* %e in /proc/sys/kernel/core_pattern and empty current->comm
@ 2011-08-28 16:45 Earl Chew
0 siblings, 0 replies; only message in thread
From: Earl Chew @ 2011-08-28 16:45 UTC (permalink / raw)
To: linux-kernel
It is possible to set /proc/sys/kernel/core_pattern to %e:
echo '%e' > /proc/sys/kernel/core_pattern
A couple of interesting effects:
a. Cores will tend to try to overwrite the executable.
Is this considered an issue ?
b. Apparently it seems possible to set current->comm to be empty:
prctl(PR_SET_NAME, "", 0, 0, 0);
No core dump is generated since the resulting corename is empty,
and filp_open() fails.
Is this considered a defect, or potential security concern ?
c. Consequential to (b), setting /proc/sys/kernel/core_pattern to empty
and /proc/sys/kernel/core_uses_pid to zero universally prevents
core dumps.
I'm wondering if this behaviour is provided intentionally.
Earl
^ permalink raw reply [flat|nested] only message in thread
only message in thread, other threads:[~2011-08-28 16:50 UTC | newest]
Thread overview: (only message) (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2011-08-28 16:45 %e in /proc/sys/kernel/core_pattern and empty current->comm Earl Chew
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox