Re: How to make a core dump?

• Previous message: Laker Zhu: "Re: How to make a core dump?"
• In reply to: Alexander Morozov: "How to make a core dump?"
• Next in thread: Scott Gifford: "Re: How to make a core dump?"
• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]

Date: Sun, 05 Sep 2004 18:13:59 +1200
To: Alexander Morozov <amorozov@pisem.net>, focus-linux@securityfocus.com

Alexander Morozov wrote:

>Hello everyone,
>recently my friend have found a malcious program running on his
>web-server. After some actions i thought it would be helpful to make
>its core dump, but i couldn't figure out how to do this. The only
>thing that came to mind was attaching to it with gdb, stopping
>it and dumping regions of memory manually (using memory map in
>/proc/pid/mem). It went fine, i copied all segments but it would be much
>better to have standart core dump, to be able to use usual programms on
>it later. I remember, that several years ago default behaviour of a
>program running under linux was dumping itself on SIGSEGV.
>
>
>And I wonder, how was this fullfilled, was it feature of glibc to catch
>SIGV and write a dump? Or was it made by the kernel?
>
>
Core dumps are created by the kernel(look in do_coredump in fs/exec.c in
Linux for the code).

The POSIX signal SIGQUIT exists to allow users to cause a coredump if
they notice a problem in a program (SIGSEGV is supposed to be for
segment violations). Any of the following signals will cause a coredump
if sent to a program and unhandled...
#define SIG_KERNEL_COREDUMP_MASK (\
        M(SIGQUIT) | M(SIGILL) | M(SIGTRAP) | M(SIGABRT) | \
        M(SIGFPE) | M(SIGSEGV) | M(SIGBUS) | M(SIGSYS) | \
        M(SIGXCPU) | M(SIGXFSZ) | M_SIGEMT )

However, the kernel also has additional security restrictions, as core
dumps can contain sensitive information, and creating files in arbitrary
locations on the filesystem could be a security risk. Firstly,
setuid/setgid programs do no coredump by default. This can be changed on
Linux by making the setuid program call the prctl syscall, with option
PR_SET_DUMPABLE and value 1. Any process can also elect to turn off
coredumps, so a compromised process could theoretically turn off this,
and you might need to use ptrace to force a process to become dumpable
if you want to be sure it will dump.

You also need to make sure that the user has permissions to create the
core file in the current working directory. If you use the ptrace
strategy above, you could cause the process to execute a chdir first to
a suitable directory.

>Alexander Morozov
>
>

• Previous message: Laker Zhu: "Re: How to make a core dump?"
• In reply to: Alexander Morozov: "How to make a core dump?"
• Next in thread: Scott Gifford: "Re: How to make a core dump?"
• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]