Hello,
I'm trying to write a robust core-dump handling script -- which eventually
sends minidumps remotely for analysis, like Mozilla Socorro[1] but for any
crashing process in the system.
I read 'man 5 core' several times, but I'm confused about "PID namespaces".
%p PID of dumped process, as seen in the PID namespace in which
the process resides
%P PID of dumped process, as seen in the initial PID namespace
(since Linux 3.12)
For now, I've set up :
echo 5 > /proc/sys/kernel/core_pipe_limit
echo "|/usr/sbin/coredump %P" > /proc/sys/kernel/core_pattern
I used %P but I'm not sure why.
(I used 5 somewhat at random too.)
The coredump script is supposed to access /proc/$PID
Should I use %P or %p or something else?
For my own reference:
commit 65aafb1e7484b7434a0c1d4c593191ebe5776a2f
Regards.
[1] https://crash-stats.mozilla.com/
[2] http://man7.org/linux/man-pages/man5/core.5.html
On 16/01/2020 14:39, Marc Gonzalez wrote:
> I'm trying to write a robust core-dump handling script -- which eventually
> sends minidumps remotely for analysis, like Mozilla Socorro[1] but for any
> crashing process in the system.
>
> I read 'man 5 core' several times, but I'm confused about "PID namespaces".
>
> %p PID of dumped process, as seen in the PID namespace in which
> the process resides
> %P PID of dumped process, as seen in the initial PID namespace
> (since Linux 3.12)
>
> For now, I've set up :
>
> echo 5 > /proc/sys/kernel/core_pipe_limit
> echo "|/usr/sbin/coredump %P" > /proc/sys/kernel/core_pattern
>
> I used %P but I'm not sure why.
> (I used 5 somewhat at random too.)
>
> The coredump script is supposed to access /proc/$PID
>
> Should I use %P or %p or something else?
I /think/ %P is the proper option, because the /usr/sbin/coredump process
should (??) be created in the initial PID namespace.
Tangent: if a process is created in a different PID namespace, does it also
have a "global" PID, or is it "invisible" in the "root" PID namespace?
http://man7.org/linux/man-pages/man7/pid_namespaces.7.html
> A process is visible to other processes in its PID namespace, and to
> the processes in each direct ancestor PID namespace going back to the
> root PID namespace. In this context, "visible" means that one
> process can be the target of operations by another process using
> system calls that specify a process ID. Conversely, the processes in
> a child PID namespace can't see processes in the parent and further
> removed ancestor namespaces. More succinctly: a process can see
> (e.g., send signals with kill(2), set nice values with
> setpriority(2), etc.) only processes contained in its own PID
> namespace and in descendants of that namespace.
What about /proc/[pid] ? (breakpad needs these bits)
I'm still not 100% sure about how to access the /proc/[pid] directory of
a process that crashed in a new PID namespace FROM a coredump analyzer
in the root PID namespace.
Regards.