3

Running a pretty standard Fedora 25 system I expect that the core files of all segfaulting processes are collected by ABRT. But this doesn't seem to be the case.

ABRT is enabled:

cat /proc/sys/kernel/core_pattern
|/usr/libexec/abrt-hook-ccpp %s %c %p %u %g %t %P %I

A self-test does work of a simple user segfault works:

sleep 100 &
kill -11 $!
[1]  + segmentation fault (core dumped)  sleep 100

And a directory containing the core file under /var/spool/abrt is generated (i.e. ccpp-YYYY-MM-DD...).

Also the journal records:

Jan 01 21:38:12 example.org audit[17183]: ANOM_ABEND auid=1000 uid=0 gid=0 ses=3 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 pid=17183 comm="sleep" exe="/usr/bin/sleep" sig=11
Jan 01 21:38:12 example.org abrt-hook-ccpp[17186]: Process 17183 (sleep) of user 0 killed by SIGSEGV - dumping core

But when an opensshd process segfaults then the abrt hook doesn't get invoked and thus there is no core file.

The journal entries for the opensshd core:

Jan 01 21:41:46 example.org audit[18256]: ANOM_ABEND auid=4294967295 uid=0 gid=0 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 pid=18256 comm="sshd" exe="/usr/sbin/sshd" sig=11
Jan 01 21:41:46 example.org kernel: traps: sshd[18256] general protection ip:7f4d8d16ffd1 sp:7ffd42d93ef0 error:0 in libc-2.24.so[7f4d8d0ef000+1bd000]

Is this an ABRT bug or a feature?

That means is the core file collection for system daemons disabled, by default?

And how do I enable it?

maxschlepzig
  • 56,316
  • 50
  • 205
  • 279
  • 1
    do the daemons have cores enabled in `/etc/security/limits.conf`? – apricot boy Jan 02 '17 at 00:14
  • @apricotboy, the `sshd` is started via `systemctl` and thus running as root, I presume. There are no entries for special users in `/etc/security/limits.conf`. – maxschlepzig Jan 02 '17 at 08:24
  • @Jakuje, it is the `sshd` from the standard fedora repository, installed by default. – maxschlepzig Jan 02 '17 at 08:25
  • @Jakuje, yes, I wrote that report - it mentions openssh-7.3p1-7.fc25.x86_64 for the server (sshd) - but 7.4 just for the client. – maxschlepzig Jan 02 '17 at 08:30
  • oh ... my bad. Sorry for the noise. – Jakuje Jan 02 '17 at 08:32
  • Just tried the same and I see the core file under `abrt-cli ls` with default settings (as far as I know). – Jakuje Jan 02 '17 at 10:44
  • @Jakuje, by any chance, is your system running with SELinux disabled? I have SELinux enabled and I suspect that it is interfering with the inheritance of resource limits set by systemd (for daemons it launches). – maxschlepzig Jan 03 '17 at 09:02
  • No, I have SELinux in enforcing. But the behavior is weird (probably because of the type of memory corruption?). I was able to collect the core dump only few times from all the tenth of crashes. – Jakuje Jan 03 '17 at 09:05

0 Answers0