linux-kernel - Re: [Feature Request?] Inline compression of process core dumps

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Thu, 12 Apr 2007 12:42:51 -0400
From:	"Bill Rugolsky Jr." <brugolsky@...emetry-investments.com>
To:	Alan Cox <alan@...rguk.ukuu.org.uk>
Cc:	"Christopher S. Aker" <caker@...shore.net>,
	linux-kernel@...r.kernel.org
Subject: Re: [Feature Request?] Inline compression of process core dumps

On Thu, Apr 12, 2007 at 05:28:45PM +0100, Alan Cox wrote:
> > There are userspace solutions to this problem:  allowing the 
> > uncompressed core dump to spin out to disk and then coming in afterwards 
> > and doing the compression, or maybe even a compressed filesystem where 
> > the core dumps land, but I just thought I'd throw this out there since 
> > it seems it would be a useful feature :)
> 
> Indeed. So useful that in current kernels you can set the core dump path
> to be
> 
> 	"|application"
> 
> and it will call out to the helper. Take care with the helper as it will
> get run for setuid apps, roots core dumps etc.

The current functionality doesn't parse command line arguments into argv,
nor provide the % variable replacements in the environment, so it is
somewhat less useful than it could be.  I supposed that parsing the command
line introduces potential problems with file names that include whitespace.
It would probably be better to split the command-line on whitespace, then
replace variables in the argv[]?

fs/exec.c:
1507         if (corename[0] == '|') {
1508                 /* SIGPIPE can happen, but it's just never processed */
1509                 if(call_usermodehelper_pipe(corename+1, NULL, NULL, &file)) {
1510                         printk(KERN_INFO "Core dump to %s pipe failed\n",
1511                                corename);
1512                         goto fail_unlock;
1513                 }
1514                 ispipe = 1;
1515         } else
1516                 file = filp_open(corename,
1517                                  O_CREAT | 2 | O_NOFOLLOW | O_LARGEFILE | flag,
1518                                  0600);


Regards,

	Bill Rugolsky
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/