An obscure kernel feature to get more info about dying processes (opens in new tab)

(timetobleed.com)

132 pointsice79915y ago28 comments

28 comments

This is actually quite interesting - I didn't know you could do that, and I will likely employ it in the future, especially with a remote web server or something you can't immediately get to. So as you roll in, you check your email on your phone, and know walking in what you're getting into and likely how to fix it. From a time-optimization viewpoint, this is nigh-invaluable.

Plus this guy has some other very nifty articles.

But I guess (glancing at first few comments) that "haterz gonna hate."

gxti15y ago

Fedora's Automated Bug Reporting Tool (abrt) uses this to automatically produce crash reports, which you can sanitize and approve to post in a central location for developers. I imagine that Ubuntu does something similar.

tzs15y ago

So what happens if the helper application crashes and tries to dump core? Would it try to run another instance of it to handle that crash, and so on, leading to a "core bomb"?

barrkel15y ago

It is nice to know that Linux has this feature, but it essentially amounts to a JIT debugger, and has been in other OSes for a long time. In Windows, it's been there since at least NT 4.

JoeAltmaier15y ago

Hook root when a process crashes? How long until an exploit?

InclinedPlane15y ago

If you have the ability to modify or create files in /proc you almost certainly already control the system.

mmastrac15y ago

Not necessarily. You can trick someone who does have access to write /proc into writing something to /proc for you via symlink or another method.

Disclosure: I work on the unrEVOked rooting tool for android and we do stuff like this all the time.

JoeAltmaier15y ago

You only need to modify the tool that runs as the hook script...which may or may not be protected

dododo15y ago

on the other hand, it makes for an interesting rootkit hook.

1 more reply

j / k navigate · click thread line to collapse

28 comments

Marticus15y ago

Plus this guy has some other very nifty articles.

But I guess (glancing at first few comments) that "haterz gonna hate."

gxti15y ago

tzs15y ago

So what happens if the helper application crashes and tries to dump core? Would it try to run another instance of it to handle that crash, and so on, leading to a "core bomb"?

barrkel15y ago

It is nice to know that Linux has this feature, but it essentially amounts to a JIT debugger, and has been in other OSes for a long time. In Windows, it's been there since at least NT 4.

JoeAltmaier15y ago

Hook root when a process crashes? How long until an exploit?

InclinedPlane15y ago

If you have the ability to modify or create files in /proc you almost certainly already control the system.

mmastrac15y ago

Not necessarily. You can trick someone who does have access to write /proc into writing something to /proc for you via symlink or another method.

Disclosure: I work on the unrEVOked rooting tool for android and we do stuff like this all the time.

JoeAltmaier15y ago

You only need to modify the tool that runs as the hook script...which may or may not be protected

dododo15y ago

on the other hand, it makes for an interesting rootkit hook.

1 more reply

j / k navigate · click thread line to collapse