<html> <head> <base href="https://bugs.freedesktop.org/" /> </head> <body> <div> <a class="bz_bug_link bz_status_NEW " title="NEW - systemd-coredump can run elfutils as root" href="https://bugs.freedesktop.org/show_bug.cgi?id=87354#c6">Comment # 6</a> on <a class="bz_bug_link bz_status_NEW " title="NEW - systemd-coredump can run elfutils as root" href="https://bugs.freedesktop.org/show_bug.cgi?id=87354">bug 87354</a> from <a class="email" href="mailto:lennart@poettering.net" title="Lennart Poettering <lennart@poettering.net>"> Lennart Poettering</a> <pre>As a first step I have now changed the coredump tool to drop all caps before processing the coredump. <a href="http://cgit.freedesktop.org/systemd/systemd/commit/?id=f11943c53ec181829a821c6b27acf828bab71caa">http://cgit.freedesktop.org/systemd/systemd/commit/?id=f11943c53ec181829a821c6b27acf828bab71caa</a> We might want to take this a couple of steps further: * introduce a new user "systemd-coredump" or so, and if we process a coredump for root, drop privs to that user. There's one complexity about this though: ideally we'd make sure that the SCM_CREDENTIALS structure passed to journald for the coredump is the root user then, and not "systemd-coredump". * move the src/core/namespace.[ch] to /src/shared, and make use of it here, to protect the root directory and home, like we do for normals services. All that together should be a sufficiently good sandbox.</pre> </div> <hr> You are receiving this mail because: <ul> <li>You are the QA Contact for the bug.</li> <li>You are the assignee for the bug.</li> </ul> </body> </html>