[steamos-log-submitter] Coredump hook omits `%d`, preventing users from reading their own coredumps.

The change touches two files: the kernel.core_pattern line in systemd/crash-hook.sysctl (around line 6) and the run() function in steamos_log_submitter/hooks/coredump.py, which unpacks sys.argv and calls systemd-coredump. Read those two spots first, then append %d to the pattern and forward the extra argument. Done means the argument reaches systemd-coredump and a core from an unprivileged process gets a user read ACL. There is no upstream repository for this project, so the patch cannot be submitted as a normal pull request.

Last year systemd fixed CVE-2025-4598, by utilizing kernel-provided dumpability value (%d) to determine if a user may access core dump file or not. The fix (https://github.com/systemd/systemd/commit/0c49e0049b7665bb7769a13ef346fef92e1ad4d6) went into v258 and was backported to v257.6, v256.16 and other versions (see https://security-tracker.debian.org/tracker/CVE-2025-4598).

SteamOS 3.8.0 was the first (to my knowledge) public release that shipped with the systemd with the above fix (257.7). The steamos-log-submitter was not updated and does not forward dumpability value (%d in kernel.core_pattern; see https://man7.org/linux/man-pages/man5/core.5.html) to systemd-coredmp, effectively preventing a user from accessing crash dumps generated from processes that run under this user. You can note this in user reports in this very repository, see https://github.com/ValveSoftware/SteamOS/issues?q=is%3Aissue+inaccessible, e.g. https://github.com/ValveSoftware/SteamOS/issues/2709).

Steps to reproduce:

1. Trigger a coredump from an ordinary process running as an unprivileged user (e.g. kill -SIGABRT <pid>).
2. Run coredumpctl info <pid> as that same user.
3. The coredump file will be marked as inaccessible.

Here's an example:

deck@steamdeck ~)$ coredumpctl
TIME                           PID  UID  GID SIG     COREFILE     EXE                          SIZE
Wed 2026-10-14 17:47:41 EEST  1595 1000 1000 SIGABRT inaccessible /usr/lib/steamos-manager        -

(deck@steamdeck ~)$ coredumpctl info 1595
           PID: 1595 (steamos-manager)
           UID: 1000 (deck)
           GID: 1000 (deck)
        Signal: 6 (ABRT)
     Timestamp: Wed 2026-10-14 17:47:41 EEST (35s ago)
  Command Line: /usr/lib/steamos-manager
    Executable: /usr/lib/steamos-manager
 Control Group: /user.slice/user-1000.slice/[email protected]/app.slice/steamos-manager.service
          Unit: [email protected]
     User Unit: steamos-manager.service
         Slice: user-1000.slice
     Owner UID: 1000 (deck)
       Boot ID: f75465f09b584f49af2f58e0fa27143d
    Machine ID: 1775c76fc20f40daab521e8efe7e6fe1
      Hostname: steamdeck
       Storage: /var/lib/systemd/coredump/core.steamos-manager.1000.f75465f09b584f49af2f58e0fa27143d.1595.1791989261000000.zst (inaccessible)
       Message: Process 1595 (steamos-manager) of user 1000 dumped core.
       < stripped >

(deck@steamdeck ~)$ ls -l /var/lib/systemd/coredump/core.steamos-manager.1000.f75465f09b584f49af2f58e0fa27143d.1595.1791989261000000.zst
-rw-r----- 1 root root 2209328 Oct 14 17:47 /var/lib/systemd/coredump/core.steamos-manager.1000.f75465f09b584f49af2f58e0fa27143d.1595.1791989261000000.zst

(deck@steamdeck ~)$ getfacl -e /var/lib/systemd/coredump/core.steamos-manager.1000.f75465f09b584f49af2f58e0fa27143d.1595.1791989261000000.zst
getfacl: Removing leading '/' from absolute path names
# file: var/lib/systemd/coredump/core.steamos-manager.1000.f75465f09b584f49af2f58e0fa27143d.1595.1791989261000000.zst
# owner: root
# group: root
user::rw-
group::r--
other::---

Expected behavior: a user can read the core when the process’s dumpability is 1 and the remaining security checks pass.

Actual behavior: the stored core lacks the user read ACL.

Proposed fix:

• Append %d to the existing pattern in systemd/crash-hook.sysctl (see https://github.com/evlaV/steamos-log-submitter/blob/main/systemd/crash-hook.sysctl#L6)
• Update steamos_log_submitter/hooks/coredump.py to accept that argument and forward it to systemd-coredump (https://github.com/evlaV/steamos-log-submitter/blob/main/steamos_log_submitter/hooks/coredump.py#L69)

Since there's no official open repository for steamos-log-submitter, I could not make a PR. So I took ToT master https://github.com/evlaV/steamos-log-submitter/commit/5e34bfdd769c1d5ff74cd47e7d5b851d300c7503 and made a patch:

diff -Nuar steamos-log-submitter.old/steamos_log_submitter/hooks/coredump.py steamos-log-submitter.new/steamos_log_submitter/hooks/coredump.py
--- steamos-log-submitter.old/steamos_log_submitter/hooks/coredump.py   2026-10-14 20:26:51.024801773 +0300
+++ steamos-log-submitter.new/steamos_log_submitter/hooks/coredump.py   2026-10-14 20:29:01.270177840 +0300
@@ -66,7 +66,7 @@


 def run() -> bool:
-    P, e, u, g, s, t, c, h, f, E = sys.argv[1:]
+    P, e, u, g, s, t, c, h, f, E, d = sys.argv[1:]

     logger.info(f'Process {P} ({e}) dumped core with signal {s} at {time.ctime(int(t))}')
     try:
@@ -75,7 +75,7 @@
         appid = None
     minidump = f'{t}-{e}-{P}-{appid}.dmp'
     tmpfile = f'{sls.pending}/minidump/.staging-{minidump}'
-    systemd = subprocess.Popen(['/usr/lib/systemd/systemd-coredump', P, u, g, s, t, c, h], stdin=subprocess.PIPE)
+    systemd = subprocess.Popen(['/usr/lib/systemd/systemd-coredump', P, u, g, s, t, c, h, d], stdin=subprocess.PIPE)

     path = E.replace('!', '/')
     if should_collect(path):
diff -Nuar steamos-log-submitter.old/systemd/crash-hook.sysctl steamos-log-submitter.new/systemd/crash-hook.sysctl
--- steamos-log-submitter.old/systemd/crash-hook.sysctl 2026-10-14 20:26:51.025168349 +0300
+++ steamos-log-submitter.new/systemd/crash-hook.sysctl 2026-10-14 20:27:41.047997128 +0300
@@ -3,4 +3,4 @@
 #  Copyright (c) 2022-2023 Valve Software
 #  Author: Vicki Pfau <[email protected]>

-kernel.core_pattern=|/usr/bin/python -m steamos_log_submitter.hooks.coredump %P %e %u %g %s %t %c %h %f %E
+kernel.core_pattern=|/usr/bin/python -m steamos_log_submitter.hooks.coredump %P %e %u %g %s %t %c %h %f %E %d

I tested the fix this on SteamOS 3.8.28 and here's the output after applying the fix. Note, you'll need to sudo steamos-readonly disable to apply this on a live system:

• Run sudo steamos-readonly disable to make system writable
• Edit /usr/lib/sysctl.d/60-crash-hook.conf
• Apply the above change sudo sysctl -p /usr/lib/sysctl.d/60-crash-hook.conf
• Edit /usr/lib/python3.13/site-packages/steamos_log_submitter/hooks/coredump.py
• Run sudo steamos-readonly enable to make the system read-only again (optional)

(deck@steamdeck ~)$ coredumpctl --no-pager
TIME                           PID  UID  GID SIG     COREFILE     EXE                                               SIZE
Wed 2026-10-14 17:47:41 EEST  1595 1000 1000 SIGABRT inaccessible /usr/lib/steamos-manager                             -
Wed 2026-10-14 17:50:53 EEST  2104 1000 1000 SIGABRT present      /home/deck/.local/share/Steam/ubuntu12_32/steam  32.4M
(deck@steamdeck ~)$ coredumpctl info 2104
           PID: 2104 (steam)
           UID: 1000 (deck)
           GID: 1000 (deck)
        Signal: 6 (ABRT)
     Timestamp: Wed 2026-10-14 17:50:50 EEST (1min 37s ago)
  Command Line: /home/deck/.local/share/Steam/ubuntu12_32/steam -srt-logger-opened -steamdeck -pipewire -steamos3 -steampal -steamdeck -gamepadui
    Executable: /home/deck/.local/share/Steam/ubuntu12_32/steam
 Control Group: /user.slice/user-1000.slice/[email protected]/app.slice/steam-launcher.service
          Unit: [email protected]
     User Unit: steam-launcher.service
         Slice: user-1000.slice
     Owner UID: 1000 (deck)
       Boot ID: f75465f09b584f49af2f58e0fa27143d
    Machine ID: 1775c76fc20f40daab521e8efe7e6fe1
      Hostname: steamdeck
       Storage: /var/lib/systemd/coredump/core.steam.1000.f75465f09b584f49af2f58e0fa27143d.2104.1791989450000000.zst (present)
  Size on Disk: 32.4M
       Message: Process 2104 (steam) of user 1000 dumped core.
       < stripped >
(deck@steamdeck ~)$ ls -l /var/lib/systemd/coredump/core.steam.1000.f75465f09b584f49af2f58e0fa27143d.2104.1791989450000000.zst
-rw-r-----+ 1 root root 34066557 Oct 14 17:50 /var/lib/systemd/coredump/core.steam.1000.f75465f09b584f49af2f58e0fa27143d.2104.1791989450000000.zst

(deck@steamdeck ~)$ getfacl -e /var/lib/systemd/coredump/core.steam.1000.f75465f09b584f49af2f58e0fa27143d.2104.1791989450000000.zst
getfacl: Removing leading '/' from absolute path names
# file: var/lib/systemd/coredump/core.steam.1000.f75465f09b584f49af2f58e0fa27143d.2104.1791989450000000.zst
# owner: root
# group: root
user::rw-
user:deck:r--                   #effective:r--
group::r--                      #effective:r--
mask::r--
other::---

Relevant information:

(deck@steamdeck ~)$ cat /etc/os-release
NAME="SteamOS"
PRETTY_NAME="SteamOS"
VERSION_CODENAME=holo
ID=steamos
ID_LIKE=arch
ANSI_COLOR="1;35"
HOME_URL="https://www.steampowered.com/"
DOCUMENTATION_URL="https://support.steampowered.com/"
SUPPORT_URL="https://support.steampowered.com/"
BUG_REPORT_URL="https://support.steampowered.com/"
LOGO=steamos
VARIANT_ID=steamdeck
VERSION_ID=3.8.28
BUILD_ID=20260922.1
STEAMOS_DEFAULT_UPDATE_BRANCH=stable
(deck@steamdeck ~)$ uname -a
Linux steamdeck 6.18.50-valve2-1-neptune-618-gc7289a96b14d #1 SMP PREEMPT_DYNAMIC Tue, 22 Sep 2026 20:17:17 +0000 x86_64 GNU/Linux
(deck@steamdeck ~)$ pacman -Qi systemd steamos-log-submitter
Name            : systemd
Version         : 257.7-2.51
Description     : system and service manager
Architecture    : x86_64
URL             : https://www.github.com/systemd/systemd
Licenses        : LGPL-2.1-or-later  CC0-1.0  GPL-2.0-or-later  MIT-0
Groups          : None
Provides        : nss-myhostname  systemd-tools=257.7  udev=257.7
Depends On      : systemd-libs=257.7  acl  libacl.so=1-64  bash  cryptsetup  libcryptsetup.so=12-64  dbus  dbus-units  kbd  kmod  hwdata  libcap  libcap.so=2-64  libgcrypt  libxcrypt  libcrypt.so=2-64  libidn2  lz4  pam  libelf  libseccomp  libseccomp.so=2-64  util-linux
                  libblkid.so=1-64  libmount.so=1-64  xz  pcre2  audit  libaudit.so=1-64  openssl  libcrypto.so=3-64  libssl.so=3-64
Optional Deps   : libmicrohttpd: systemd-journal-gatewayd and systemd-journal-remote
                  quota-tools: kernel-level quota management
                  systemd-sysvcompat: symlink package to provide sysvinit binaries [installed]
                  systemd-ukify: combine kernel and initrd into a signed Unified Kernel Image
                  polkit: allow administration as unprivileged user [installed]
                  curl: systemd-journal-upload, machinectl pull-tar and pull-raw [installed]
                  gnutls: systemd-journal-gatewayd and systemd-journal-remote [installed]
                  qrencode: show QR codes [installed]
                  iptables: firewall features [installed]
                  libarchive: convert DDIs to tarballs [installed]
                  libbpf: support BPF programs [installed]
                  libpwquality: check password quality
                  libfido2: unlocking LUKS2 volumes with FIDO2 token
                  libp11-kit: support PKCS#11 [installed]
                  tpm2-tss: unlocking LUKS2 volumes with TPM2 [installed]
Required By     : accountsservice  atomupd-daemon  base  bolt  conmon  cups  ec-log  flatpak  inputattach-cec-units  mdadm  media-player-info  mkinitcpio  pacman  steamos-devkit-service  steamos-log-submitter  steamos-manager  steamos-powerbuttond  steamos-systemreport
                  steamos-tweak-mtu-probing  systemd-sysvcompat  xdg-desktop-portal  xdg-user-dirs  zram-generator
Optional For    : None
Conflicts With  : nss-myhostname  systemd-tools  udev
Replaces        : nss-myhostname  systemd-tools  udev
Installed Size  : 33.78 MiB
Packager        : GitLab CI Package Builder <[email protected]>
Build Date      : Fri 07 Aug 2026 11:53:29 PM EEST
Install Date    : Mon 28 Apr 1986 02:00:00 PM EEST
Install Reason  : Installed as a dependency for another package
Install Script  : Yes
Validated By    : Signature

Name            : steamos-log-submitter
Version         : 0.8.3-1
Description     : SteamOS Log Submitter
Architecture    : any
URL             : https://gitlab.steamos.cloud/jupiter/steamos-log-submitter
Licenses        : LGPL2.1
Groups          : None
Provides        : None
Depends On      : python>=3.13  python<3.14  python-dbus-next  python-httpx  python-minidump  python-psutil  python-pyalsa  python-pyelftools  systemd  google-breakpad
Optional Deps   : umr: enhanced amdgpu crash logging [installed]
Required By     : jupiter-steamos-log-submitter  steamos-kdumpst-layer
Optional For    : steamos-manager
Conflicts With  : breakpad-hook
Replaces        : None
Installed Size  : 573.98 KiB
Packager        : GitLab CI Package Builder <[email protected]>
Build Date      : Fri 28 Aug 2026 03:47:06 AM EEST
Install Date    : Mon 28 Apr 1986 02:00:00 PM EEST
Install Reason  : Installed as a dependency for another package
Install Script  : No
Validated By    : Signature
(deck@steamdeck ~)$ systemctl --version
systemd 257 (257.7-2.51-arch)
+PAM +AUDIT -SELINUX -APPARMOR -IMA +IPE +SMACK +SECCOMP +GCRYPT +GNUTLS +OPENSSL +ACL +BLKID +CURL +ELFUTILS +FIDO2 +IDN2 -IDN +IPTC +KMOD +LIBCRYPTSETUP +LIBCRYPTSETUP_PLUGINS +LIBFDISK +PCRE2 +PWQUALITY +P11KIT +QRENCODE +TPM2 +BZIP2 +LZ4 +XZ +ZLIB +ZSTD +BPF_FRAMEWORK +BTF +XKBCOMMON +UTMP -SYSVINIT +LIBARCHIVE
(deck@steamdeck ~)$ sysctl kernel.core_pattern fs.suid_dumpable
kernel.core_pattern = |/usr/bin/python -m steamos_log_submitter.hooks.coredump %P %e %u %g %s %t %c %h %f %E
fs.suid_dumpable = 2