| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Date: Sat, 20 Sep 2008 19:12:39 +0200
From: Thomas Jarosch <thomas.jarosch@...ra2net.com>
To: linux-kernel@...r.kernel.org
Cc: Marcin Slusarz <marcin.slusarz@...il.com>
Subject: [patch] log fatal signals like SIGSEGV
Hello together,
here's the reworked version of the signal logging patch.
Many thanks to Marcin Slusarz for reviewing it.
The idea is to briefly log "fatal" signals by default, the output
should be close to zero during normal system operation.
Faulty hardware gets detected much quicker
if you see crashing apps in the logs.
The patch applies to 2.6.26 and git HEAD.
scripts/checkpatch.pl is happy, too.
I'm off for a vacation, so expect a delay of some days
if there should be additional questions or comments.
Hope the new feature is as useful to others as it has been to me.
Enjoy,
Thomas
------------------------------------------------------
From: Thomas Jarosch <thomas.jarosch@...ra2net.com>
Log signals like SIGSEGV, SIGILL, SIGBUS or SIGFPE to aid tracing
of obscure problems. Also logs the sender of the signal.
The log message looks like this:
"kernel: signal 9 sent to freezed[2634] uid:100,
parent init[1] uid:0 by bash[3168] uid:0, parent sshd[3164] uid:0"
You can control the degree of logging via sysctl: "signal-log-level"
0 - Signal logging disabled
1 - Log SIGSEGV, SIGILL, SIGBUS and SIGFPE (default)
2 - Log SIGKILL and SIGABRT and all signals from log level 1
3 or higher: Log all signals
The printing code is based on grsecurity's signal logger.
Reviewed-by: Marcin Slusarz <marcin.slusarz@...il.com>
Signed-off-by: Thomas Jarosch <thomas.jarosch@...ra2net.com>
Signed-off-by: Gerd v. Egidy <gve@...ra2net.com>
------------------------------------------------------
diff -u -r -p linux-2.6.26.vanilla/kernel/signal.c linux-2.6.26/kernel/signal.c
--- linux-2.6.26.vanilla/kernel/signal.c Tue Sep 16 13:45:34 2008
+++ linux-2.6.26/kernel/signal.c Thu Sep 18 10:43:27 2008
@@ -796,6 +796,35 @@ static void complete_signal(int sig, str
return;
}
+int signal_log_level __read_mostly = 1;
+
+static void log_signal(const int sig, const struct task_struct *t)
+{
+ bool log_signal = false;
+
+ if (signal_log_level >= 1 && (sig == SIGSEGV || sig == SIGILL
+ || sig == SIGBUS || sig == SIGFPE))
+ log_signal = true;
+ else if (signal_log_level >= 2 && (sig == SIGKILL || sig == SIGABRT))
+ log_signal = true;
+ else if (signal_log_level >= 3)
+ log_signal = true;
+
+ if (!log_signal)
+ return;
+
+ if (printk_ratelimit()) {
+ /* Note: tasklist_lock is already locked by siglock */
+ printk(KERN_WARNING "signal %d sent to %.30s[%d] uid:%u, "
+ "parent %.30s[%d] uid:%u by %.30s[%d] uid:%u, "
+ "parent %.30s[%d] uid:%u\n", sig, t->comm,
+ t->pid, t->uid, t->parent->comm, t->parent->pid,
+ t->parent->uid, current->comm, current->pid,
+ current->uid, current->parent->comm,
+ current->parent->pid, current->parent->uid);
+ }
+}
+
static inline int legacy_queue(struct sigpending *signals, int sig)
{
return (sig < SIGRTMIN) && sigismember(&signals->signal, sig);
@@ -810,6 +839,8 @@ static int send_signal(int sig, struct s
assert_spin_locked(&t->sighand->siglock);
if (!prepare_signal(sig, t))
return 0;
+
+ log_signal(sig, t);
pending = group ? &t->signal->shared_pending : &t->pending;
/*
diff -u -r -p linux-2.6.26.vanilla/kernel/sysctl.c linux-2.6.26/kernel/sysctl.c
--- linux-2.6.26.vanilla/kernel/sysctl.c Sun Jul 13 23:51:29 2008
+++ linux-2.6.26/kernel/sysctl.c Thu Sep 18 10:08:47 2008
@@ -63,6 +63,7 @@ static int deprecated_sysctl_warning(str
/* External variables not in a header file. */
extern int C_A_D;
extern int print_fatal_signals;
+extern int signal_log_level;
extern int sysctl_overcommit_memory;
extern int sysctl_overcommit_ratio;
extern int sysctl_panic_on_oom;
@@ -398,6 +428,14 @@ static struct ctl_table kern_table[] = {
.ctl_name = CTL_UNNUMBERED,
.procname = "print-fatal-signals",
.data = &print_fatal_signals,
+ .maxlen = sizeof(int),
+ .mode = 0644,
+ .proc_handler = &proc_dointvec,
+ },
+ {
+ .ctl_name = CTL_UNNUMBERED,
+ .procname = "signal-log-level",
+ .data = &signal_log_level,
.maxlen = sizeof(int),
.mode = 0644,
.proc_handler = &proc_dointvec,
diff -u -r linux-2.6.26.vanilla/Documentation/sysctl/kernel.txt linux-2.6.26/Documentation/sysctl/kernel.txt
--- linux-2.6.26.vanilla/Documentation/sysctl/kernel.txt Sun Jul 13 23:51:29 2008
+++ linux-2.6.26/Documentation/sysctl/kernel.txt Thu Sep 18 10:50:13 2008
@@ -47,6 +47,7 @@
- rtsig-max
- rtsig-nr
- sem
+- signal-log-level
- sg-big-buff [ generic SCSI device (sg) ]
- shmall
- shmmax [ sysv ipc ]
@@ -349,6 +350,21 @@
==============================================================
+signal-log-level:
+
+Brief logging of signal and sender to aid
+tracing of obscure problems later on.
+
+ 0 - Signal logging disabled
+
+ 1 - Log SIGSEGV, SIGILL, SIGBUS and SIGFPE (default)
+
+ 2 - Log SIGKILL and SIGABRT and all signals from log level 1
+
+ 3 or higher: Log all signals
+
+==============================================================
+
softlockup_thresh:
This value can be used to lower the softlockup tolerance
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
Powered by blists - more mailing lists