[Okta Webinar] Learn how to a build a cloud-first strategyRegister Now

x
?
Solved

Core dump of app running as 'root'

Posted on 2006-05-12
13
Medium Priority
?
855 Views
Last Modified: 2012-08-13
We are running Mandrake 10.1

Some of our apps have to run as root for different reasons. We noticed that none of these apps core dump while all the apps that run as regular user create core dumps. Is there anything we have to set differently for root?

=====
Werner
0
Comment
Question by:griessh
  • 5
  • 3
  • 2
  • +2
13 Comments
 
LVL 24

Expert Comment

by:slyong
ID: 16673057
It really depends on what the programs do and if they are developed properly.  I can think of an example:

1) Open a file
2) Write something to the file
3) Close the file
4) Exit

A simple program to do that would core dump if the file permission is not correct.  So if you are root, you can access the file, but when you are not, then because there is no check on whether a file is opened properly, the program will core dump.
0
 
LVL 43

Expert Comment

by:ravenpl
ID: 16673061
if the application is suid installed and spawned by regular user - it will not core dump.
0
 
LVL 35

Expert Comment

by:Duncan Roe
ID: 16673208
It may be that the root applications run with ulimit -c 0 (max size of core dump = 0 i.e. don't dump). Well written apps never coredump anyway once in production - but I guess you are expecting dumps for some reason.
The script that starts the program could do a "ulimit -c unlimited", but be warned a non-root coredump can't fill a disk (i.e. it can get "disk full" but the safety margin reserved for root will still be there, so directories can be updated properly &c). A root process coredumping can fill the safety margin, which can lead to serious filesystem corruption.
0
What does it mean to be "Always On"?

Is your cloud always on? With an Always On cloud you won't have to worry about downtime for maintenance or software application code updates, ensuring that your bottom line isn't affected.

 
LVL 11

Author Comment

by:griessh
ID: 16673573
sylong
thanks, but you missed the issue

duncan
thanks, I am pretty sure we addressed the ulimit value already.

ravenpl
WHY? It core dumped on other UNIX flavors. Ther is no reason forthat limitation.

=====
Werner
0
 
LVL 3

Expert Comment

by:leisner
ID: 16679138
where is the processes current directory when it tries to dump core...  Can it write there?

Programs that dump core as root are not a good think...

It it would dump core, do you know where to look?

How do you know its supposed to dump core?

Try running the program and hitting it with a core dump signal (like sigABRT) and seeing what happens....

0
 
LVL 11

Author Comment

by:griessh
ID: 16691655
leisner, thanks

>> Can it write there
Yes, absolutely, we are writing log files in that directory.

>> dump core as root are not a good think
Welcome to a developer's life :-)

>> How do you know its supposed to dump core?
Because my signal handler logs Sig 11 and Sig 6

>> and seeing what happens (I send sig 11)
always a log, never a core
0
 
LVL 35

Expert Comment

by:Duncan Roe
ID: 16694569
If you have a signal handler, it will catch the signal and you won't get a core dump. Your signal handler needs to raise another signal that *will* dump core. You are catching SIGABRT & SIGSEGV, so you could use say SIGQUIT: after logging a message, the handlers could do something like:-
   raise(SIGQUIT);
0
 
LVL 3

Expert Comment

by:leisner
ID: 16694827
or just abort() after logging the signal...

0
 
LVL 11

Author Comment

by:griessh
ID: 16695172
duncan

point well taken, that is already implemented (Check my question and you will see that it works for other users)

leisner

I need the core to debug the problem :-(
0
 
LVL 35

Expert Comment

by:Duncan Roe
ID: 16697401
leisner - I suspect abort() would be no good since griessh is catching SIGABRT

griessh - when running as a normal user, do you get a message like:

    Quit (core dumped)

before the dump? (Assuming here your signal handlers raise SIGQUIT)

And then as root do you get a message like:

    Quit

i.e. the same message but without " (core dumped)"?

Please also post the code of a signal handler and the line that registers it
0
 
LVL 11

Author Comment

by:griessh
ID: 16701031
We don't use QUIT.

I can't post code, because it is proprietary code. We use that signal handler on several other **IXs withour any problem.

When I googled for this issue, I found that many Linux versions had that problem, some of them have patches for the kernel to allow core dumps for root processses. I guess it has to do with security settings in the kernel. I had hoped somebody knows more about it.

=====
Werner
0
 
LVL 43

Accepted Solution

by:
ravenpl earned 2000 total points
ID: 16715660
> if the application is suid installed and spawned by regular user - it will not core dump.
The reason is security(maybe too tight).
man prctl # flag PR_SET_DUMPABLE
0
 
LVL 11

Author Comment

by:griessh
ID: 16743320
Thanks ravenpl

prctl (PR_SET_DUMPABLE,1) enables the core file.

It seems ther is still hopw for EE after all :-)

=====
Werner
0

Featured Post

Nothing ever in the clear!

This technical paper will help you implement VMware’s VM encryption as well as implement Veeam encryption which together will achieve the nothing ever in the clear goal. If a bad guy steals VMs, backups or traffic they get nothing.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

The purpose of this article is to fix the unknown display problem in Linux Mint operating system. After installing the OS if you see Display monitor is not recognized then we can install "MESA" utilities to fix this problem or we can install additio…
The purpose of this article is to demonstrate how we can upgrade Python from version 2.7.6 to Python 2.7.10 on the Linux Mint operating system. I am using an Oracle Virtual Box where I have installed Linux Mint operating system version 17.2. Once yo…
We’ve all felt that sense of false security before—locking down external access to a database or component and feeling like we’ve done all we need to do to secure company data. But that feeling is fleeting. Attacks these days can happen in many w…
With just a little bit of  SQL and VBA, many doors open to cool things like synchronize a list box to display data relevant to other information on a form.  If you have never written code or looked at an SQL statement before, no problem! ...  give i…
Suggested Courses
Course of the Month19 days, 23 hours left to enroll

873 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question