Process connector can now also detect coredumping events. Main aim of patch is get notified at start of coredumping, instead of having to wait for it to finish and then being notified through EXIT event. Could be used for instance by process-managers that want to get notified as soon as possible about process failures, and not necessarily beeing notified after coredump, which could be in the order of minutes depending on size of coredump, piping and so on.
Unified · Split
| @@ -232,6 +232,31 @@ void proc_comm_connector(struct task_struct *task) · 231 unmodified lines | ||
| 232 | 232 | cn_netlink_send(msg, CN_IDX_PROC, GFP_KERNEL); |
| 233 | 233 | } |
| 234 | 234 | |
| 235 | +void proc_coredump_connector(struct task_struct *task) | |
| 236 | +{ | |
| 237 | + struct cn_msg *msg; | |
| 238 | + struct proc_event *ev; | |
| 239 | + __u8 buffer[CN_PROC_MSG_SIZE]; | |
| 240 | + struct timespec ts; | |
| 241 | + | |
| 242 | + if (atomic_read(&proc_event_num_listeners) < 1) | |
| 243 | + return; | |
| 244 | + | |
| 245 | + msg = (struct cn_msg *)buffer; | |
| 246 | + ev = (struct proc_event *)msg->data; | |
| 247 | + get_seq(&msg->seq, &ev->cpu); | |
| 248 | + ktime_get_ts(&ts); /* get high res monotonic timestamp */ | |
| 249 | + put_unaligned(timespec_to_ns(&ts), (__u64 *)&ev->timestamp_ns); | |
| 250 | + ev->what = PROC_EVENT_COREDUMP; | |
| 251 | + ev->event_data.coredump.process_pid = task->pid; | |
| 252 | + ev->event_data.coredump.process_tgid = task->tgid; | |
| 253 | + | |
| 254 | + memcpy(&msg->id, &cn_proc_event_id, sizeof(msg->id)); | |
| 255 | + msg->ack = 0; /* not used */ | |
| 256 | + msg->len = sizeof(*ev); | |
| 257 | + cn_netlink_send(msg, CN_IDX_PROC, GFP_KERNEL); | |
| 258 | +} | |
| 259 | + | |
| 235 | 260 | void proc_exit_connector(struct task_struct *task) |
| 236 | 261 | { |
| 237 | 262 | struct cn_msg *msg; |
| @@ -26,6 +26,7 @@ void proc_id_connector(struct task_struct *task, int which_id); · 25 unmodified lines | ||
| 26 | 26 | void proc_sid_connector(struct task_struct *task); |
| 27 | 27 | void proc_ptrace_connector(struct task_struct *task, int which_id); |
| 28 | 28 | void proc_comm_connector(struct task_struct *task); |
| 29 | +void proc_coredump_connector(struct task_struct *task); | |
| 29 | 30 | void proc_exit_connector(struct task_struct *task); |
| 30 | 31 | #else |
| 31 | 32 | static inline void proc_fork_connector(struct task_struct *task) |
| @@ -48,6 +49,9 @@ static inline void proc_ptrace_connector(struct task_struct *task, · 16 unmodified lines | ||
| 48 | 49 | int ptrace_id) |
| 49 | 50 | {} |
| 50 | 51 | |
| 52 | +static inline void proc_coredump_connector(struct task_struct *task) | |
| 53 | +{} | |
| 54 | + | |
| 51 | 55 | static inline void proc_exit_connector(struct task_struct *task) |
| 52 | 56 | {} |
| 53 | 57 | #endif /* CONFIG_PROC_EVENTS */ |
| @@ -56,7 +56,9 @@ struct proc_event { · 55 unmodified lines | ||
| 56 | 56 | PROC_EVENT_PTRACE = 0x00000100, |
| 57 | 57 | PROC_EVENT_COMM = 0x00000200, |
| 58 | 58 | /* "next" should be 0x00000400 */ |
| 59 | − /* "last" is the last process event: exit */ | |
| 59 | + /* "last" is the last process event: exit, | |
| 60 | + * while "next to last" is coredumping event */ | |
| 61 | + PROC_EVENT_COREDUMP = 0x40000000, | |
| 60 | 62 | PROC_EVENT_EXIT = 0x80000000 |
| 61 | 63 | } what; |
| 62 | 64 | __u32 cpu; |
| @@ -110,11 +112,17 @@ struct proc_event { · 47 unmodified lines | ||
| 110 | 112 | char comm[16]; |
| 111 | 113 | } comm; |
| 112 | 114 | |
| 115 | + struct coredump_proc_event { | |
| 116 | + __kernel_pid_t process_pid; | |
| 117 | + __kernel_pid_t process_tgid; | |
| 118 | + } coredump; | |
| 119 | + | |
| 113 | 120 | struct exit_proc_event { |
| 114 | 121 | __kernel_pid_t process_pid; |
| 115 | 122 | __kernel_pid_t process_tgid; |
| 116 | 123 | __u32 exit_code, exit_signal; |
| 117 | 124 | } exit; |
| 125 | + | |
| 118 | 126 | } event_data; |
| 119 | 127 | }; |
| 120 | 128 | |
| @@ -32,6 +32,7 @@ · 31 unmodified lines | ||
| 32 | 32 | #include <linux/user_namespace.h> |
| 33 | 33 | #include <linux/uprobes.h> |
| 34 | 34 | #include <linux/compat.h> |
| 35 | +#include <linux/cn_proc.h> | |
| 35 | 36 | #define CREATE_TRACE_POINTS |
| 36 | 37 | #include <trace/events/signal.h> |
| 37 | 38 | |
| @@ -2350,6 +2351,7 @@ relock: · 2312 unmodified lines | ||
| 2350 | 2351 | if (sig_kernel_coredump(signr)) { |
| 2351 | 2352 | if (print_fatal_signals) |
| 2352 | 2353 | print_fatal_signal(info->si_signo); |
| 2354 | + proc_coredump_connector(current); | |
| 2353 | 2355 | /* |
| 2354 | 2356 | * If it was able to dump core, this kills all |
| 2355 | 2357 | * other threads in the group and synchronizes with |