netdev - RE: [PATCH 1/1] connector: Added coredumping event to the process connector

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <DUB002-W14207698E8638F6DEB6F4A7DDEE0@phx.gbl>
Date:	Sat, 16 Mar 2013 19:08:03 +0000
From:	Jesper Derehag <jderehag@...mail.com>
To:	"netdev@...r.kernel.org" <netdev@...r.kernel.org>
Subject: RE: [PATCH 1/1] connector: Added coredumping event to the process
 connector

----------------------------------------
> Date: Sat, 16 Mar 2013 19:40:36 +0100
> From: hannes@...essinduktion.org
> To: jderehag@...mail.com
> CC: zbr@...emap.net; netdev@...r.kernel.org
> Subject: Re: [PATCH 1/1] connector: Added coredumping event to the process connector
>
> On Sat, Mar 16, 2013 at 05:57:20PM +0000, Jesper Derehag wrote:
> >
> >
> > > Date: Sat, 16 Mar 2013 18:03:48 +0100
> > > From: hannes@...essinduktion.org
> > > To: jderehag@...mail.com
> > > CC: zbr@...emap.net; netdev@...r.kernel.org
> > > Subject: Re: [PATCH 1/1] connector: Added coredumping event to the process connector
> > >
> > > On Sat, Mar 16, 2013 at 11:50:50AM +0100, Jesper Derehag wrote:
> > > > + ev->event_data.exit.exit_code = task->exit_code;
> > > > + ev->event_data.exit.exit_signal = task->exit_signal;
> > >
> > > Do these already contain meaningful values?
> > >
> >
> > I have to admit that they dont.And you are correct, I should add a new event struct specific for the coredump event instead of piggybacking on the exit struct.Will re-submit a patch..
>
> Hm, I am still unsure if such a patch is needed. Couldn't you test for
> coredump by inspecting exit_code on PROC_EVENT_EXIT?

*** resubmitted message due to it got dropped by vger.kernel.org ***

 Well, what this patch adds I think is more a question of timing. 
 As an example, say you want to quickly detect process failures. In that case if we would only have the EXIT event, that would mean that we get notified after the dump is done, which could take minutes depending on how large the dump is. 
If we instead watch for both EXIT & COREDUMP events, it would mean that we would quickly catch any failing process, regardless of if its actually starting to coredump or if its exited for some other reason. 		 	   		  --
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html