MySQL Bugs: #21361: Patch: create coredumps on linux when --user or --group is used

Bug #21361	Patch: create coredumps on linux when --user or --group is used
Submitted:	31 Jul 2006 11:55	Modified:	5 Sep 2006 13:39
Reporter:	Michal Marek	Email Updates:
Status:	Duplicate	Impact on me:	None
Category:	MySQL Server	Severity:	S4 (Feature request)
Version:	5.0.22	OS:	Linux (Linux)
Assigned to:		CPU Architecture:	Any

Description:
mysqld doesn't dump core on Linux (don't know about other OSes) when the
--user or --group option is given. That's because setuid() or setgid()
disables coredumps for the process.

How to repeat:
mysqld_safe --user=mysql --core-file ...
killall -11 mysqld
# mysqld will say "writing coredump", but no core will appear in /var/lib/mysql/

Suggested fix:
Call prctl(PR_SET_DUMPABLE, 1) after setuid() to enable coredumps again.
I'll attach a patch.

patch to allow coredumps

Attachment: mysql-5.0.22-coredump.patch (text/x-patch), 1.19 KiB.

The call is indeed linux specific (introduced with kernel 2.4),
and given it's recent security implications i'd say it should 
not be used. 

Starting the server using the right user id right
away is not that much of an issue when core dumps are needed
and other settings like ulimit need to be tweaked, too ...

So, it is a feature request and, according to Hartmut, it is unlikely that it will be implemented.

> The call is indeed linux specific (introduced with kernel 2.4),
> and given it's recent security implications i'd say it should 
> not be used.

Which security implications? mysqld runs under a dedicated user ID,
so in fact only root will be able to signal it and read the
coredump. And the patch calls prctl() only if the --core-file option
is given, ie. when the user explicitly asks for a coredump.

prctl() security issues are false assumptions. mysqld does not have setuid bit on binary, it is setuid to non-privileged user, and kernel bugs are kernel bugs - mysqld is not required to do anything in order for them to be exploitable.

Duplicate of Bug#21723