should be marked undumpable to avoid PTRACE attach

[Kees Cook]

Binary package hint: gnome-keyring

Programs that keep sensitive information in memory should avoid dumping core or being PTRACEable. Things like ssh-agent already accomplish this by calling:

        prctl(PR_SET_DUMPABLE, 0);

ProblemType: Bug
DistroRelease: Ubuntu 10.04
Package: gnome-keyring 2.92.92.is.2.30.0-0ubuntu3
ProcVersionSignature: Ubuntu 2.6.32-21.32-generic 2.6.32.11+drm33.2
Uname: Linux 2.6.32-21-generic x86_64
Architecture: amd64
Date: Thu Apr 29 22:19:39 2010
ProcEnviron:
 LANGUAGE=en_US:en
 PATH=(custom, user)
 LANG=en_US.utf8
 SHELL=/bin/bash
SourcePackage: gnome-keyring

[Kees Cook (kees)]

To more directly illustrate:

$ gdb /usr/bin/ssh-agent $(pidof ssh-agent)
...
Attaching to program: /usr/bin/ssh-agent, process 16395
ptrace: Operation not permitted.

$ gdb /usr/bin/gpg-agent $(pidof gpg-agent)
...
Attaching to program: /usr/bin/gpg-agent, process 16396
...
0x00007f68d288af93 in __select_nocancel ()
    at ../sysdeps/unix/syscall-template.S:82
82 ../sysdeps/unix/syscall-template.S: No such file or directory.
 in ../sysdeps/unix/syscall-template.S
(gdb)

[Sebastien Bacher (seb128)]

Thank you for your bug report. The issue is an upstream one and it would be nice if somebody having it could send the bug the to the people writting the software (https://wiki.ubuntu.com/Bugs/Upstream/GNOME)

[Chris Halse Rogers (raof)]

This was actually fixed (with a Debian patch) in the gnupg 2.1.7-1 upload.