Re: [2/3] 2.6.22-rc2: known regressions v2

[Vivek Goyal <vgoyal@in.ibm.com>]

On Fri, May 25, 2007 at 10:50:38AM -0700, Linus Torvalds wrote:
> 
> 
> On Fri, 25 May 2007, Andrew Morton wrote:
> >
> > > > There is an additional factor - dumps contain data which variously is -
> > > > copyright third parties, protected by privacy laws, just personally
> > > > private, security sensitive (eg browser history) and so on.
> > > 
> > > Yes. 
> > 
> > We're uninterested in pagecache and user memory and they should be omitted
> > from the image (making it enormously smaller too).
> 
> The people who would use crash-dumps (big sensitive firms) don't trust 
> you.
> 
> And they'd be right not to trust you. You end up having a _lot_ of 
> sensitive data even if you avoid user memory and page cache. The network 
> buffers, the dentries, and just stale data that hasn't been overwritten.
> 
> So if you end up having secure data on that machine, you should *never* 
> send a dump to somebody you don't trust. For the financial companies 
> (which are practically the only ones that would use dumps) there can even 
> be legal reasons why they cannot do that!
> 
> > That leaves security keys and perhaps filenames, and these could probably
> > be addressed.
> 
> It leaves almost every single kernel allocation, and no, it cannot be 
> addressed.
> 
> How are you going to clear out the network packets that you have in 
> memory? They're just kmalloc'ed. 
> 
> > > I'm sure we've had one or two crashdumps over the years that have actually 
> > > clarified a bug.
> > > 
> > > But I seriously doubt it is more than a handful. 
> > 
> > We've had a few more than that, but all the ones I recall actually came
> > from the kdump developers who were hitting other bugs and who just happened
> > to know how to drive the thing.
> 
> Right, I don't dispute that some _developers_ might use dumping. I dispute 
> that any user would practically ever use it.
> 
> And even for developers, I suspect it's _so_ far down the list of things 
> you do, that it's practically zero.
> 
> > > But 99% of the time, the problem doesn't happen on a developer machine, 
> > > and even if it does, 90% of the time you really just want the traceback 
> > > and register info that you get out of an oops.
> > 
> > Often we don't even get that: "I was in X and it didn't hit the logs".
> 
> Yes. 
> 

Isn't it reason enough for customers to use it? How will a customer 
capture even an OOPS meesage? Lets say some web server crashed and OOPs 
message did not make it to logs. I am not expecting a customer to setup
a console for each and every machine in the network. In this scenario
customer will have no choice but to reset the machine without any
information about why did machine crash.

If one can keep kdump configured, upon a crash there are high chances
that customer will have some debug information to look at. I agree that
security of data can be a concern. In that case probably one can extract
a small dump report, like OOPs message, messages in the kernel buffers
just before crash etc. and report it to service folks. 

Without kdump, customer will most likely have no debug data except a
complain that system crashed and rebooted or it had to be reset by manual
intervention.

Thanks
Vivek