Re: core_pattern pipe documentation

Neil Horman
2008-04-23T14:59:33Z

On Wed, Apr 23, 2008 at 02:09:14PM +0200, Michael Kerrisk wrote:
> Andi -- ping!
>
> Adding Neil to CC, since it looks like he also did some work here, and
> so can perhaps comment.
>
> On Fri, Apr 18, 2008 at 6:53 PM, Michael Kerrisk
> <mtk.manpages-gM/Ye1E23mwN+BqQ9rBEUg@public.gmane.org> wrote:
> > Andi,
> >
> > I wrote the following description of the core_pattern pipe feature. Does this
> > seem okay?
> >
> > Piping core dumps to a program
> > Since kernel 2.6.19, Linux supports an alternate syntax
> > for the /proc/sys/kernel/core_pattern file. If the first
> > character of this file is a pipe symbol (|), then the
> > remainder of the line is interpreted as a program to be
> > executed. Instead of being written to a disk file, the
> > core dump is given as standard input to the program.
> > Note the following points:
> >
> > * The program must be specified using an absolute path-
> > name (or a pathname relative to the root directory,
> > /), and must immediately follow the '|' character.
> >
> > * The process created to run the program runs as user
> > and group root.
> >
> > * Arguments can be supplied to the program, delimited by
> > white space (up to a total line length of 128 bytes).
> >
> > Cheers,
> >
> > Michael
> >
Thanks for CC'ing me. The above all looks good. I would add documentation
however, about the available macros that can be used when core_pattern is
specified as a pipe. Adding something like the following would be good:

* Arguments can be statically declared or implied via the use of macros,
denoted by the use of the %sign. The following macros are supported:
* %% - output a literal % sign on the command line
* %p - the pid of the crashing process
* %u - the uid of the crashing process
* %g - the gid of the crashing process
* %s - the signal that caused the crashing process to crash
* %t - the time the crashing process dumped
* %h - the hostname of the system
* %e - the executable name of the crashing process
* %c - the core limit size of the crashing process

Note that the core limit size macro may be a different value than what
is returned by getrlimit(RLIMIT_CORE,...). This is due to the fact
that the core_pattern specified executible will be run as the same uid
as the crashing process, and to facilitate reception of the entire
core, the kernel will temporarily set RLIMIT_CORE to unlimited while
the dump is in progress. Note also %u and %g may be different values
than getuid/getgid in the event that the core_pattern executable is
set[u|g]id root

Thanks & Regards
Neil

--
/***************************************************
*Neil Horman
*nhorman-2XuSBdqkA4R54TAoqtyWWQ@public.gmane.org
*gpg keyid: 1024D / 0x92A74FA1
*http://pgp.mit.edu
***************************************************/