Messages in this thread | | | Date | Sun, 28 Aug 2011 09:45:08 -0700 | From | Earl Chew <> | Subject | %e in /proc/sys/kernel/core_pattern and empty current->comm |
| |
It is possible to set /proc/sys/kernel/core_pattern to %e:
echo '%e' > /proc/sys/kernel/core_pattern
A couple of interesting effects:
a. Cores will tend to try to overwrite the executable.
Is this considered an issue ?
b. Apparently it seems possible to set current->comm to be empty:
prctl(PR_SET_NAME, "", 0, 0, 0);
No core dump is generated since the resulting corename is empty, and filp_open() fails.
Is this considered a defect, or potential security concern ?
c. Consequential to (b), setting /proc/sys/kernel/core_pattern to empty and /proc/sys/kernel/core_uses_pid to zero universally prevents core dumps.
I'm wondering if this behaviour is provided intentionally.
Earl
| |