On Fri, Apr 25, 2008 at 6:22 PM, Neil Horman <nhorman@tuxdriver.com> wrote:
Have a look at the following. It demonstrates what I'm seeing (that
the coredump program is run as root/root).
===
$ cat core_pattern_test.c
/* core_pattern_test.c */
#define _GNU_SOURCE
#include <sys/stat.h>
#include <fcntl.h>
#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>
#define BUF_SIZE 1024
int
main(int argc, char *argv[])
{
int fd, tot, j;
ssize_t nread;
char buf[BUF_SIZE];
FILE *fp;
fd = open(argv[1], O_CREAT | O_WRONLY | O_TRUNC, 0666);
if (fd == -1)
exit(EXIT_FAILURE);
fp = fdopen(fd, "a");
fprintf(fp, "PID=%ld\n", (long) getpid());
fprintf(fp, "cwd=%s\n", get_current_dir_name());
fprintf(fp, "UID=%ld; EUID=%ld\n", (long) getuid(), (long) geteuid());
fprintf(fp, "GID=%ld; EGID=%ld\n", (long) getgid(), (long) getegid());
fprintf(fp, "argc=%d\n", argc);
for (j = 0; j < argc; j++)
fprintf(fp, "argc[%d]=<%s>\n", j, argv[j]);
/* Count bytes in standard input */
tot = 0;
while ((nread = read(STDIN_FILENO, buf, BUF_SIZE)) > 0)
tot += nread;
fprintf(fp, "Total bytes in core dump: %d\n", tot);
exit(EXIT_SUCCESS);
}
$ cc core_pattern_test.c
$ sudo sh -c 'echo "|$PWD/core_pattern_test $PWD/c p_%p u_%u g_%g t_%t
c_%c" > /proc/sys/kernel/core_pattern'
root's password:
$ id
uid=1000(mtk) gid=100(users) groups=16(dialout),33(video),100(users)
$ sleep 100
[type ^\]
Quit (core dumped)
$ cat c
PID=6743
cwd=/
UID=0; EUID=0
GID=0; EGID=0
argc=7
argc[0]=</home/mtk/man-pages/man5/core_pattern_test>
argc[1]=</home/mtk/man-pages/man5/c>
argc[2]=<p_6742>
argc[3]=<u_1000>
argc[4]=<g_100>
argc[5]=<t_1209146940>
argc[6]=<c_4294967295>
Total bytes in core dump: 282624
$
===
Your thoughts?
Cheers,
Michael
--
