%e in /proc/sys/kernel/core_pattern and empty current->comm
From: Earl Chew
Date: Sun Aug 28 2011 - 12:50:05 EST
It is possible to set /proc/sys/kernel/core_pattern to %e:
echo '%e' > /proc/sys/kernel/core_pattern
A couple of interesting effects:
a. Cores will tend to try to overwrite the executable.
Is this considered an issue ?
b. Apparently it seems possible to set current->comm to be empty:
prctl(PR_SET_NAME, "", 0, 0, 0);
No core dump is generated since the resulting corename is empty,
and filp_open() fails.
Is this considered a defect, or potential security concern ?
c. Consequential to (b), setting /proc/sys/kernel/core_pattern to empty
and /proc/sys/kernel/core_uses_pid to zero universally prevents
core dumps.
I'm wondering if this behaviour is provided intentionally.
Earl
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/