linux-kernel - Re: signals logged / [RFC] log out-of-virtual-memory events

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <Pine.LNX.4.61.0705211420100.4452@yvahk01.tjqt.qr>
Date:	Mon, 21 May 2007 14:30:44 +0200 (MEST)
From:	Jan Engelhardt <jengelh@...ux01.gwdg.de>
To:	Folkert van Heusden <folkert@...heusden.com>
cc:	Andrea Righi <righiandr@...rs.sourceforge.net>,
	Andi Kleen <ak@...e.de>,
	Stephen Hemminger <shemminger@...ux-foundation.org>,
	Eric Dumazet <dada1@...mosbay.com>,
	Rik van Riel <riel@...hat.com>,
	LKML <linux-kernel@...r.kernel.org>, linux-mm@...ck.org
Subject: Re: signals logged / [RFC] log out-of-virtual-memory events


On May 21 2007 13:04, Folkert van Heusden wrote:
>
>What about the following enhancement: I check with sig_fatal if it would
>kill the process and only then emit a message. So when an application
>takes care itself of handling it nothing is printed.

>+	/* emit some logging for unhandled signals
>+	 */
>+	if (sig_fatal(t, sig))

Not unhandled_signal()?

>+	{

if (sig_fatal(t, sig)) {

>+		printk(KERN_WARNING "Sig %d send to %d owned by %d.%d (%s)\n",

s/send/sent/;

>+		sig, t -> pid, t -> uid, t -> gid, t -> comm);

t->pid, t->uid, t->gid, t->comm);

>+	}
>+
> 	/*
> 	 * fast-pathed signals for kernel-internal things like SIGSTOP
> 	 * or SIGKILL.
>
>of course, this can also be limited to only the interesting signals:
>
>Signed-off by: Folkert van Heusden <folkert@...heusden.com>
>
>--- kernel/signal.c.org	2007-05-20 22:47:13.000000000 +0200
>+++ kernel/signal.c	2007-05-21 12:59:52.000000000 +0200
>@@ -739,6 +739,28 @@
> 	struct sigqueue * q = NULL;
> 	int ret = 0;
> 
>+	/* emit some logging for nasty signals
>+	 * especially SIGSEGV and friends aught to be looked at when happening
>+	 */
>+	switch(sig) {
>+	case SIGQUIT: 
>+	case SIGILL: 
>+	case SIGTRAP:
>+	case SIGABRT: 
>+	case SIGBUS: 
>+	case SIGFPE:
>+	case SIGSEGV: 
>+	case SIGXCPU: 
>+	case SIGXFSZ:
>+	case SIGSYS: 
>+	case SIGSTKFLT:
>+		if (sig_fatal(t, sig))
>+		{
>+			printk(KERN_WARNING "Sig %d send to %d owned by %d.%d (%s)\n",
>+			sig, t -> pid, t -> uid, t -> gid, t -> comm);
>+		}
>+	}
>+
> 	/*
> 	 * fast-pathed signals for kernel-internal things like SIGSTOP
> 	 * or SIGKILL.
>



	Jan
-- 
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/