Skip to content

Restore Linux process dumpability hardening - #22

Draft
noobping wants to merge 4 commits into
mainfrom
codex/fix-process-dumpability-issue-for-linux-builds
Draft

Restore Linux process dumpability hardening#22
noobping wants to merge 4 commits into
mainfrom
codex/fix-process-dumpability-issue-for-linux-builds

Conversation

@noobping

Copy link
Copy Markdown
Owner

Motivation

  • Fix a security regression where the prctl(PR_SET_DUMPABLE, 0) hardening was gated behind the flatpak feature and therefore not applied in default non-Flatpak Linux builds, allowing same-UID processes to read memory.

Description

  • Remove the #[cfg(feature = "flatpak")] gate so disable_process_dumpability() is compiled and its call is executed on all Linux builds, restoring the prctl(PR_SET_DUMPABLE, 0, ...) hardening alongside core-dump limits in src/support/hardening.rs.

Testing

  • Ran cargo fmt --check which passed.
  • Ran git diff --check which passed.
  • Ran cargo check which failed due to a missing system dependency (glib-2.0.pc not found by pkg-config) in the environment, so full build verification was blocked.

Codex Task

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant