From 604500ead1762a926b1d68af98737f27f4173adf Mon Sep 17 00:00:00 2001 From: Daniel Kahn Gillmor Date: Tue, 11 Aug 2015 20:28:26 -0400 Subject: [PATCH] Avoid simple memory dumps via ptrace This avoids needing to setgid gpg-agent. It probably doesn't defend against all possible attacks, but it defends against one specific (and easy) one. If there are other protections we should do them too. This will make it slightly harder to debug the agent because the normal user won't be able to attach gdb to it directly while it runs. The remaining options for debugging are: * launch the agent from gdb directly * connect gdb to a running agent as the superuser Upstream bug: https://bugs.gnupg.org/gnupg/issue1211 Gbp-Pq: Topic block-ptrace-on-agent Gbp-Pq: Name 0002-Avoid-simple-memory-dumps-via-ptrace.patch --- agent/gpg-agent.c | 8 ++++++++ configure.ac | 1 + 2 files changed, 9 insertions(+) diff --git a/agent/gpg-agent.c b/agent/gpg-agent.c index c0208cc..31bf337 100644 --- a/agent/gpg-agent.c +++ b/agent/gpg-agent.c @@ -48,6 +48,9 @@ # include #endif #include +#ifdef HAVE_PRCTL +# include +#endif #define GNUPG_COMMON_NEED_AFLOCAL #include "agent.h" @@ -949,6 +952,11 @@ main (int argc, char **argv ) early_system_init (); +#if defined(HAVE_PRCTL) && defined(PR_SET_DUMPABLE) + /* Disable ptrace on Linux without sgid bit */ + prctl(PR_SET_DUMPABLE, 0); +#endif + /* Before we do anything else we save the list of currently open file descriptors and the signal mask. This info is required to do the exec call properly. We don't need it on Windows. */ diff --git a/configure.ac b/configure.ac index f929cb6..f2b6a70 100644 --- a/configure.ac +++ b/configure.ac @@ -1335,6 +1335,7 @@ AC_CHECK_FUNCS([strerror strlwr tcgetattr mmap canonicalize_file_name]) AC_CHECK_FUNCS([strcasecmp strncasecmp ctermid times gmtime_r strtoull]) AC_CHECK_FUNCS([setenv unsetenv fcntl ftruncate inet_ntop]) AC_CHECK_FUNCS([canonicalize_file_name]) +AC_CHECK_FUNCS([prctl]) AC_CHECK_FUNCS([gettimeofday getrusage getrlimit setrlimit clock_gettime]) AC_CHECK_FUNCS([atexit raise getpagesize strftime nl_langinfo setlocale]) AC_CHECK_FUNCS([waitpid wait4 sigaction sigprocmask pipe getaddrinfo]) -- 2.30.2