linux-kernel - Request for Comment: Adding information to user core dumps

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [day] [month] [year] [list]

Date:	Tue, 15 Dec 2015 09:24:16 -0800
From:	"Kevin Grigorenko" <kevin.grigorenko@...ibm.com>
To:	linux-kernel@...r.kernel.org
Subject: Request for Comment: Adding information to user core dumps

Hi there. I plan to create a patch that puts additional ELF notes into 
core dumps of user processes produced by the kernel. These are desired in 
customer field work because 1) we often get a core without access to the 
original machine and much of this would remove significant delays and 
errors, and 2) most customers have poor system monitoring and some of this 
information is lost. Are there any objections, previous patches, or ideas?

Draft list of additions (all will be available in coredump_filter; some 
proposed as enabled by default [TBD]):
1. Equivalent output of /proc/PID/smaps. The benefits include an accurate 
view of process size, Rss for each VMA, knowing about non-readable VMAs, 
etc.
2. The value of /proc/PID/coredump_filter
3. The values of 
/proc/sys/kernel/[core_pattern|core_pipe_limit|core_uses_pid]
4. Timestamp for a few stages of core dump processing, such as the 
beginning and when writing metadata/notes completed
5. Memory statistics for the system and processes (similar to OOM killer 
output)
6. Equivalent output of `uname -a`
7. Equivalent output of /proc/cpuinfo
8. Process envars
9. Equivalent output of /proc/sys/vm/swappiness
10. Equivalent output of /proc/PID/cmdline
11. Equivalent output of /proc/PID/cwd
12. Equivalent output of lsof for this process
13. Equivalent output of /proc/PID/limits

Thanks for your time.

--
Kevin Grigorenko
IBM WebSphere Foundation SWAT Team
kevin.grigorenko@...ibm.com
Blog: https://www.ibm.com/developerworks/mydeveloperworks/blogs/kevgrig/

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/