让设置 suid 的程序也产生 coredump

最新推荐文章于 2024-09-29 13:19:26 发布

iteye_17143

最新推荐文章于 2024-09-29 13:19:26 发布

阅读量352

点赞数

分类专栏：网络编程文章标签： Security HTML

本文链接：https://blog.youkuaiyun.com/iteye_17143/article/details/81859644

版权

网络编程专栏收录该内容

42 篇文章

订阅专栏

本文探讨了Linux系统中SUID程序产生core dump文件的不同模式。默认情况下，改变了凭证的进程不会产生core dump，但可通过调整fs.suid_dumpable参数启用三种模式：传统模式、调试模式及安全模式。

摘要生成于 C知道，由 DeepSeek-R1 满血版支持，前往体验 >

被 suid 的程序要产生 coredump 文件，还需要额外的设置。

[url]http://www.linuxinsight.com/proc_sys_fs_suid_dumpable.html[/url]

[quote]
suid_dumpable
Submitted by admin on Thu, 2006-06-01 01:45

The value in this file determines whether core dump files are produced for set-user-ID or otherwise protected/tainted binaries. Three different integer values can be specified:

* 0 (default) - This provides the traditional behaviour. A core dump will not be produced for a process which has changed credentials (by calling seteuid(2), setgid(2), or similar, or by executing a set-user-ID or set-group-ID program) or whose binary does not have read permission enabled.
* 1 ("debug") - All processes dump core when possible. The core dump is owned by the file system user ID of the dumping process and no security is applied. This is intended for system debugging situations only. Ptrace is unchecked.
* 2 ("suidsafe") - Any binary which normally would not be dumped (see "0" above) is dumped readable by root only. This allows the user to remove the core dump file but not to read it. For security reasons core dumps in this mode will not overwrite one another or other files. This mode is appropriate when administrators are attempting to debug problems in a normal environment.
[/quote]