Writing a robust core-dump handling script (wrt PID namespaces)

Writing a robust core-dump handling script (wrt PID namespaces)

[Marc Gonzalez]

Hello,

I'm trying to write a robust core-dump handling script -- which eventually
sends minidumps remotely for analysis, like Mozilla Socorro[1] but for any
crashing process in the system.

I read 'man 5 core' several times, but I'm confused about "PID namespaces".

           %p  PID of dumped process, as seen in the PID namespace in which
               the process resides
           %P  PID of dumped process, as seen in the initial PID namespace
               (since Linux 3.12)

For now, I've set up :

    echo 5 > /proc/sys/kernel/core_pipe_limit
    echo "|/usr/sbin/coredump %P" > /proc/sys/kernel/core_pattern

I used %P but I'm not sure why.
(I used 5 somewhat at random too.)

The coredump script is supposed to access /proc/$PID

Should I use %P or %p or something else?

For my own reference:
commit 65aafb1e7484b7434a0c1d4c593191ebe5776a2f

Regards.


[1] https://crash-stats.mozilla.com/
[2] http://man7.org/linux/man-pages/man5/core.5.html

Re: Writing a robust core-dump handling script (wrt PID namespaces)

[Marc Gonzalez]

On 16/01/2020 14:39, Marc Gonzalez wrote:

> I'm trying to write a robust core-dump handling script -- which eventually
> sends minidumps remotely for analysis, like Mozilla Socorro[1] but for any
> crashing process in the system.
> 
> I read 'man 5 core' several times, but I'm confused about "PID namespaces".
> 
>            %p  PID of dumped process, as seen in the PID namespace in which
>                the process resides
>            %P  PID of dumped process, as seen in the initial PID namespace
>                (since Linux 3.12)
> 
> For now, I've set up :
> 
>     echo 5 > /proc/sys/kernel/core_pipe_limit
>     echo "|/usr/sbin/coredump %P" > /proc/sys/kernel/core_pattern
> 
> I used %P but I'm not sure why.
> (I used 5 somewhat at random too.)
> 
> The coredump script is supposed to access /proc/$PID
> 
> Should I use %P or %p or something else?

I /think/ %P is the proper option, because the /usr/sbin/coredump process
should (??) be created in the initial PID namespace.

Tangent: if a process is created in a different PID namespace, does it also
have a "global" PID, or is it "invisible" in the "root" PID namespace?

http://man7.org/linux/man-pages/man7/pid_namespaces.7.html

>        A process is visible to other processes in its PID namespace, and to
>        the processes in each direct ancestor PID namespace going back to the
>        root PID namespace.  In this context, "visible" means that one
>        process can be the target of operations by another process using
>        system calls that specify a process ID.  Conversely, the processes in
>        a child PID namespace can't see processes in the parent and further
>        removed ancestor namespaces.  More succinctly: a process can see
>        (e.g., send signals with kill(2), set nice values with
>        setpriority(2), etc.) only processes contained in its own PID
>        namespace and in descendants of that namespace.

What about /proc/[pid] ? (breakpad needs these bits)

I'm still not 100% sure about how to access the /proc/[pid] directory of
a process that crashed in a new PID namespace FROM a coredump analyzer
in the root PID namespace.

Regards.