[PATCH] sanlock: configuring the core dump output

[Federico Simoncelli]

All the setrlimit calls have been moved to a new setup_limits function
that is called regardless the presence of the -U and -G options.
The new RLIMIT_CORE limit is set to allow the core dump to be written
in case of a crash (for more details: man core).

Signed-off-by: Federico Simoncelli <fsimonce(a)redhat.com&gt;
---
 src/main.c |   42 ++++++++++++++++++++++++++++++------------
 1 files changed, 30 insertions(+), 12 deletions(-)

diff --git a/src/main.c b/src/main.c
index 552641e..a7922b5 100644
--- a/src/main.c
+++ b/src/main.c
@@ -24,6 +24,7 @@
 #include <pwd.h>
 #include <grp.h>
 #include <sys/types.h>
+#include <sys/prctl.h>
 #include <sys/wait.h>
 #include <sys/stat.h>
 #include <sys/socket.h>
@@ -1329,19 +1330,10 @@ static void setup_host_name(void)
 		 uuid, name.nodename);
 }
 
-static void setup_groups(void)
+static void setup_limits(void)
 {
-	int rv, i, j, h;
-	int pngroups, sngroups, ngroups_max;
-	gid_t *pgroup, *sgroup;
-	struct rlimit rlim;
-
-	if (!com.uname || !com.gname)
-		return;
-
-	/* before switching to a different user/group we must configure
-	   the limits for memlock and rtprio */
-	rlim.rlim_cur = rlim.rlim_max= -1;
+	int rv;
+	struct rlimit rlim = { .rlim_cur = -1, .rlim_max= -1 };
 
 	rv = setrlimit(RLIMIT_MEMLOCK, &rlim);
 	if (rv < 0) {
@@ -1355,6 +1347,22 @@ static void setup_groups(void)
 		exit(EXIT_FAILURE);
 	}
 
+	rv = setrlimit(RLIMIT_CORE, &rlim);
+	if (rv < 0) {
+		log_error("cannot set the limits for core dumps %i", errno);
+		exit(EXIT_FAILURE);
+	}
+}
+
+static void setup_groups(void)
+{
+	int rv, i, j, h;
+	int pngroups, sngroups, ngroups_max;
+	gid_t *pgroup, *sgroup;
+
+	if (!com.uname || !com.gname)
+		return;
+
 	ngroups_max = sysconf(_SC_NGROUPS_MAX);
 	if (ngroups_max < 0) {
 		log_error("cannot get the max number of groups %i", errno);
@@ -1418,6 +1426,15 @@ static void setup_groups(void)
 		log_error("cannot set user id to %i errno %i", com.uid, errno);
 	}
 
+	/* When a program is owned by a user (group) other than the real user
+	 * (group) ID of the process, the PR_SET_DUMPABLE option gets cleared.
+	 * See RLIMIT_CORE in setup_limits and man 5 core.
+	 */
+	rv = prctl(PR_SET_DUMPABLE, 1, 0, 0, 0);
+	if (rv < 0) {
+		log_error("cannot set dumpable process errno %i", com.uid, errno);
+	}
+
  out:
 	free(pgroup);
 }
@@ -1577,6 +1594,7 @@ static int do_daemon(void)
 		}
 	}
 
+	setup_limits();
 	setup_helper();
 
 	/* main task never does disk io, so we don't really need to set
-- 
1.7.1