exit(p->p_lock);
    179 	mutex_exit(proc_lock);
    180 	if (error)
    181 		goto done;
    182 
    183 	/*
    184 	 * On a complex filename, see if the filesystem allow us to write
    185 	 * core dumps there.
    186 	 *
    187 	 * XXX: We should have an API that avoids double lookups
    188 	 */
    189 	if (lastslash) {
    190 		char c[2];
    191 
    192 		if (lastslash - name >= MAXPATHLEN - 2) {
    193 			error = EPERM;
    194 			goto done;
    195 		}
    196 
    197 		c[0] = lastslash[1];
    198 		c[1] = lastslash[2];
    199 		lastslash[1] = '.';
    200 		lastslash[2] = '\0';
    201 		error = namei_simple_kernel(name, NSM_FOLLOW_NOEMULROOT, &vp);
    202 		if (error)
    203 			goto done;
    204 		if (vp->v_mount == NULL ||
    205 		    (vp->v_mount->mnt_flag & MNT_NOCOREDUMP) != 0)
    206 			error = EPERM;
    207 		vrele(vp);
    208 		if (error)
    209 			goto done;
    210 		lastslash[1] = c[0];
    211 		lastslash[2] = c[1];
    212 	}
    213 
    214 	pb = pathbuf_create(name);
    215 	if (pb == NULL) {
    216 		error = ENOMEM;
    217 		goto done;
    218 	}
    219 	NDINIT(&nd, LOOKUP, NOFOLLOW, pb);
    220 	if ((error = vn_open(&nd, O_CREAT | O_NOFOLLOW | FWRITE,
    221 	    S_IRUSR | S_IWUSR)) != 0) {
    222 		pathbuf_destroy(pb);
    223 		goto done;
    224 	}
    225 	vp = nd.ni_vp;
    226 	pathbuf_destroy(pb);
    227 
    228 	/*
    229 	 * Don't dump to:
    230 	 * 	- non-regular files
    231 	 * 	- files with links
    232 	 * 	- files we don't own
    233 	 */
    234 	if (vp->v_type != VREG ||
    235 	    VOP_GETATTR(vp, &vattr, cred) || vattr.va_nlink != 1 ||
    236 	    vattr.va_uid != kauth_cred_geteuid(cred)) {
    237 		error = EACCES;
    238 		goto out;
    239 	}
    240 	vattr_null(&vattr);
    241 	vattr.va_size = 0;
    242 
    243 	if ((p->p_flag & PK_SUGID) && security_setidcore_dump) {
    244 		vattr.va_uid = security_setidcore_owner;
    245 		vattr.va_gid = security_setidcore_group;
    246 		vattr.va_mode = security_setidcore_mode;
    247 	}
    248 
    249 	VOP_SETATTR(vp, &vattr, cred);
    250 	p->p_acflag |= ACORE;
    251 
    252 	io.io_lwp = l;
    253 	io.io_vp = vp;
    254 	io.io_cred = cred;
    255 	io.io_offset = 0;
    256 
    257 	/* Now dump the actual core file. */
    258 	error = (*p->p_execsw->es_coredump)(l, &io);
    259  out:
    260 	VOP_UNLOCK(vp);
    261 	error1 = vn_close(vp, FWRITE, cred);
    262 	if (error == 0)
    263 		error = error1;
    264 done:
    265 	if (name != NULL)
    266 		PNBUF_PUT(name);
    267 	return error;
    268 }
    269 
    270 static int
    271 coredump_buildname(struct proc *p, char *dst, const char *src, size_t len)
    272 {
    273 	const char	*s;
    274 	char		*d, *end;
    275 	int		i;
    276 
    277 	KASSERT(mutex_owned(proc_lock));
    278 
    279 	for (s = src, d = dst, end = d + len; *s != '\0'; s++) {
    280 		if (*s == '%') {
    281 			switch (*(s + 1)) {
    282 			case 'n':
    283 				i = snprintf(d, end - d, "%s", p->p_comm);
    284 				break;
    285 			case 'p':
    286 				i = snprintf(d, end - d, "%d", p->p_pid);
    287 				break;
    288 			case 'u':
    289 				i = snprintf(d, end - d, "%.*s",
    290 				    (int)sizeof p->p_pgrp->pg_session->s_login,
    291 				    p->p_pgrp->pg_session->s_login);
    292 				break;
    293 			case 't':
    294 				i = snprintf(d, end - d, "%lld",
    295 				    (long long)p->p_stats->p_start.tv_sec);
    296 				break;
    297 			default:
    298 				goto copy;
    299 			}
    300 			d += i;
    301 			s++;
    302 		} else {
    303  copy:			*d = *s;
    304 			d++;
    305 		}
    306 		if (d >= end)
    307 			return (ENAMETOOLONG);
    308 	}
    309 	*d = '\0';
    310 	return 0;
    311 }
    312 
    313 int
    314 coredump_write(struct coredump_iostate *io, enum uio_seg segflg,
    315     const void *data, size_t len)
    316 {
    317 	int error;
    318 
    319 	error = vn_rdwr(UIO_WRITE, io->io_vp, __UNCONST(data), len,
    320 	    io->io_offset, segflg,
    321 	    IO_NODELOCKED|IO_UNIT, io->io_cred, NULL,
    322 	    segflg == UIO_USERSPACE ? io->io_lwp : NULL);
    323 	if (error) {
    324 		printf("pid %d (%s): %s write of %zu@%p at %lld failed: %d\n",
    325 		    io->io_lwp->l_proc->p_pid, io->io_lwp->l_proc->p_comm,
    326 		    segflg == UIO_USERSPACE ? "user" : "system",
    327 		    len, data, (long long) io->io_offset, error);
    328 		return (error);
    329 	}
    330 
    331 	io->io_offset += len;
    332 	return (0);
    333 }
    334 
    335 off_t
    336 coredump_offset(struct coredump_iostate *io)
    337 {
    338 	return io->io_offset;
    339 }
    340