linux-kernel - Re: Extending coredump note section to contain filenames

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20120312165359.GA32400@host2.jankratochvil.net>
Date:	Mon, 12 Mar 2012 17:53:59 +0100
From:	Jan Kratochvil <jan.kratochvil@...hat.com>
To:	Denys Vlasenko <dvlasenk@...hat.com>
Cc:	Roland McGrath <roland@...k.frob.com>,
	linux-kernel@...r.kernel.org, Oleg Nesterov <oleg@...hat.com>,
	Kushal Das <kdas@...hat.com>
Subject: Re: Extending coredump note section to contain filenames

On Mon, 12 Mar 2012 13:05:56 +0100, Denys Vlasenko wrote:
> Build-ids are useful, but they still don't map directly to the names
> of loaded files. You need to rely on /usr/lib/debug/.build-id/XX/YYYYYYYYYY
> symlinks to translate build-ids to names.

There is draft of https://fedoraproject.org/wiki/Darkserver but it is not yet
deployed.  This will give you distro and file version / URL for the specified
build-id.  Without any local symlinks/files at all.

Reasons why it has not yet been finished + deployed I find out of the scope of
this thread.

> Why we don't save library names in coredump?

Because they are useless.  If you have a filename there how to find which
content it should match?  Even if you verify the file is still there with the
same content there is a race it can no longer be true when you read the core
file 5 seconds later.

The build-id mapping server above always works and without races.

> > it can have unknown content etc.
> 
> I don't understand. *What* can have unknown content?

You will save there "/lib64/libc-2.14.90.so".  But the next day you have no
idea which compilation or build the core file was generated for, that virtual
machine can be either already updated or even reinstalled from scratch etc.
"/lib64/libc-2.14.90.so" does not say anything about the build.

> I'll be satisfied with 99.9999% success rate instead of 100% :)

I am not, I prefer 100% build-id server.

Regards,
Jan
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/