[patch] Support live PIDs with deleted files

Jan Kratochvil jan.kratochvil at redhat.com
Wed Dec 18 19:13:26 UTC 2013


Hi Mark,

jankratochvil/deleted

with the new /proc/PID/map_files/ feature it is possible to fully access even
deleted executable + shared_libraries.  Current Linux kernels (3.11.10) permit
on root user as the tracer but (1) hopefully it gets fixed in the future and
(2) at least for the use in ABRT it is OK as backtracer is run from core
dumping hook.

Linux kernels have always supported also /proc/PID/exe which works for deleted
main executable.  It even works for non-root users.  But it works only for the
executable, not for shared libraries.  I find more useful to push for Linux
kernel /proc/PID/map_files/ permissions fix than to implement /proc/PID/exe.

If the running binary has been upgraded while it is still running its separate
debug info files in /usr/lib/debug/ will no longer match.  But still
.eh_frame-based unwind is possible using /proc/PID/map_files/ that time.

Testcase is skipped when /proc/PID/map_files/ gives permission error.

OK for check-in?

I am not completely sure setting just mod->main.name is right but it looks so.


Thanks,
Jan
-------------- next part --------------
An embedded message was scrubbed...
From: Jan Kratochvil <jan.kratochvil at redhat.com>
Subject: [PATCH] Support live PIDs with deleted files.
Date: Wed, 18 Dec 2013 19:19:07 +0100
Size: 9863
URL: <https://lists.fedorahosted.org/pipermail/elfutils-devel/attachments/20131218/6c086271/attachment.mht>


More information about the elfutils-devel mailing list