linux-kernel - Re: Extending coredump note section to contain filenames

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Fri, 9 Mar 2012 18:29:34 +0100
From:	Jan Kratochvil <jan.kratochvil@...hat.com>
To:	Denys Vlasenko <dvlasenk@...hat.com>
Cc:	Roland McGrath <mcgrathr@...gle.com>, linux-kernel@...r.kernel.org,
	Oleg Nesterov <oleg@...hat.com>
Subject: Re: Extending coredump note section to contain filenames

Hi Denys,

On Fri, 09 Mar 2012 18:13:49 +0100, Denys Vlasenko wrote:
> gdb retrieves loaded library names by examining dynamic loader's
> data stored in the coredump's data segments. It uses intimate
> knowledge how and where dynamic loader keeps the list of loaded
> libraries.

this is the backward compatible way and it is no longer the right one with
build-ids.

GDB should scan the address space for mapped build-ids and map symbol files
accordingly.  The shared library list may be even corrupted in crashes with
memory overruns.  But it has not been implemented yet, I plan it for years.

(It can use the shared library list as a hint as in some cases the symbol
files could overlap if you load the first page of an ELF file etc., this is
very improbable possibility.)


> Another question is detection of deleted files.
> If /usr/lib/xulrunner-2/libmozjs.so was updated while program ran
> and now file mapped into process address space does not correspond
> to the same-named file on disk, can we help users to detect this? How?
> By saving maj/min/inode? Hash thereof?
> File size?
> File's md5sum (probably not, way too expensive. But nicely robust...)?

build-id is already being saved.  This is all that matters.  Filename does not
say anything - as you noticed it can be even already deleted, it can have
unknown content etc.  I do not see what problems you target here.


Regards,
Jan
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/