linux-kernel - Re: Writing a robust core-dump handling script (wrt PID namespaces)

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:   Mon, 27 Jan 2020 11:54:50 +0100
From:   Marc Gonzalez <marc.w.gonzalez@...e.fr>
To:     Eric Biederman <ebiederm@...ssion.com>,
        Stephane Graber <stgraber@...ntu.com>,
        Eric Dumazet <edumazet@...gle.com>,
        Al Viro <viro@...iv.linux.org.uk>
Cc:     LKML <linux-kernel@...r.kernel.org>,
        Linux ARM <linux-arm-kernel@...ts.infradead.org>
Subject: Re: Writing a robust core-dump handling script (wrt PID namespaces)

On 16/01/2020 14:39, Marc Gonzalez wrote:

> I'm trying to write a robust core-dump handling script -- which eventually
> sends minidumps remotely for analysis, like Mozilla Socorro[1] but for any
> crashing process in the system.
> 
> I read 'man 5 core' several times, but I'm confused about "PID namespaces".
> 
>            %p  PID of dumped process, as seen in the PID namespace in which
>                the process resides
>            %P  PID of dumped process, as seen in the initial PID namespace
>                (since Linux 3.12)
> 
> For now, I've set up :
> 
>     echo 5 > /proc/sys/kernel/core_pipe_limit
>     echo "|/usr/sbin/coredump %P" > /proc/sys/kernel/core_pattern
> 
> I used %P but I'm not sure why.
> (I used 5 somewhat at random too.)
> 
> The coredump script is supposed to access /proc/$PID
> 
> Should I use %P or %p or something else?

I /think/ %P is the proper option, because the /usr/sbin/coredump process
should (??) be created in the initial PID namespace.

Tangent: if a process is created in a different PID namespace, does it also
have a "global" PID, or is it "invisible" in the "root" PID namespace?

http://man7.org/linux/man-pages/man7/pid_namespaces.7.html

>        A process is visible to other processes in its PID namespace, and to
>        the processes in each direct ancestor PID namespace going back to the
>        root PID namespace.  In this context, "visible" means that one
>        process can be the target of operations by another process using
>        system calls that specify a process ID.  Conversely, the processes in
>        a child PID namespace can't see processes in the parent and further
>        removed ancestor namespaces.  More succinctly: a process can see
>        (e.g., send signals with kill(2), set nice values with
>        setpriority(2), etc.) only processes contained in its own PID
>        namespace and in descendants of that namespace.

What about /proc/[pid] ? (breakpad needs these bits)

I'm still not 100% sure about how to access the /proc/[pid] directory of
a process that crashed in a new PID namespace FROM a coredump analyzer
in the root PID namespace.

Regards.