Re: [Feature Request?] Inline compression of process core dumps

Christopher S. Aker
2007-04-13T13:39:03Z

Alan Cox wrote:
>> Looking at the code, it seems to me that format_corename() is appending
>> .pid, regardless if !core_uses_pid and corename[0]=='|', in which case
>> it creates an invalid path for call_usermodehelper_pipe().
>>
>> Bug in the code, or bug in my methods?
>
> This looks somewhat better and might do the trick. Also fixes a very very
> obscure security corner case. If you change core pattern to start with
> the program name then the user can run a program called "|myevilhack" as
> it stands. The patch checks for "|" in the pattern not the output and
> doesn't nail a pid on to a piped name.

<snip>

Works great now. Queue this sucker up!

# cat /proc/sys/kernel/core_pattern
|/home/caker/bin/dumper.pl
# ./linux
<blah blah>
Segmentation fault (core dumped)
# file /tmp/dumper.out
/tmp/dumper.out: ELF 32-bit LSB core file Intel 80386, version 1
(SYSV), SVR4-style

Thanks for everyone's help.

-Chris