[PATCH RFC 0/3] coredump: support AF_UNIX sockets

[PATCH RFC 0/3] coredump: support AF_UNIX sockets

[Christian Brauner]

Coredumping currently supports two modes:

(1) Dumping directly into a file somewhere on the filesystem.
(2) Dumping into a pipe connected to a usermode helper process
    spawned as a child of the system_unbound_wq or kthreadd.

For simplicity I'm mostly ignoring (1). There's probably still some
users of (1) out there but processing coredumps in this way can be
considered adventurous especially in the face of set*id binaries.

The most common option should be (2) by now. It works by allowing
userspace to put a string into /proc/sys/kernel/core_pattern like:

        |/usr/lib/systemd/systemd-coredump %P %u %g %s %t %c %h

The "|" at the beginning indicates to the kernel that a pipe must be
used. The path following the pipe indicator is a path to a binary that
will be spawned as a usermode helper process. Any additional parameters
pass information about the task that is generating the coredump to the
binary that processes the coredump.

In this case systemd-coredump is spawned as a usermode helper. There's
various conceptual consequences of this (non-exhaustive list):

- systemd-coredump is spawned with file descriptor number 0 (stdin)
  to the read-end of the pipe. All other file descriptors are closed.
  That specifically includes 1 (stdout) and 2 (stderr). This has already
  caused bugs because userspace assumed that this cannot happen (Whether
  or not this is a sane assumption is irrelevant.).

- systemd-coredump will be spawned as a child of system_unbound_wq. So
  it is not a child of any userspace process and specifically not a
  child of PID 1 so it cannot be waited upon and is in general a weird
  hybrid upcall.

- systemd-coredump is spawned highly privileged as it is spawned with
  full kernel credentials requiring all kinds of weird privilege
  dropping excercises in userspaces.

This adds another mode:

(3) Dumping into a AF_UNIX socket.

Userspace can set /proc/sys/kernel/core_pattern to:

        :/run/coredump.socket

The ":" at the beginning indicates to the kernel that an AF_UNIX socket
is used to process coredumps. The task generating the coredump simply
connects to the socket and writes the coredump into the socket.

Userspace can get a stable handle on the task generating the coredump by
using the SO_PEERPIDFD socket option. SO_PEERPIDFD uses the thread-group
leader pid stashed during connect(). Even if the task generating the
coredump is a subthread in the thread-group the pidfd of the
thread-group leader is a reliable stable handle. Userspace that's
interested in the credentials of the specific thread that crashed can
use SCM_PIDFD to retrieve them.

The pidfd can be used to safely open and parse /proc/<pid> of the task
and it can also be used to retrieve additional meta information via the
PIDFD_GET_INFO ioctl().

This will allow userspace to not have to rely on usermode helpers for
processing coredumps and thus to stop having to handle super privileged
coredumping helpers.

This is easy to test:

(a) coredump processing (we're using socat):

    > cat coredump_socket.sh
    #!/bin/bash
    
    set -x
    
    sudo bash -c "echo ':/tmp/stream.sock' > /proc/sys/kernel/core_pattern"
    socat --statistics unix-listen:/tmp/stream.sock,fork FILE:core_file,create,append,truncate

(b) trigger a coredump:

    user1@localhost:~/data/scripts$ cat crash.c
    #include <stdio.h>
    #include <unistd.h>
    
    int main(int argc, char *argv[])
    {
            fprintf(stderr, "%u\n", (1 / 0));
            _exit(0);
    }

Signed-off-by: Christian Brauner <brauner@kernel.org>
---
Christian Brauner (3):
      coredump: massage format_corname()
      coredump: massage do_coredump()
      coredump: support AF_UNIX sockets

 fs/coredump.c | 241 ++++++++++++++++++++++++++++++++++++++++------------------
 1 file changed, 168 insertions(+), 73 deletions(-)
---
base-commit: 80e14080a00bc429a4ee440d17746a49867df663
change-id: 20250429-work-coredump-socket-87cc0f17729c

[PATCH RFC 1/3] coredump: massage format_corname()

[Christian Brauner]

We're going to extend the coredump code in follow-up patches.
Clean it up so we can do this more easily.

Signed-off-by: Christian Brauner <brauner@kernel.org>
---
 fs/coredump.c | 41 ++++++++++++++++++++++++-----------------
 1 file changed, 24 insertions(+), 17 deletions(-)

diff --git a/fs/coredump.c b/fs/coredump.c
index d740a0411266..281320ea351f 100644
--- a/fs/coredump.c
+++ b/fs/coredump.c
@@ -76,9 +76,15 @@ static char core_pattern[CORENAME_MAX_SIZE] = "core";
 static int core_name_size = CORENAME_MAX_SIZE;
 unsigned int core_file_note_size_limit = CORE_FILE_NOTE_SIZE_DEFAULT;
 
+enum coredump_type_t {
+	COREDUMP_FILE = 1,
+	COREDUMP_PIPE = 2,
+};
+
 struct core_name {
 	char *corename;
 	int used, size;
+	enum coredump_type_t core_type;
 };
 
 static int expand_corename(struct core_name *cn, int size)
@@ -218,18 +224,21 @@ static int format_corename(struct core_name *cn, struct coredump_params *cprm,
 {
 	const struct cred *cred = current_cred();
 	const char *pat_ptr = core_pattern;
-	int ispipe = (*pat_ptr == '|');
 	bool was_space = false;
 	int pid_in_pattern = 0;
 	int err = 0;
 
 	cn->used = 0;
 	cn->corename = NULL;
+	if (*pat_ptr == '|')
+		cn->core_type = COREDUMP_PIPE;
+	else
+		cn->core_type = COREDUMP_FILE;
 	if (expand_corename(cn, core_name_size))
 		return -ENOMEM;
 	cn->corename[0] = '\0';
 
-	if (ispipe) {
+	if (cn->core_type == COREDUMP_PIPE) {
 		int argvs = sizeof(core_pattern) / 2;
 		(*argv) = kmalloc_array(argvs, sizeof(**argv), GFP_KERNEL);
 		if (!(*argv))
@@ -247,7 +256,7 @@ static int format_corename(struct core_name *cn, struct coredump_params *cprm,
 		 * Split on spaces before doing template expansion so that
 		 * %e and %E don't get split if they have spaces in them
 		 */
-		if (ispipe) {
+		if (cn->core_type == COREDUMP_PIPE) {
 			if (isspace(*pat_ptr)) {
 				if (cn->used != 0)
 					was_space = true;
@@ -353,7 +362,7 @@ static int format_corename(struct core_name *cn, struct coredump_params *cprm,
 				 * Installing a pidfd only makes sense if
 				 * we actually spawn a usermode helper.
 				 */
-				if (!ispipe)
+				if (!(cn->core_type != COREDUMP_PIPE))
 					break;
 
 				/*
@@ -384,12 +393,12 @@ static int format_corename(struct core_name *cn, struct coredump_params *cprm,
 	 * If core_pattern does not include a %p (as is the default)
 	 * and core_uses_pid is set, then .%pid will be appended to
 	 * the filename. Do not do this for piped commands. */
-	if (!ispipe && !pid_in_pattern && core_uses_pid) {
+	if (!(cn->core_type == COREDUMP_PIPE) && !pid_in_pattern && core_uses_pid) {
 		err = cn_printf(cn, ".%d", task_tgid_vnr(current));
 		if (err)
 			return err;
 	}
-	return ispipe;
+	return 0;
 }
 
 static int zap_process(struct signal_struct *signal, int exit_code)
@@ -583,7 +592,6 @@ void do_coredump(const kernel_siginfo_t *siginfo)
 	const struct cred *old_cred;
 	struct cred *cred;
 	int retval = 0;
-	int ispipe;
 	size_t *argv = NULL;
 	int argc = 0;
 	/* require nonrelative corefile path and be extra careful */
@@ -632,19 +640,18 @@ void do_coredump(const kernel_siginfo_t *siginfo)
 
 	old_cred = override_creds(cred);
 
-	ispipe = format_corename(&cn, &cprm, &argv, &argc);
+	retval = format_corename(&cn, &cprm, &argv, &argc);
+	if (retval < 0) {
+		coredump_report_failure("format_corename failed, aborting core");
+		goto fail_unlock;
+	}
 
-	if (ispipe) {
+	if (cn.core_type == COREDUMP_PIPE) {
 		int argi;
 		int dump_count;
 		char **helper_argv;
 		struct subprocess_info *sub_info;
 
-		if (ispipe < 0) {
-			coredump_report_failure("format_corename failed, aborting core");
-			goto fail_unlock;
-		}
-
 		if (cprm.limit == 1) {
 			/* See umh_coredump_setup() which sets RLIMIT_CORE = 1.
 			 *
@@ -695,7 +702,7 @@ void do_coredump(const kernel_siginfo_t *siginfo)
 			coredump_report_failure("|%s pipe failed", cn.corename);
 			goto close_fail;
 		}
-	} else {
+	} else if (cn.core_type == COREDUMP_FILE) {
 		struct mnt_idmap *idmap;
 		struct inode *inode;
 		int open_flags = O_CREAT | O_WRONLY | O_NOFOLLOW |
@@ -823,13 +830,13 @@ void do_coredump(const kernel_siginfo_t *siginfo)
 		file_end_write(cprm.file);
 		free_vma_snapshot(&cprm);
 	}
-	if (ispipe && core_pipe_limit)
+	if ((cn.core_type == COREDUMP_PIPE) && core_pipe_limit)
 		wait_for_dump_helpers(cprm.file);
 close_fail:
 	if (cprm.file)
 		filp_close(cprm.file, NULL);
 fail_dropcount:
-	if (ispipe)
+	if (cn.core_type == COREDUMP_PIPE)
 		atomic_dec(&core_dump_count);
 fail_unlock:
 	kfree(argv);

-- 
2.47.2

[PATCH RFC 2/3] coredump: massage do_coredump()

[Christian Brauner]

We're going to extend the coredump code in follow-up patches.
Clean it up so we can do this more easily.

Signed-off-by: Christian Brauner <brauner@kernel.org>
---
 fs/coredump.c | 123 +++++++++++++++++++++++++++++++---------------------------
 1 file changed, 66 insertions(+), 57 deletions(-)

diff --git a/fs/coredump.c b/fs/coredump.c
index 281320ea351f..1779299b8c61 100644
--- a/fs/coredump.c
+++ b/fs/coredump.c
@@ -646,63 +646,8 @@ void do_coredump(const kernel_siginfo_t *siginfo)
 		goto fail_unlock;
 	}
 
-	if (cn.core_type == COREDUMP_PIPE) {
-		int argi;
-		int dump_count;
-		char **helper_argv;
-		struct subprocess_info *sub_info;
-
-		if (cprm.limit == 1) {
-			/* See umh_coredump_setup() which sets RLIMIT_CORE = 1.
-			 *
-			 * Normally core limits are irrelevant to pipes, since
-			 * we're not writing to the file system, but we use
-			 * cprm.limit of 1 here as a special value, this is a
-			 * consistent way to catch recursive crashes.
-			 * We can still crash if the core_pattern binary sets
-			 * RLIM_CORE = !1, but it runs as root, and can do
-			 * lots of stupid things.
-			 *
-			 * Note that we use task_tgid_vnr here to grab the pid
-			 * of the process group leader.  That way we get the
-			 * right pid if a thread in a multi-threaded
-			 * core_pattern process dies.
-			 */
-			coredump_report_failure("RLIMIT_CORE is set to 1, aborting core");
-			goto fail_unlock;
-		}
-		cprm.limit = RLIM_INFINITY;
-
-		dump_count = atomic_inc_return(&core_dump_count);
-		if (core_pipe_limit && (core_pipe_limit < dump_count)) {
-			coredump_report_failure("over core_pipe_limit, skipping core dump");
-			goto fail_dropcount;
-		}
-
-		helper_argv = kmalloc_array(argc + 1, sizeof(*helper_argv),
-					    GFP_KERNEL);
-		if (!helper_argv) {
-			coredump_report_failure("%s failed to allocate memory", __func__);
-			goto fail_dropcount;
-		}
-		for (argi = 0; argi < argc; argi++)
-			helper_argv[argi] = cn.corename + argv[argi];
-		helper_argv[argi] = NULL;
-
-		retval = -ENOMEM;
-		sub_info = call_usermodehelper_setup(helper_argv[0],
-						helper_argv, NULL, GFP_KERNEL,
-						umh_coredump_setup, NULL, &cprm);
-		if (sub_info)
-			retval = call_usermodehelper_exec(sub_info,
-							  UMH_WAIT_EXEC);
-
-		kfree(helper_argv);
-		if (retval) {
-			coredump_report_failure("|%s pipe failed", cn.corename);
-			goto close_fail;
-		}
-	} else if (cn.core_type == COREDUMP_FILE) {
+	switch (cn.core_type) {
+	case COREDUMP_FILE: {
 		struct mnt_idmap *idmap;
 		struct inode *inode;
 		int open_flags = O_CREAT | O_WRONLY | O_NOFOLLOW |
@@ -796,6 +741,70 @@ void do_coredump(const kernel_siginfo_t *siginfo)
 		if (do_truncate(idmap, cprm.file->f_path.dentry,
 				0, 0, cprm.file))
 			goto close_fail;
+		break;
+	}
+	case COREDUMP_PIPE: {
+		int argi;
+		int dump_count;
+		char **helper_argv;
+		struct subprocess_info *sub_info;
+
+		if (cprm.limit == 1) {
+			/* See umh_coredump_setup() which sets RLIMIT_CORE = 1.
+			 *
+			 * Normally core limits are irrelevant to pipes, since
+			 * we're not writing to the file system, but we use
+			 * cprm.limit of 1 here as a special value, this is a
+			 * consistent way to catch recursive crashes.
+			 * We can still crash if the core_pattern binary sets
+			 * RLIM_CORE = !1, but it runs as root, and can do
+			 * lots of stupid things.
+			 *
+			 * Note that we use task_tgid_vnr here to grab the pid
+			 * of the process group leader.  That way we get the
+			 * right pid if a thread in a multi-threaded
+			 * core_pattern process dies.
+			 */
+			coredump_report_failure("RLIMIT_CORE is set to 1, aborting core");
+			goto fail_unlock;
+		}
+		cprm.limit = RLIM_INFINITY;
+
+		dump_count = atomic_inc_return(&core_dump_count);
+		if (core_pipe_limit && (core_pipe_limit < dump_count)) {
+			coredump_report_failure("over core_pipe_limit, skipping core dump");
+			goto fail_dropcount;
+		}
+
+		helper_argv = kmalloc_array(argc + 1, sizeof(*helper_argv),
+					    GFP_KERNEL);
+		if (!helper_argv) {
+			coredump_report_failure("%s failed to allocate memory", __func__);
+			goto fail_dropcount;
+		}
+		for (argi = 0; argi < argc; argi++)
+			helper_argv[argi] = cn.corename + argv[argi];
+		helper_argv[argi] = NULL;
+
+		retval = -ENOMEM;
+		sub_info = call_usermodehelper_setup(helper_argv[0],
+						helper_argv, NULL, GFP_KERNEL,
+						umh_coredump_setup, NULL, &cprm);
+		if (sub_info)
+			retval = call_usermodehelper_exec(sub_info,
+							  UMH_WAIT_EXEC);
+
+		kfree(helper_argv);
+		if (retval) {
+			coredump_report_failure("|%s pipe failed", cn.corename);
+			goto close_fail;
+		}
+		break;
+	}
+	default:
+		WARN_ON_ONCE(true);
+		retval = -EINVAL;
+		goto close_fail;
 	}
 
 	/* get us an unshared descriptor table; almost always a no-op */

-- 
2.47.2

[PATCH RFC 3/3] coredump: support AF_UNIX sockets

[Christian Brauner]

Coredumping currently supports two modes:

(1) Dumping directly into a file somewhere on the filesystem.
(2) Dumping into a pipe connected to a usermode helper process
    spawned as a child of the system_unbound_wq or kthreadd.

For simplicity I'm mostly ignoring (1). There's probably still some
users of (1) out there but processing coredumps in this way can be
considered adventurous especially in the face of set*id binaries.

The most common option should be (2) by now. It works by allowing
userspace to put a string into /proc/sys/kernel/core_pattern like:

        |/usr/lib/systemd/systemd-coredump %P %u %g %s %t %c %h

The "|" at the beginning indicates to the kernel that a pipe must be
used. The path following the pipe indicator is a path to a binary that
will be spawned as a usermode helper process. Any additional parameters
pass information about the task that is generating the coredump to the
binary that processes the coredump.

In this case systemd-coredump is spawned as a usermode helper. There's
various conceptual consequences of this (non-exhaustive list):

- systemd-coredump is spawned with file descriptor number 0 (stdin)
  to the read-end of the pipe. All other file descriptors are closed.
  That specifically includes 1 (stdout) and 2 (stderr). This has already
  caused bugs because userspace assumed that this cannot happen (Whether
  or not this is a sane assumption is irrelevant.).

- systemd-coredump will be spawned as a child of system_unbound_wq. So
  it is not a child of any userspace process and specifically not a
  child of PID 1 so it cannot be waited upon and is in general a weird
  hybrid upcall.

- systemd-coredump is spawned highly privileged as it is spawned with
  full kernel credentials requiring all kinds of weird privilege
  dropping excercises in userspaces.

This adds another mode:

(3) Dumping into a AF_UNIX socket.

Userspace can set /proc/sys/kernel/core_pattern to:

        :/run/coredump.socket

The ":" at the beginning indicates to the kernel that an AF_UNIX socket
is used to process coredumps. The task generating the coredump simply
connects to the socket and writes the coredump into the socket.

Userspace can get a stable handle on the task generating the coredump by
using the SO_PEERPIDFD socket option. SO_PEERPIDFD uses the thread-group
leader pid stashed during connect(). Even if the task generating the
coredump is a subthread in the thread-group the pidfd of the
thread-group leader is a reliable stable handle. Userspace that's
interested in the credentials of the specific thread that crashed can
use SCM_PIDFD to retrieve them.

The pidfd can be used to safely open and parse /proc/<pid> of the task
and it can also be used to retrieve additional meta information via the
PIDFD_GET_INFO ioctl().

This will allow userspace to not have to rely on usermode helpers for
processing coredumps and thus to stop having to handle super privileged
coredumping helpers.

This is easy to test:

(a) coredump processing (we're using socat):

    > cat coredump_socket.sh
    #!/bin/bash

    set -x

    sudo bash -c "echo ':/tmp/stream.sock' > /proc/sys/kernel/core_pattern"
    socat --statistics unix-listen:/tmp/stream.sock,fork FILE:core_file,create,append,truncate

(b) trigger a coredump:

    user1@localhost:~/data/scripts$ cat crash.c
    #include <stdio.h>
    #include <unistd.h>

    int main(int argc, char *argv[])
    {
            fprintf(stderr, "%u\n", (1 / 0));
            _exit(0);
    }

Signed-off-by: Christian Brauner <brauner@kernel.org>
---
 fs/coredump.c | 83 +++++++++++++++++++++++++++++++++++++++++++++++++++++++++--
 1 file changed, 81 insertions(+), 2 deletions(-)

diff --git a/fs/coredump.c b/fs/coredump.c
index 1779299b8c61..db914ff20a5e 100644
--- a/fs/coredump.c
+++ b/fs/coredump.c
@@ -45,6 +45,9 @@
 #include <linux/elf.h>
 #include <linux/pidfs.h>
 #include <uapi/linux/pidfd.h>
+#include <linux/net.h>
+#include <uapi/linux/un.h>
+#include <linux/socket.h>
 
 #include <linux/uaccess.h>
 #include <asm/mmu_context.h>
@@ -79,6 +82,7 @@ unsigned int core_file_note_size_limit = CORE_FILE_NOTE_SIZE_DEFAULT;
 enum coredump_type_t {
 	COREDUMP_FILE = 1,
 	COREDUMP_PIPE = 2,
+	COREDUMP_SOCK = 3,
 };
 
 struct core_name {
@@ -232,13 +236,16 @@ static int format_corename(struct core_name *cn, struct coredump_params *cprm,
 	cn->corename = NULL;
 	if (*pat_ptr == '|')
 		cn->core_type = COREDUMP_PIPE;
+	else if (*pat_ptr == ':')
+		cn->core_type = COREDUMP_SOCK;
 	else
 		cn->core_type = COREDUMP_FILE;
 	if (expand_corename(cn, core_name_size))
 		return -ENOMEM;
 	cn->corename[0] = '\0';
 
-	if (cn->core_type == COREDUMP_PIPE) {
+	switch (cn->core_type) {
+	case COREDUMP_PIPE: {
 		int argvs = sizeof(core_pattern) / 2;
 		(*argv) = kmalloc_array(argvs, sizeof(**argv), GFP_KERNEL);
 		if (!(*argv))
@@ -247,6 +254,35 @@ static int format_corename(struct core_name *cn, struct coredump_params *cprm,
 		++pat_ptr;
 		if (!(*pat_ptr))
 			return -ENOMEM;
+		break;
+	}
+	case COREDUMP_SOCK: {
+		/* skip ':' */
+		++pat_ptr;
+		/* no spaces */
+		if (!(*pat_ptr))
+			return -EINVAL;
+		/* must be an absolute path */
+		if (!(*pat_ptr == '/'))
+			return -EINVAL;
+		err = cn_printf(cn, "%s", pat_ptr);
+		if (err)
+			return err;
+		/*
+		 * No need to parse any other options. Relevant
+		 * information can be retrieved from the peer pidfd
+		 * retrievable via SO_PEERPIDFD by the receiver or via
+		 * /proc/<pid>, using the SO_PEERPIDFD to guard against
+		 * pid recycling when opening /proc/<pid>.
+		 *
+		 * Hell, we could even add a PIDFD_COREDUMP struct
+		 * retrievable via an ioctl.
+		 */
+		return 0;
+	}
+	default:
+		WARN_ON_ONCE(cn->core_type != COREDUMP_FILE);
+		break;
 	}
 
 	/* Repeat as long as we have more pattern to process and more output
@@ -801,6 +837,49 @@ void do_coredump(const kernel_siginfo_t *siginfo)
 		}
 		break;
 	}
+	case COREDUMP_SOCK: {
+		struct file *file __free(fput) = NULL;
+		struct sockaddr_un unix_addr = {
+			.sun_family = AF_UNIX,
+		};
+		struct sockaddr_storage *addr;
+
+		retval = strscpy(unix_addr.sun_path, cn.corename, sizeof(unix_addr.sun_path));
+		if (retval < 0)
+			goto close_fail;
+
+		file = __sys_socket_file(AF_UNIX, SOCK_STREAM, 0);
+		if (IS_ERR(file))
+			goto close_fail;
+
+		/*
+		 * It is possible that the userspace process which is
+		 * supposed to handle the coredump and is listening on
+		 * the AF_UNIX socket coredumps. This should be fine
+		 * though. If this was the only process which was
+		 * listen()ing on the AF_UNIX socket for coredumps it
+		 * obviously won't be listen()ing anymore by the time it
+		 * gets here. So the __sys_connect_file() call will
+		 * often fail with ECONNREFUSED and the coredump.
+		 *
+		 * In general though, userspace should just mark itself
+		 * non dumpable and not do any of this nonsense. We
+		 * shouldn't work around this.
+		 */
+		addr = (struct sockaddr_storage *)(&unix_addr);
+		retval = __sys_connect_file(file, addr, sizeof(unix_addr), O_CLOEXEC);
+		if (retval)
+			goto close_fail;
+
+		/* The peer isn't supposed to write and we for sure won't read. */
+		retval =  __sys_shutdown_sock(sock_from_file(file), SHUT_RD);
+		if (retval)
+			goto close_fail;
+
+		cprm.file = no_free_ptr(file);
+		cprm.limit = RLIM_INFINITY;
+		break;
+	}
 	default:
 		WARN_ON_ONCE(true);
 		retval = -EINVAL;
@@ -1070,7 +1149,7 @@ EXPORT_SYMBOL(dump_align);
 void validate_coredump_safety(void)
 {
 	if (suid_dumpable == SUID_DUMP_ROOT &&
-	    core_pattern[0] != '/' && core_pattern[0] != '|') {
+	    core_pattern[0] != '/' && core_pattern[0] != '|' && core_pattern[0] != ':') {
 
 		coredump_report_failure("Unsafe core_pattern used with fs.suid_dumpable=2: "
 			"pipe handler or fully qualified core dump path required. "

-- 
2.47.2

Re: [PATCH RFC 3/3] coredump: support AF_UNIX sockets

[Christian Brauner]

> This is easy to test:
> 
> (a) coredump processing (we're using socat):
> 
>     > cat coredump_socket.sh
>     #!/bin/bash
> 
>     set -x
> 
>     sudo bash -c "echo ':/tmp/stream.sock' > /proc/sys/kernel/core_pattern"
>     socat --statistics unix-listen:/tmp/stream.sock,fork FILE:core_file,create,append,truncate

Don't use "truncate" please. It's not a socat option and it won't work.
The correct option is "trunc".

Re: [PATCH RFC 3/3] coredump: support AF_UNIX sockets

[Kuniyuki Iwashima]

From: Christian Brauner <brauner@kernel.org>
Date: Wed, 30 Apr 2025 13:05:03 +0200
> @@ -801,6 +837,49 @@ void do_coredump(const kernel_siginfo_t *siginfo)
>  		}
>  		break;
>  	}
> +	case COREDUMP_SOCK: {
> +		struct file *file __free(fput) = NULL;
> +		struct sockaddr_un unix_addr = {
> +			.sun_family = AF_UNIX,
> +		};
> +		struct sockaddr_storage *addr;
> +
> +		retval = strscpy(unix_addr.sun_path, cn.corename, sizeof(unix_addr.sun_path));
> +		if (retval < 0)
> +			goto close_fail;
> +
> +		file = __sys_socket_file(AF_UNIX, SOCK_STREAM, 0);
> +		if (IS_ERR(file))
> +			goto close_fail;
> +
> +		/*
> +		 * It is possible that the userspace process which is
> +		 * supposed to handle the coredump and is listening on
> +		 * the AF_UNIX socket coredumps. This should be fine
> +		 * though. If this was the only process which was
> +		 * listen()ing on the AF_UNIX socket for coredumps it
> +		 * obviously won't be listen()ing anymore by the time it
> +		 * gets here. So the __sys_connect_file() call will
> +		 * often fail with ECONNREFUSED and the coredump.
> +		 *
> +		 * In general though, userspace should just mark itself
> +		 * non dumpable and not do any of this nonsense. We
> +		 * shouldn't work around this.
> +		 */
> +		addr = (struct sockaddr_storage *)(&unix_addr);
> +		retval = __sys_connect_file(file, addr, sizeof(unix_addr), O_CLOEXEC);

The 3rd argument should be offsetof(struct sockaddr_un, sun_path)
+ retval of strscpy() above ?

I guess you could see an unexpected error when
CONFIG_INIT_STACK_NONE=y and cn.corename has garbage at tail.

Re: [PATCH RFC 3/3] coredump: support AF_UNIX sockets

[kernel test robot]

Hi Christian,

[This is a private test report for your RFC patch.]
kernel test robot noticed the following build errors:

[auto build test ERROR on 80e14080a00bc429a4ee440d17746a49867df663]

url:    https://github.com/intel-lab-lkp/linux/commits/Christian-Brauner/coredump-massage-format_corname/20250430-191417
base:   80e14080a00bc429a4ee440d17746a49867df663
patch link:    https://lore.kernel.org/r/20250430-work-coredump-socket-v1-3-2faf027dbb47%40kernel.org
patch subject: [PATCH RFC 3/3] coredump: support AF_UNIX sockets
config: csky-randconfig-001-20250501 (https://download.01.org/0day-ci/archive/20250502/202505020158.k0MgUz2u-lkp@intel.com/config)
compiler: csky-linux-gcc (GCC) 13.3.0
reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250502/202505020158.k0MgUz2u-lkp@intel.com/reproduce)

If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp@intel.com>
| Closes: https://lore.kernel.org/oe-kbuild-all/202505020158.k0MgUz2u-lkp@intel.com/

All errors (new ones prefixed by >>):

   csky-linux-ld: fs/coredump.o: in function `do_coredump':
   fs/coredump.c:851:(.text+0x1338): undefined reference to `__sys_socket_file'
>> csky-linux-ld: fs/coredump.c:870:(.text+0x1352): undefined reference to `__sys_connect_file'
>> csky-linux-ld: fs/coredump.c:875:(.text+0x135e): undefined reference to `sock_from_file'
>> csky-linux-ld: fs/coredump.c:875:(.text+0x1364): undefined reference to `__sys_shutdown_sock'
   csky-linux-ld: fs/coredump.o: in function `do_coredump':
>> arch/csky/include/asm/irqflags.h:38:(.text+0x1488): undefined reference to `__sys_socket_file'
>> csky-linux-ld: arch/csky/include/asm/irqflags.h:38:(.text+0x148c): undefined reference to `__sys_connect_file'
>> csky-linux-ld: arch/csky/include/asm/irqflags.h:38:(.text+0x1490): undefined reference to `sock_from_file'
>> csky-linux-ld: arch/csky/include/asm/irqflags.h:38:(.text+0x1494): undefined reference to `__sys_shutdown_sock'
   `.exit.text' referenced in section `__jump_table' of drivers/rapidio/rio_cm.o: defined in discarded section `.exit.text' of drivers/rapidio/rio_cm.o
   `.exit.text' referenced in section `__jump_table' of drivers/rapidio/rio_cm.o: defined in discarded section `.exit.text' of drivers/rapidio/rio_cm.o
   `.exit.text' referenced in section `__jump_table' of drivers/rapidio/switches/idt_gen2.o: defined in discarded section `.exit.text' of drivers/rapidio/switches/idt_gen2.o
   `.exit.text' referenced in section `__jump_table' of drivers/rapidio/switches/idt_gen2.o: defined in discarded section `.exit.text' of drivers/rapidio/switches/idt_gen2.o
   `.exit.text' referenced in section `__jump_table' of drivers/rapidio/switches/idt_gen2.o: defined in discarded section `.exit.text' of drivers/rapidio/switches/idt_gen2.o
   `.exit.text' referenced in section `__jump_table' of drivers/rapidio/switches/idt_gen2.o: defined in discarded section `.exit.text' of drivers/rapidio/switches/idt_gen2.o
   `.exit.text' referenced in section `__jump_table' of drivers/misc/phantom.o: defined in discarded section `.exit.text' of drivers/misc/phantom.o
   `.exit.text' referenced in section `__jump_table' of drivers/misc/phantom.o: defined in discarded section `.exit.text' of drivers/misc/phantom.o

-- 
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki

Re: [PATCH RFC 3/3] coredump: support AF_UNIX sockets

[kernel test robot]

Hi Christian,

[This is a private test report for your RFC patch.]
kernel test robot noticed the following build errors:

[auto build test ERROR on 80e14080a00bc429a4ee440d17746a49867df663]

url:    https://github.com/intel-lab-lkp/linux/commits/Christian-Brauner/coredump-massage-format_corname/20250430-191417
base:   80e14080a00bc429a4ee440d17746a49867df663
patch link:    https://lore.kernel.org/r/20250430-work-coredump-socket-v1-3-2faf027dbb47%40kernel.org
patch subject: [PATCH RFC 3/3] coredump: support AF_UNIX sockets
config: nios2-randconfig-002-20250501 (https://download.01.org/0day-ci/archive/20250502/202505020143.Kuje6Wsb-lkp@intel.com/config)
compiler: nios2-linux-gcc (GCC) 7.5.0
reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250502/202505020143.Kuje6Wsb-lkp@intel.com/reproduce)

If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp@intel.com>
| Closes: https://lore.kernel.org/oe-kbuild-all/202505020143.Kuje6Wsb-lkp@intel.com/

All errors (new ones prefixed by >>):

   nios2-linux-ld: fs/coredump.o: in function `do_coredump':
   fs/coredump.c:851: undefined reference to `__sys_socket_file'
>> fs/coredump.c:851:(.text+0x14b4): relocation truncated to fit: R_NIOS2_CALL26 against `__sys_socket_file'
>> nios2-linux-ld: fs/coredump.c:870: undefined reference to `__sys_connect_file'
>> fs/coredump.c:870:(.text+0x14d4): relocation truncated to fit: R_NIOS2_CALL26 against `__sys_connect_file'
>> nios2-linux-ld: fs/coredump.c:875: undefined reference to `sock_from_file'
>> fs/coredump.c:875:(.text+0x14e0): relocation truncated to fit: R_NIOS2_CALL26 against `sock_from_file'
>> nios2-linux-ld: fs/coredump.c:875: undefined reference to `__sys_shutdown_sock'
>> fs/coredump.c:875:(.text+0x14ec): relocation truncated to fit: R_NIOS2_CALL26 against `__sys_shutdown_sock'


vim +851 fs/coredump.c

   621	
   622	void do_coredump(const kernel_siginfo_t *siginfo)
   623	{
   624		struct core_state core_state;
   625		struct core_name cn;
   626		struct mm_struct *mm = current->mm;
   627		struct linux_binfmt * binfmt;
   628		const struct cred *old_cred;
   629		struct cred *cred;
   630		int retval = 0;
   631		size_t *argv = NULL;
   632		int argc = 0;
   633		/* require nonrelative corefile path and be extra careful */
   634		bool need_suid_safe = false;
   635		bool core_dumped = false;
   636		static atomic_t core_dump_count = ATOMIC_INIT(0);
   637		struct coredump_params cprm = {
   638			.siginfo = siginfo,
   639			.limit = rlimit(RLIMIT_CORE),
   640			/*
   641			 * We must use the same mm->flags while dumping core to avoid
   642			 * inconsistency of bit flags, since this flag is not protected
   643			 * by any locks.
   644			 */
   645			.mm_flags = mm->flags,
   646			.vma_meta = NULL,
   647			.cpu = raw_smp_processor_id(),
   648		};
   649	
   650		audit_core_dumps(siginfo->si_signo);
   651	
   652		binfmt = mm->binfmt;
   653		if (!binfmt || !binfmt->core_dump)
   654			goto fail;
   655		if (!__get_dumpable(cprm.mm_flags))
   656			goto fail;
   657	
   658		cred = prepare_creds();
   659		if (!cred)
   660			goto fail;
   661		/*
   662		 * We cannot trust fsuid as being the "true" uid of the process
   663		 * nor do we know its entire history. We only know it was tainted
   664		 * so we dump it as root in mode 2, and only into a controlled
   665		 * environment (pipe handler or fully qualified path).
   666		 */
   667		if (__get_dumpable(cprm.mm_flags) == SUID_DUMP_ROOT) {
   668			/* Setuid core dump mode */
   669			cred->fsuid = GLOBAL_ROOT_UID;	/* Dump root private */
   670			need_suid_safe = true;
   671		}
   672	
   673		retval = coredump_wait(siginfo->si_signo, &core_state);
   674		if (retval < 0)
   675			goto fail_creds;
   676	
   677		old_cred = override_creds(cred);
   678	
   679		retval = format_corename(&cn, &cprm, &argv, &argc);
   680		if (retval < 0) {
   681			coredump_report_failure("format_corename failed, aborting core");
   682			goto fail_unlock;
   683		}
   684	
   685		switch (cn.core_type) {
   686		case COREDUMP_FILE: {
   687			struct mnt_idmap *idmap;
   688			struct inode *inode;
   689			int open_flags = O_CREAT | O_WRONLY | O_NOFOLLOW |
   690					 O_LARGEFILE | O_EXCL;
   691	
   692			if (cprm.limit < binfmt->min_coredump)
   693				goto fail_unlock;
   694	
   695			if (need_suid_safe && cn.corename[0] != '/') {
   696				coredump_report_failure(
   697					"this process can only dump core to a fully qualified path, skipping core dump");
   698				goto fail_unlock;
   699			}
   700	
   701			/*
   702			 * Unlink the file if it exists unless this is a SUID
   703			 * binary - in that case, we're running around with root
   704			 * privs and don't want to unlink another user's coredump.
   705			 */
   706			if (!need_suid_safe) {
   707				/*
   708				 * If it doesn't exist, that's fine. If there's some
   709				 * other problem, we'll catch it at the filp_open().
   710				 */
   711				do_unlinkat(AT_FDCWD, getname_kernel(cn.corename));
   712			}
   713	
   714			/*
   715			 * There is a race between unlinking and creating the
   716			 * file, but if that causes an EEXIST here, that's
   717			 * fine - another process raced with us while creating
   718			 * the corefile, and the other process won. To userspace,
   719			 * what matters is that at least one of the two processes
   720			 * writes its coredump successfully, not which one.
   721			 */
   722			if (need_suid_safe) {
   723				/*
   724				 * Using user namespaces, normal user tasks can change
   725				 * their current->fs->root to point to arbitrary
   726				 * directories. Since the intention of the "only dump
   727				 * with a fully qualified path" rule is to control where
   728				 * coredumps may be placed using root privileges,
   729				 * current->fs->root must not be used. Instead, use the
   730				 * root directory of init_task.
   731				 */
   732				struct path root;
   733	
   734				task_lock(&init_task);
   735				get_fs_root(init_task.fs, &root);
   736				task_unlock(&init_task);
   737				cprm.file = file_open_root(&root, cn.corename,
   738							   open_flags, 0600);
   739				path_put(&root);
   740			} else {
   741				cprm.file = filp_open(cn.corename, open_flags, 0600);
   742			}
   743			if (IS_ERR(cprm.file))
   744				goto fail_unlock;
   745	
   746			inode = file_inode(cprm.file);
   747			if (inode->i_nlink > 1)
   748				goto close_fail;
   749			if (d_unhashed(cprm.file->f_path.dentry))
   750				goto close_fail;
   751			/*
   752			 * AK: actually i see no reason to not allow this for named
   753			 * pipes etc, but keep the previous behaviour for now.
   754			 */
   755			if (!S_ISREG(inode->i_mode))
   756				goto close_fail;
   757			/*
   758			 * Don't dump core if the filesystem changed owner or mode
   759			 * of the file during file creation. This is an issue when
   760			 * a process dumps core while its cwd is e.g. on a vfat
   761			 * filesystem.
   762			 */
   763			idmap = file_mnt_idmap(cprm.file);
   764			if (!vfsuid_eq_kuid(i_uid_into_vfsuid(idmap, inode),
   765					    current_fsuid())) {
   766				coredump_report_failure("Core dump to %s aborted: "
   767					"cannot preserve file owner", cn.corename);
   768				goto close_fail;
   769			}
   770			if ((inode->i_mode & 0677) != 0600) {
   771				coredump_report_failure("Core dump to %s aborted: "
   772					"cannot preserve file permissions", cn.corename);
   773				goto close_fail;
   774			}
   775			if (!(cprm.file->f_mode & FMODE_CAN_WRITE))
   776				goto close_fail;
   777			if (do_truncate(idmap, cprm.file->f_path.dentry,
   778					0, 0, cprm.file))
   779				goto close_fail;
   780			break;
   781		}
   782		case COREDUMP_PIPE: {
   783			int argi;
   784			int dump_count;
   785			char **helper_argv;
   786			struct subprocess_info *sub_info;
   787	
   788			if (cprm.limit == 1) {
   789				/* See umh_coredump_setup() which sets RLIMIT_CORE = 1.
   790				 *
   791				 * Normally core limits are irrelevant to pipes, since
   792				 * we're not writing to the file system, but we use
   793				 * cprm.limit of 1 here as a special value, this is a
   794				 * consistent way to catch recursive crashes.
   795				 * We can still crash if the core_pattern binary sets
   796				 * RLIM_CORE = !1, but it runs as root, and can do
   797				 * lots of stupid things.
   798				 *
   799				 * Note that we use task_tgid_vnr here to grab the pid
   800				 * of the process group leader.  That way we get the
   801				 * right pid if a thread in a multi-threaded
   802				 * core_pattern process dies.
   803				 */
   804				coredump_report_failure("RLIMIT_CORE is set to 1, aborting core");
   805				goto fail_unlock;
   806			}
   807			cprm.limit = RLIM_INFINITY;
   808	
   809			dump_count = atomic_inc_return(&core_dump_count);
   810			if (core_pipe_limit && (core_pipe_limit < dump_count)) {
   811				coredump_report_failure("over core_pipe_limit, skipping core dump");
   812				goto fail_dropcount;
   813			}
   814	
   815			helper_argv = kmalloc_array(argc + 1, sizeof(*helper_argv),
   816						    GFP_KERNEL);
   817			if (!helper_argv) {
   818				coredump_report_failure("%s failed to allocate memory", __func__);
   819				goto fail_dropcount;
   820			}
   821			for (argi = 0; argi < argc; argi++)
   822				helper_argv[argi] = cn.corename + argv[argi];
   823			helper_argv[argi] = NULL;
   824	
   825			retval = -ENOMEM;
   826			sub_info = call_usermodehelper_setup(helper_argv[0],
   827							helper_argv, NULL, GFP_KERNEL,
   828							umh_coredump_setup, NULL, &cprm);
   829			if (sub_info)
   830				retval = call_usermodehelper_exec(sub_info,
   831								  UMH_WAIT_EXEC);
   832	
   833			kfree(helper_argv);
   834			if (retval) {
   835				coredump_report_failure("|%s pipe failed", cn.corename);
   836				goto close_fail;
   837			}
   838			break;
   839		}
   840		case COREDUMP_SOCK: {
   841			struct file *file __free(fput) = NULL;
   842			struct sockaddr_un unix_addr = {
   843				.sun_family = AF_UNIX,
   844			};
   845			struct sockaddr_storage *addr;
   846	
   847			retval = strscpy(unix_addr.sun_path, cn.corename, sizeof(unix_addr.sun_path));
   848			if (retval < 0)
   849				goto close_fail;
   850	
 > 851			file = __sys_socket_file(AF_UNIX, SOCK_STREAM, 0);
   852			if (IS_ERR(file))
   853				goto close_fail;
   854	
   855			/*
   856			 * It is possible that the userspace process which is
   857			 * supposed to handle the coredump and is listening on
   858			 * the AF_UNIX socket coredumps. This should be fine
   859			 * though. If this was the only process which was
   860			 * listen()ing on the AF_UNIX socket for coredumps it
   861			 * obviously won't be listen()ing anymore by the time it
   862			 * gets here. So the __sys_connect_file() call will
   863			 * often fail with ECONNREFUSED and the coredump.
   864			 *
   865			 * In general though, userspace should just mark itself
   866			 * non dumpable and not do any of this nonsense. We
   867			 * shouldn't work around this.
   868			 */
   869			addr = (struct sockaddr_storage *)(&unix_addr);
 > 870			retval = __sys_connect_file(file, addr, sizeof(unix_addr), O_CLOEXEC);
   871			if (retval)
   872				goto close_fail;
   873	
   874			/* The peer isn't supposed to write and we for sure won't read. */
 > 875			retval =  __sys_shutdown_sock(sock_from_file(file), SHUT_RD);
   876			if (retval)
   877				goto close_fail;
   878	
   879			cprm.file = no_free_ptr(file);
   880			cprm.limit = RLIM_INFINITY;
   881			break;
   882		}
   883		default:
   884			WARN_ON_ONCE(true);
   885			retval = -EINVAL;
   886			goto close_fail;
   887		}
   888	
   889		/* get us an unshared descriptor table; almost always a no-op */
   890		/* The cell spufs coredump code reads the file descriptor tables */
   891		retval = unshare_files();
   892		if (retval)
   893			goto close_fail;
   894		if (!dump_interrupted()) {
   895			/*
   896			 * umh disabled with CONFIG_STATIC_USERMODEHELPER_PATH="" would
   897			 * have this set to NULL.
   898			 */
   899			if (!cprm.file) {
   900				coredump_report_failure("Core dump to |%s disabled", cn.corename);
   901				goto close_fail;
   902			}
   903			if (!dump_vma_snapshot(&cprm))
   904				goto close_fail;
   905	
   906			file_start_write(cprm.file);
   907			core_dumped = binfmt->core_dump(&cprm);
   908			/*
   909			 * Ensures that file size is big enough to contain the current
   910			 * file postion. This prevents gdb from complaining about
   911			 * a truncated file if the last "write" to the file was
   912			 * dump_skip.
   913			 */
   914			if (cprm.to_skip) {
   915				cprm.to_skip--;
   916				dump_emit(&cprm, "", 1);
   917			}
   918			file_end_write(cprm.file);
   919			free_vma_snapshot(&cprm);
   920		}
   921		if ((cn.core_type == COREDUMP_PIPE) && core_pipe_limit)
   922			wait_for_dump_helpers(cprm.file);
   923	close_fail:
   924		if (cprm.file)
   925			filp_close(cprm.file, NULL);
   926	fail_dropcount:
   927		if (cn.core_type == COREDUMP_PIPE)
   928			atomic_dec(&core_dump_count);
   929	fail_unlock:
   930		kfree(argv);
   931		kfree(cn.corename);
   932		coredump_finish(core_dumped);
   933		revert_creds(old_cred);
   934	fail_creds:
   935		put_cred(cred);
   936	fail:
   937		return;
   938	}
   939	

-- 
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki

Re: [PATCH RFC 0/3] coredump: support AF_UNIX sockets

[Christian Brauner]

> This is easy to test:
> 
> (a) coredump processing (we're using socat):
> 
>     > cat coredump_socket.sh
>     #!/bin/bash
>     
>     set -x
>     
>     sudo bash -c "echo ':/tmp/stream.sock' > /proc/sys/kernel/core_pattern"
>     socat --statistics unix-listen:/tmp/stream.sock,fork FILE:core_file,create,append,truncate

Don't use "truncate" please. It's not a socat option and it won't work.
The correct option is "trunc".