[patch 0/3] Live PIDs with deleted files by /dev/PID/mem

Jan Kratochvil jan.kratochvil at redhat.com
Mon Mar 10 20:47:40 UTC 2014


On Mon, 10 Mar 2014 21:38:31 +0100, Mark Wielaard wrote:
> On Thu, 2014-03-06 at 20:55 +0100, Jan Kratochvil wrote:
> > In general I believe reading /proc/PID/maps is safer than the guessing by
> > elf_from_remote_memory(), for example because the image may come from mmap()
> > and not from dlopen().  But I guess it may be the common disagreement.
> 
> I agree that using all addresses from /proc/PID/maps, and not just the
> base address, would be a good idea. But IMHO elf_from_remote_memory
> should still be used for sanity checking the segment mapping addresses
> and offsets to make sure the ELF file was mapped in as expected.

I was not against the part of sanity checks at all.


Jan


More information about the elfutils-devel mailing list