Use scoped_with_init_fs() to temporarily override current->fs for the filp_open() call so the coredump path lookup happens in init's filesystem context. This replaces the init_root() + file_open_root() pattern with the simpler scoped override. coredump_file() ← do_coredump() ← vfs_coredump() ← get_signal() — runs as the crashing userspace process Uses init's root to prevent a chrooted/user-namespaced process from controlling where suid coredumps land. Not a kthread, but intentionally needs init's fs for security. Signed-off-by: Christian Brauner --- fs/coredump.c | 11 +++-------- 1 file changed, 3 insertions(+), 8 deletions(-) diff --git a/fs/coredump.c b/fs/coredump.c index 29df8aa19e2e..7428349f10bf 100644 --- a/fs/coredump.c +++ b/fs/coredump.c @@ -919,15 +919,10 @@ static bool coredump_file(struct core_name *cn, struct coredump_params *cprm, * with a fully qualified path" rule is to control where * coredumps may be placed using root privileges, * current->fs->root must not be used. Instead, use the - * root directory of init_task. + * root directory of PID 1. */ - struct path root; - - task_lock(&init_task); - get_fs_root(init_task.fs, &root); - task_unlock(&init_task); - file = file_open_root(&root, cn->corename, open_flags, 0600); - path_put(&root); + scoped_with_init_fs() + file = filp_open(cn->corename, open_flags, 0600); } else { file = filp_open(cn->corename, open_flags, 0600); } -- 2.47.3