linux-kernel - Re: utrace vs. ptrace

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Tue, 25 Jul 2006 11:27:31 -0700 (PDT)
From:	Linus Torvalds <torvalds@...l.org>
To:	Alan Cox <alan@...rguk.ukuu.org.uk>
cc:	Andi Kleen <ak@...e.de>, Ingo Molnar <mingo@...e.hu>,
	Albert Cahalan <acahalan@...il.com>, arjan@...radead.org,
	akpm@...l.org, linux-kernel@...r.kernel.org,
	Roland McGrath <roland@...hat.com>
Subject: Re: utrace vs. ptrace

On Tue, 25 Jul 2006, Alan Cox wrote:
>
> On Iau, 2006-07-13 at 12:05 -0700, Linus Torvalds wrote:
> > Doing core-dumping in user space would be insane. It doesn't give _any_ 
> > advantages, only disadvantages.
> 
> It has a number of very real advantages in certain circumstances and the
> only interface the kernel needs to provide is the debugger interface and
> something to "kick" the debugger and reparent to it, or for that matter
> it might even be viable just to pass the helper the fd of an anonymous
> file holding the dump.

What you're talking about is not core-dumping, it's just an extended 
debugging interface. And it eeds to be _damn_ careful, exactly because it 
tends to be something very security-sensitive.

> Taking out the kernel core dump support would be insane.

Indeed.

> We get customers who like to collect/process/do clever stuff with core
> dumps and failure cases. We also get people who want to dump a core that
> excludes the 14GB shared mmap of the database file as another example
> where it helps.

"ptrace" certainly isn't wondeful.

What you often want is not a core-dump at all, but a "stop the process" 
thing. It's really irritating that the core-dump is generated and the 
process is gone, when it would often be a lot nicer if instead of 
core-dumping, the process was just stopped and then you could attach to it 
with gdb, and get the whole damn information (including things like access 
to open file descriptors etc).

But again, that has nothing to do with core-dumping. 

			Linus
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/