diff options
| -rw-r--r-- | src/SUMMARY.md | 5 | ||||
| -rw-r--r-- | src/linux/README.md | 5 | ||||
| -rw-r--r-- | src/linux/coredump.md | 92 | ||||
| -rw-r--r-- | src/linux/ptrace_scope.md | 21 | ||||
| -rw-r--r-- | src/linux/systemd.md | 68 |
5 files changed, 191 insertions, 0 deletions
diff --git a/src/SUMMARY.md b/src/SUMMARY.md index 830812f..c32741e 100644 --- a/src/SUMMARY.md +++ b/src/SUMMARY.md @@ -49,6 +49,11 @@ - [symbol versioning](./development/symbolver.md) - [python](./development/python.md) +- [Linux](./linux/README.md) + - [systemd](./linux/systemd.md) + - [coredump](./linux/coredump.md) + - [ptrace_scope](./linux/ptrace_scope.md) + - [Arch](./arch/README.md) - [x86_64](./arch/x86_64.md) - [arm64](./arch/arm64.md) diff --git a/src/linux/README.md b/src/linux/README.md new file mode 100644 index 0000000..bd80476 --- /dev/null +++ b/src/linux/README.md @@ -0,0 +1,5 @@ +# Linux + +- [systemd](./systemd.md) +- [coredump](./coredump.md) +- [ptrace_scope](./ptrace_scope.md) diff --git a/src/linux/coredump.md b/src/linux/coredump.md new file mode 100644 index 0000000..7dd72c9 --- /dev/null +++ b/src/linux/coredump.md @@ -0,0 +1,92 @@ +# core(5) + +There are multiple requirements that must be satisfied that `coredumps` are +being generated, a full list can be found in [core(5)][man-core]. + +An important one is to configure the soft resource limit `RLMIT_CORE` +(typically as unlimited during debugging). +In a typical bash/zsh this can be done as +```bash +ulimit -Sc unlimited +``` + +## Naming of coredump files + +There are two important kernel configs to control the naming: +```config +/proc/sys/kernel/core_pattern + <pattern> => Specifies a name pattern for the coredump file. This can + include certain FORMAT specifier. + |<cmdline> => Coredump is pipe through stdin to the user space process + specified by the cmdline, this can also contain FORMAT specifier. + + FORMAT specifier (full list, see core(5)): + %E Pathname of the executable ('/' replaced by '!'). + %p PID of the dumping process in its pid namespace. + %P PID of the dumping process in the initial pid namespace. + %u Real UID of dumping process. + %s Signal number causing the dump. + + +/proc/sys/kernel/core_uses_pid + 1 => Append ".<pid>" suffic to the coredump file name + (pid of the dumping process). + 0 => Do not append the suffix. +``` + +## Control which segments are dumped + +Each process has a coredump filter defined in `/proc/<pid>/coredump_filter` +which specifies which memory segments are being dumped. +Filters are preseved across `fork/exec` calls and hence child processes inherit +the parents filters. + +The filter is a bitmask where `1` indicates to dump the given type. +``` +From core(5): + bit 0 Dump anonymous private mappings. + bit 1 Dump anonymous shared mappings. + bit 2 Dump file-backed private mappings. + bit 3 Dump file-backed shared mappings. + bit 4 Dump ELF headers. + bit 5 Dump private huge pages. + bit 6 Dump shared huge pages. + bit 7 Dump private DAX pages. + bit 8 Dump shared DAX pages. + +Default filter 0x33. +``` + +# Some examples out there + +## coredumpctl (systemd) + +```bash +# List available coredumps. +coredumpctl list + TIME PID UID GID SIG COREFILE EXE SIZE + ... + Fri 2022-03-11 12:10:48 CET 6363 1000 1000 SIGSEGV present /usr/bin/sleep 18.1K + +# Get detailed info on specific coredump. +coredumpctl info 6363 + +# Debug specific coredump. +coredumpctl debug 6363 + +# Dump specific coredump to file. +coredumpctl dump 6363 -o <file> +``` + +## apport (ubuntu) + +Known crash report locations: +- `/var/crash` + +To get to the raw coredump, crash reports can be unpacked as: +```bash +apport-unpack <crash_repot> <dest_dir> +``` +The coredump resides under `<dest_dir>/CoreDump`. + +[man-core]: https://man7.org/linux/man-pages/man5/core.5.html diff --git a/src/linux/ptrace_scope.md b/src/linux/ptrace_scope.md new file mode 100644 index 0000000..72e8353 --- /dev/null +++ b/src/linux/ptrace_scope.md @@ -0,0 +1,21 @@ +# ptrace_scope + +In case the kernel was compiled with the `yama` security module +(`CONFIG_SECURITY_YAMA`), tracing processes with `ptrace(2)` can be restricted. + +```config +/proc/sys/kernel/yama/ptrace_scope + 0 => No restrictions. + 1 => Restricted attach, only the following can attach + - A process in the parent hierarchy. + - A process with CAP_SYS_PTRACE. + - A process with the PID that the tracee allowed by via + PR_SET_PTRACER. + 2 => Only processes with CAP_SYS_PTRACE in the user namespace of the tracee + can attach. + 3 => No tracing allowed. +``` + +Further details in [`ptrace(2)`][man-ptrace]. + +[man-ptrace]: https://man7.org/linux/man-pages/man2/ptrace.2.html diff --git a/src/linux/systemd.md b/src/linux/systemd.md new file mode 100644 index 0000000..14ced0b --- /dev/null +++ b/src/linux/systemd.md @@ -0,0 +1,68 @@ +# systemd + +## systemctl + +Inspect units: +```text +systemctl [opts] [cmd] +[opts] + --user + +[cmd] + list-units <pattern> List units in memory + + status <unit> Show runtime status of unit + + start <unit> Start a unit + stop <unit> Stop a unit + restart <unit> Restart a unit + reload <unit> Reload a unit + + enable <unit> Enable a unit (persistent) + disable <unit> Disable a unit + + cat <unit> Print unit file + show <unit> Show properties of unit +``` + +### Example: Trivial user unit + +```bash +# Generate unit +mkdir -p ~/.config/systemd/user +echo '[Unit] +Description=Test logger + +[Service] +Type=oneshot +ExecStart=logger "Hello from test unit"' > ~/.config/systemd/user/test.service + +# Run unit +systemctl --user start test + +# See log message +journalctl --user -u test -n 5 +``` + +## journalctl + +Inspect journal logs: +```text +journalctl [opts] [matches] + --user Current user journal (system by default) + -u <unit> Show logs for specified <unit> + -n <lines> Show only last <lines> + -f Follow journal + -g <pattern> Grep for <pattern> +``` + +Cleanup: +```text +journalctl [opts] + --disk-usage Show current disk usage + --vacuum-size=<size> Reduce journal log to <size> (K/M/G) +``` + +## References +- [man systemd.unit(5)](https://www.man7.org/linux/man-pages/man5/systemd.unit.5.html) +- [man systemd.service(5)](https://www.man7.org/linux/man-pages/man5/systemd.service.5.html) |