linux-kernel - Re: ptracing a task from core

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <51501D57.1000605@redhat.com>
Date:	Mon, 25 Mar 2013 10:48:07 +0100
From:	Denys Vlasenko <dvlasenk@...hat.com>
To:	Oleg Nesterov <oleg@...hat.com>
CC:	Daniel Walker <dwalker@...o99.com>, linux-kernel@...r.kernel.org
Subject: Re: ptracing a task from core_pattern pipe

On 03/19/2013 09:19 PM, Oleg Nesterov wrote:
>> The above is regarding the situation which I'm running my corepipe_app ,
>> i.e. my system doesn't have a disk to save a core file for parsing.
> 
> Can't you process the data inplace? You do not need to save it to disk.

Daniel said:

>> I'm trying to get the "dumpers" registers and stack out when it fails.

Registers would be easy'ish to get from coredump:
they are contained in note sections which are at the beginning
of the coredump. You can implement necessary parsing without
too much pain.

Getting at stack would be harder.

But by asking kernel to allow you to poke around dead task's
address space with ptrace() calls you just shift difficulty away from you
(today you need to implement in-memory ELF parsing) to kernel people
(they will need to implement *and support* ptracing of coredumping
tasks).

This is somewhat unfair, considering that coredumping code in kernel
is already a source of many complications, and that kernel-side coding
is harder than userspace.

I think you are lucky that ptrace attach even *works* on coredumping task.
No documentation ever guaranteed such a thing.

Did you try whether process_vm_readv() works on coredumping task?
If it is, then you can get at dying process' address space that way.

-- 
vda
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/