Re: [HACKERS] Debian no longer dumps cores?

On Mon, 20 Oct 2008, Alvaro Herrera wrote:

> My Debian system (now running Linux 2.6.26) is no longer dumping core
> files, and I can't figure out why :-(

My guess is that you're being nailed by one of the changes related to
implementing the improved capabilities interface made in 2.6.25 or 2.6.26.
I know that broke some libpcap versions for example:
http://lkml.org/lkml/2008/4/22/18

I haven't upgraded a Debian system to a kernel that new yet myself to know
specifically what's wrong, the blog posting at
http://linux-man-pages.blogspot.com/2008/05/capabilities-have-fully-arrived-finally.html
is a good starter point to dig for more info. If I had to make a guess
I'd suspect whatever is dumping core doesn't have the CAP_SYS_RAWIO
capability needed to access /proc/kcore and you need to tweak a file
related to that area rather than the ulimit stuff.

Also worth mentioning is that you may need to adjust
/proc/sys/fs/suid_dumpable (see
http://manpages.courier-mta.org/htmlman5/proc.5.html ) and that there have
been distributions that just broke even the CAP_SYS_RAWIO interface at the
kernel level; see http://vir.homelinux.org/blog/archives/30-Lost-time.html
for an example.

--
* Greg Smith gsmith(at)gregsmith(dot)com http://www.gregsmith.com Baltimore, MD