Hi Luca,
On Mon, 2023-06-19 at 21:54 +0100, Luca Boccassi wrote:
> > > Which does bring up the question why systemd-coredump isn't running
> > in
> > > the same mount space as the crashing program. Then it would simply
> > find
> > > the files that the crashing program is using.
> >
> > On this point that systemd-coredump might not run in the same mount
> > namespace, don’t blindly believe me. I think I saw this while
> > reviewing the
> > systemd code, but it was the first time I looked at it to investigate
> > this issue,
> > so may be wrong.
>
> This is correct, in case of containers sd-coredump will run on the host
> and collect from all the guests, so they are going to be in different
> namespaces. And even when they are not, the original binary might be
> long gone by the time it has a chance to run.
Since sd-coredump is run on the host it could transition into the mount
namespace of the process it is capturing the coredump for. This makes
sense if it is then going to do some path based lookups. Alternatively
we could look into making the path based lookups look under
/proc/PID/root/ Since sd-coredump is run as special kernel helper
through /proc/sys/kernel/core_pattern the original executable is still
there (it cannot be reaped till sd-coredump has done its thing).
The core (5) manpage states:
* The process runs in the initial namespaces (PID, mount, user,
and so on) and not in the namespaces of the crashing process.
One can utilize specifiers such as %P to find the right
/proc/[pid] directory and probe/enter the crashing process's
namespaces if needed.
https://man7.org/linux/man-pages/man5/core.5.html
Cheers,
Mark
