Re: fs/binfmt_elf.c:maydump()

["David S. Miller" <davem@davemloft.net>]

From: Daniel Jacobowitz <dan@debian.org>
Date: Thu, 6 Apr 2006 18:15:19 -0400

> On Thu, Apr 06, 2006 at 02:03:57PM -0700, David S. Miller wrote:
> > Yes, this means we might hit the core dump limits quicker but we
> > shouldn't be doing anything which makes less debugging information
> > than necessary available.  Software development is hard enough as
> > it is right? :)
> 
> > -	/* If it hasn't been written to, don't write it out */
> > -	if (!vma->anon_vma)
> > -		return 0;
> > -
> 
> Isn't this, um, a little more extreme than what you really want?
> What goes into coredumps with this patch applied?  I bet it includes
> the complete text segments of every executable and shared library
> involved in the link.  You're going to need those if you want to debug,
> anyway.

With this patch applied, yes, it includes the complete text segments of
every executable and shared library mapped into the program which is
dumping core.

What's a good check to avoid shared libraries and executables?  And do
we really want to avoid including them?  What if a new version of one
of the shared libraries is installed on the system after the core file
is generated?  Wouldn't you want the complete original image so that
the program could be debugged accurately in the face of such changes?

Anyways a possible check would be if the object was mapped with
execute permission, so a test on VM_EXEC being set in vma->vm_flags.

But like the comment above maydump() seems to suggest, I'm of the
opinion that we should include as much as possible into the core
file image.