Date: Wed, 16 Sep 1998 07:47:05 -0700 (PDT) From: Matthew Dillon <dillon@backplane.com> To: Andrzej Bialecki <abial@nask.pl> Cc: John Polstra <jdp@FreeBSD.ORG>, cvs-committers@FreeBSD.ORG, cvs-all@FreeBSD.ORG Subject: Re: cvs commit: src/sys/kern imgact_elf.c Message-ID: <199809161447.HAA24256@apollo.backplane.com> References: <Pine.BSF.4.02A.9809160840180.17001-100000@korin.warman.org.pl>
next in thread | previous in thread | raw e-mail | index | archive | help
:On Tue, 15 Sep 1998, John Polstra wrote:
:
:> jdp 1998/09/15 14:46:35 PDT
:>
:> Modified files:
:> sys/kern imgact_elf.c
:> Log:
:> Instead of just the data and stack segments, include all writable
:> segments (except memory-mapped devices) in the ELF core file. This
:> is really nice. You get access to the data areas of all shared
:> libraries, and even to files that are mapped read-write.
^^^^^^^^^ ^^^^^^^^^^^^^^^^^^^^^
: ^^^^^^^^^ ^^^^^^^^^^^^^^^^^^^^^
:I wonder if it could be used to gather some security related info out of
:core file...
:
:Andrzej Bialecki
There have been many occassions where I have not been able to debug
programs from core dumps due to the fact that the core dumps do not
include process's entire memory area. I would be nice if all mmap'd
segments were included in the core dump. Since core's do not occur
for suid programs anyway, and since you can access all the segments
when you attach a debugger to the running process, I do not see any
particular security problem with doing this and it would make debugging
core files more useablee. Right now there are several major programs
which allocate memory via mmap() that cannot be debugged from a core
dump due to the fact that the corefile does not contained the mmap'd
segments.
-Matt
Matthew Dillon Engineering, HiWay Technologies, Inc. & BEST Internet
Communications & God knows what else.
<dillon@backplane.com> (Please include original email in any response)
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?199809161447.HAA24256>