Re: How to make a core dump?

Alexander Morozov wrote:

> Hello everyone,
> recently my friend have found a malcious program running on his
> web-server. After some actions i thought it would be helpful to make
> its core dump, but i couldn't figure out how to do this. The only
> thing that came to mind was attaching to it with gdb, stopping
> it and dumping regions of memory manually (using memory map in
> /proc/pid/mem). It went fine, i copied all segments but it would be much
> better to have standart core dump, to be able to use usual programms on
> it later. I remember, that several years ago default behaviour of a
> program running under linux was dumping itself on SIGSEGV.
>  
>
> And I wonder, how was this fullfilled, was it feature of glibc to catch
> SIGV and write a dump? Or was it made by the kernel?
>  
Core dumps are created by the kernel(look in do_coredump in fs/exec.c in 
Linux for the code).

The POSIX signal SIGQUIT exists to allow users to cause a coredump if 
they notice a problem in a program (SIGSEGV is supposed to be for 
segment violations). Any of the following signals will cause a coredump 
if sent to a program and unhandled...
#define SIG_KERNEL_COREDUMP_MASK (\
       M(SIGQUIT)   |  M(SIGILL)    |  M(SIGTRAP)   |  M(SIGABRT)   | \
       M(SIGFPE)    |  M(SIGSEGV)   |  M(SIGBUS)    |  M(SIGSYS)    | \
       M(SIGXCPU)   |  M(SIGXFSZ)   |  M_SIGEMT                     )

However, the kernel also has additional security restrictions, as core 
dumps can contain sensitive information, and creating files in arbitrary 
locations on the filesystem could be a security risk. Firstly, 
setuid/setgid programs do no coredump by default. This can be changed on 
Linux by making the setuid program call the prctl syscall, with option 
PR_SET_DUMPABLE and value 1. Any process can also elect to turn off 
coredumps, so a compromised process could theoretically turn off this, 
and you might need to use ptrace to force a process to become dumpable 
if you want to be sure it will dump.

You also need to make sure that the user has permissions to create the 
core file in the current working directory. If you use the ptrace 
strategy above, you could cause the process to execute a chdir first to 
a suitable directory.

> Alexander Morozov
>