5 ms·

I see a lot of sudo in there, for debugging a program presumably not running as root. Is it possible with this tooling to debug core dumps as a normal user?

necrotic_comp 5y ago
I agree, that seems like a very bad idea.
jandrese 5y ago
Systemd's core dump utility stuffs the files in /var/lib/systemd/coredump with 640 permissions and ownership of root:root regardless of who owned the process. It might be paranoia on someone's part, but I agree that it causes a lot of unnecessary privilege escalation for people who want to actually fix the problem.
- pengaru 5y ago
  > Systemd's core dump utility stuffs the files in /var/lib/systemd/coredump with 640 permissions and ownership of root:root regardless of who owned the process. This isn't true for +ACL builds of systemd, look at the output of `getfacl /var/lib/systemd/coredump/$foo` and you'll see.
- jcelerier 5y ago
  .. but you can just run coredumpctl gdb or coredumpctl dump <the dump> > /tmo/YOLO.dump
- rwmj 5y ago
  This isn't true, at least on Fedora. When my program crashes I run "coredumpctl gdb" without sudo and it works fine - I use this all the time. (It could be that Fedora has done some special configuration and that it's not like this out of the box for upstream systemd)
  - e12e 5y ago
    I'm not at my laptop right now, but from https://www.freedesktop.org/software/systemd/man/coredumpctl.html https://www.freedesktop.org/software/systemd/man/coredumpctl... It looks like coredumpctl might be suid? Or that the service is, and coredumpctl gets access through the service - so there's a certain elevation going on either way?
    - lights0123 5y ago
      It's not. It sets ACLs so that the user that owns the process may read the coredump, but typical ls doesn't show that.
      - deathanatos 5y ago
        ls -l will note the presence of ACLs with a "+" next to the permissions. I typically `ls -l` or just have that aliased to ll if it isn't already… (but YMMV)
pengaru 5y ago
sudo should not be required if the coredumped process was running as your user, but this will only be true if systemd was built with +ACL (look at `systemctl --version` output).
soraminazuki 5y ago
Coredumps can contain sensitive information about privileged processes, so it's rational to not have it world-readable.

necrotic_comp 5y ago

I agree, that seems like a very bad idea.

jandrese 5y ago

Systemd's core dump utility stuffs the files in /var/lib/systemd/coredump with 640 permissions and ownership of root:root regardless of who owned the process. It might be paranoia on someone's part, but I agree that it causes a lot of unnecessary privilege escalation for people who want to actually fix the problem.

pengaru 5y ago
> Systemd's core dump utility stuffs the files in /var/lib/systemd/coredump with 640 permissions and ownership of root:root regardless of who owned the process. This isn't true for +ACL builds of systemd, look at the output of `getfacl /var/lib/systemd/coredump/$foo` and you'll see.
jcelerier 5y ago
.. but you can just run coredumpctl gdb or coredumpctl dump <the dump> > /tmo/YOLO.dump
rwmj 5y ago
This isn't true, at least on Fedora. When my program crashes I run "coredumpctl gdb" without sudo and it works fine - I use this all the time. (It could be that Fedora has done some special configuration and that it's not like this out of the box for upstream systemd)
- e12e 5y ago
  I'm not at my laptop right now, but from https://www.freedesktop.org/software/systemd/man/coredumpctl.html https://www.freedesktop.org/software/systemd/man/coredumpctl... It looks like coredumpctl might be suid? Or that the service is, and coredumpctl gets access through the service - so there's a certain elevation going on either way?
  - lights0123 5y ago
    It's not. It sets ACLs so that the user that owns the process may read the coredump, but typical ls doesn't show that.
    - deathanatos 5y ago
      ls -l will note the presence of ACLs with a "+" next to the permissions. I typically `ls -l` or just have that aliased to ll if it isn't already… (but YMMV)

pengaru 5y ago

sudo should not be required if the coredumped process was running as your user, but this will only be true if systemd was built with +ACL (look at `systemctl --version` output).

soraminazuki 5y ago

Coredumps can contain sensitive information about privileged processes, so it's rational to not have it world-readable.