2 This file is part of systemd.
4 Copyright 2012 Lennart Poettering
6 systemd is free software; you can redistribute it and/or modify it
7 under the terms of the GNU Lesser General Public License as published by
8 the Free Software Foundation; either version 2.1 of the License, or
9 (at your option) any later version.
11 systemd is distributed in the hope that it will be useful, but
12 WITHOUT ANY WARRANTY; without even the implied warranty of
13 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
14 Lesser General Public License for more details.
16 You should have received a copy of the GNU Lesser General Public License
17 along with systemd; If not, see <http://www.gnu.org/licenses/>.
22 #include <sys/prctl.h>
23 #include <sys/xattr.h>
28 #include <elfutils/libdwfl.h>
31 #include "sd-journal.h"
33 #include "sd-daemon.h"
36 #include "alloc-util.h"
37 #include "capability-util.h"
38 #include "cgroup-util.h"
40 #include "conf-parser.h"
42 #include "coredump-vacuum.h"
43 #include "dirent-util.h"
49 #include "journald-native.h"
53 #include "parse-util.h"
54 #include "process-util.h"
55 #include "socket-util.h"
57 #include "stacktrace.h"
58 #include "string-table.h"
59 #include "string-util.h"
61 #include "user-util.h"
64 /* The maximum size up to which we process coredumps */
65 #define PROCESS_SIZE_MAX ((uint64_t) (2LLU*1024LLU*1024LLU*1024LLU))
67 /* The maximum size up to which we leave the coredump around on disk */
68 #define EXTERNAL_SIZE_MAX PROCESS_SIZE_MAX
70 /* The maximum size up to which we store the coredump in the journal */
71 #define JOURNAL_SIZE_MAX ((size_t) (767LU*1024LU*1024LU))
73 /* Make sure to not make this larger than the maximum journal entry
74 * size. See DATA_SIZE_MAX in journald-native.c. */
75 assert_cc(JOURNAL_SIZE_MAX
<= DATA_SIZE_MAX
);
78 /* We use this as array indexes for a couple of special fields we use for naming coredumping files, and
91 typedef enum CoredumpStorage
{
92 COREDUMP_STORAGE_NONE
,
93 COREDUMP_STORAGE_EXTERNAL
,
94 COREDUMP_STORAGE_JOURNAL
,
95 COREDUMP_STORAGE_BOTH
,
96 _COREDUMP_STORAGE_MAX
,
97 _COREDUMP_STORAGE_INVALID
= -1
100 static const char* const coredump_storage_table
[_COREDUMP_STORAGE_MAX
] = {
101 [COREDUMP_STORAGE_NONE
] = "none",
102 [COREDUMP_STORAGE_EXTERNAL
] = "external",
103 [COREDUMP_STORAGE_JOURNAL
] = "journal",
104 [COREDUMP_STORAGE_BOTH
] = "both",
107 DEFINE_PRIVATE_STRING_TABLE_LOOKUP(coredump_storage
, CoredumpStorage
);
108 static DEFINE_CONFIG_PARSE_ENUM(config_parse_coredump_storage
, coredump_storage
, CoredumpStorage
, "Failed to parse storage setting");
110 static CoredumpStorage arg_storage
= COREDUMP_STORAGE_EXTERNAL
;
111 static bool arg_compress
= true;
112 static uint64_t arg_process_size_max
= PROCESS_SIZE_MAX
;
113 static uint64_t arg_external_size_max
= EXTERNAL_SIZE_MAX
;
114 static size_t arg_journal_size_max
= JOURNAL_SIZE_MAX
;
115 static uint64_t arg_keep_free
= (uint64_t) -1;
116 static uint64_t arg_max_use
= (uint64_t) -1;
118 static int parse_config(void) {
119 static const ConfigTableItem items
[] = {
120 { "Coredump", "Storage", config_parse_coredump_storage
, 0, &arg_storage
},
121 { "Coredump", "Compress", config_parse_bool
, 0, &arg_compress
},
122 { "Coredump", "ProcessSizeMax", config_parse_iec_uint64
, 0, &arg_process_size_max
},
123 { "Coredump", "ExternalSizeMax", config_parse_iec_uint64
, 0, &arg_external_size_max
},
124 { "Coredump", "JournalSizeMax", config_parse_iec_size
, 0, &arg_journal_size_max
},
125 { "Coredump", "KeepFree", config_parse_iec_uint64
, 0, &arg_keep_free
},
126 { "Coredump", "MaxUse", config_parse_iec_uint64
, 0, &arg_max_use
},
130 return config_parse_many(PKGSYSCONFDIR
"/coredump.conf",
131 CONF_PATHS_NULSTR("systemd/coredump.conf.d"),
133 config_item_table_lookup
, items
,
137 static int fix_acl(int fd
, uid_t uid
) {
140 _cleanup_(acl_freep
) acl_t acl
= NULL
;
142 acl_permset_t permset
;
147 if (uid
<= SYSTEM_UID_MAX
)
150 /* Make sure normal users can read (but not write or delete)
151 * their own coredumps */
153 acl
= acl_get_fd(fd
);
155 return log_error_errno(errno
, "Failed to get ACL: %m");
157 if (acl_create_entry(&acl
, &entry
) < 0 ||
158 acl_set_tag_type(entry
, ACL_USER
) < 0 ||
159 acl_set_qualifier(entry
, &uid
) < 0) {
160 log_error_errno(errno
, "Failed to patch ACL: %m");
164 if (acl_get_permset(entry
, &permset
) < 0 ||
165 acl_add_perm(permset
, ACL_READ
) < 0)
166 return log_warning_errno(errno
, "Failed to patch ACL: %m");
168 r
= calc_acl_mask_if_needed(&acl
);
170 return log_warning_errno(r
, "Failed to patch ACL: %m");
172 if (acl_set_fd(fd
, acl
) < 0)
173 return log_error_errno(errno
, "Failed to apply ACL: %m");
179 static int fix_xattr(int fd
, const char *context
[_CONTEXT_MAX
]) {
181 static const char * const xattrs
[_CONTEXT_MAX
] = {
182 [CONTEXT_PID
] = "user.coredump.pid",
183 [CONTEXT_UID
] = "user.coredump.uid",
184 [CONTEXT_GID
] = "user.coredump.gid",
185 [CONTEXT_SIGNAL
] = "user.coredump.signal",
186 [CONTEXT_TIMESTAMP
] = "user.coredump.timestamp",
187 [CONTEXT_COMM
] = "user.coredump.comm",
188 [CONTEXT_EXE
] = "user.coredump.exe",
196 /* Attach some metadata to coredumps via extended
197 * attributes. Just because we can. */
199 for (i
= 0; i
< _CONTEXT_MAX
; i
++) {
202 if (isempty(context
[i
]) || !xattrs
[i
])
205 k
= fsetxattr(fd
, xattrs
[i
], context
[i
], strlen(context
[i
]), XATTR_CREATE
);
213 #define filename_escape(s) xescape((s), "./ ")
215 static int fix_permissions(
217 const char *filename
,
219 const char *context
[_CONTEXT_MAX
],
227 /* Ignore errors on these */
228 (void) fchmod(fd
, 0640);
229 (void) fix_acl(fd
, uid
);
230 (void) fix_xattr(fd
, context
);
233 return log_error_errno(errno
, "Failed to sync coredump %s: %m", filename
);
235 if (rename(filename
, target
) < 0)
236 return log_error_errno(errno
, "Failed to rename coredump %s -> %s: %m", filename
, target
);
241 static int maybe_remove_external_coredump(const char *filename
, uint64_t size
) {
243 /* Returns 1 if might remove, 0 if will not remove, < 0 on error. */
245 if (IN_SET(arg_storage
, COREDUMP_STORAGE_EXTERNAL
, COREDUMP_STORAGE_BOTH
) &&
246 size
<= arg_external_size_max
)
252 if (unlink(filename
) < 0 && errno
!= ENOENT
)
253 return log_error_errno(errno
, "Failed to unlink %s: %m", filename
);
258 static int make_filename(const char *context
[_CONTEXT_MAX
], char **ret
) {
259 _cleanup_free_
char *c
= NULL
, *u
= NULL
, *p
= NULL
, *t
= NULL
;
260 sd_id128_t boot
= {};
265 c
= filename_escape(context
[CONTEXT_COMM
]);
269 u
= filename_escape(context
[CONTEXT_UID
]);
273 r
= sd_id128_get_boot(&boot
);
277 p
= filename_escape(context
[CONTEXT_PID
]);
281 t
= filename_escape(context
[CONTEXT_TIMESTAMP
]);
286 "/var/lib/systemd/coredump/core.%s.%s." SD_ID128_FORMAT_STR
".%s.%s000000",
289 SD_ID128_FORMAT_VAL(boot
),
297 static int save_external_coredump(
298 const char *context
[_CONTEXT_MAX
],
303 uint64_t *ret_size
) {
305 _cleanup_free_
char *fn
= NULL
, *tmp
= NULL
;
306 _cleanup_close_
int fd
= -1;
307 uint64_t rlimit
, max_size
;
313 assert(ret_filename
);
318 r
= parse_uid(context
[CONTEXT_UID
], &uid
);
320 return log_error_errno(r
, "Failed to parse UID: %m");
322 r
= safe_atou64(context
[CONTEXT_RLIMIT
], &rlimit
);
324 return log_error_errno(r
, "Failed to parse resource limit: %s", context
[CONTEXT_RLIMIT
]);
326 /* Is coredumping disabled? Then don't bother saving/processing the coredump */
327 log_info("Core Dumping has been disabled for process %s (%s).", context
[CONTEXT_PID
], context
[CONTEXT_COMM
]);
331 /* Never store more than the process configured, or than we actually shall keep or process */
332 max_size
= MIN(rlimit
, MAX(arg_process_size_max
, arg_external_size_max
));
334 r
= make_filename(context
, &fn
);
336 return log_error_errno(r
, "Failed to determine coredump file name: %m");
338 r
= tempfn_random(fn
, NULL
, &tmp
);
340 return log_error_errno(r
, "Failed to determine temporary file name: %m");
342 mkdir_p_label("/var/lib/systemd/coredump", 0755);
344 fd
= open(tmp
, O_CREAT
|O_EXCL
|O_RDWR
|O_CLOEXEC
|O_NOCTTY
|O_NOFOLLOW
, 0640);
346 return log_error_errno(errno
, "Failed to create coredump file %s: %m", tmp
);
348 r
= copy_bytes(input_fd
, fd
, max_size
, false);
350 log_error("Coredump of %s (%s) is larger than configured processing limit, refusing.", context
[CONTEXT_PID
], context
[CONTEXT_COMM
]);
352 } else if (IN_SET(r
, -EDQUOT
, -ENOSPC
)) {
353 log_error("Not enough disk space for coredump of %s (%s), refusing.", context
[CONTEXT_PID
], context
[CONTEXT_COMM
]);
356 log_error_errno(r
, "Failed to dump coredump to file: %m");
360 if (fstat(fd
, &st
) < 0) {
361 log_error_errno(errno
, "Failed to fstat coredump %s: %m", tmp
);
365 if (lseek(fd
, 0, SEEK_SET
) == (off_t
) -1) {
366 log_error_errno(errno
, "Failed to seek on %s: %m", tmp
);
370 #if defined(HAVE_XZ) || defined(HAVE_LZ4)
371 /* If we will remove the coredump anyway, do not compress. */
372 if (maybe_remove_external_coredump(NULL
, st
.st_size
) == 0
375 _cleanup_free_
char *fn_compressed
= NULL
, *tmp_compressed
= NULL
;
376 _cleanup_close_
int fd_compressed
= -1;
378 fn_compressed
= strappend(fn
, COMPRESSED_EXT
);
379 if (!fn_compressed
) {
384 r
= tempfn_random(fn_compressed
, NULL
, &tmp_compressed
);
386 log_error_errno(r
, "Failed to determine temporary file name for %s: %m", fn_compressed
);
390 fd_compressed
= open(tmp_compressed
, O_CREAT
|O_EXCL
|O_RDWR
|O_CLOEXEC
|O_NOCTTY
|O_NOFOLLOW
, 0640);
391 if (fd_compressed
< 0) {
392 log_error_errno(errno
, "Failed to create file %s: %m", tmp_compressed
);
396 r
= compress_stream(fd
, fd_compressed
, -1);
398 log_error_errno(r
, "Failed to compress %s: %m", tmp_compressed
);
399 goto fail_compressed
;
402 r
= fix_permissions(fd_compressed
, tmp_compressed
, fn_compressed
, context
, uid
);
404 goto fail_compressed
;
406 /* OK, this worked, we can get rid of the uncompressed version now */
409 *ret_filename
= fn_compressed
; /* compressed */
410 *ret_node_fd
= fd_compressed
; /* compressed */
411 *ret_data_fd
= fd
; /* uncompressed */
412 *ret_size
= (uint64_t) st
.st_size
; /* uncompressed */
414 fn_compressed
= NULL
;
415 fd
= fd_compressed
= -1;
420 (void) unlink(tmp_compressed
);
426 r
= fix_permissions(fd
, tmp
, fn
, context
, uid
);
433 *ret_size
= (uint64_t) st
.st_size
;
445 static int allocate_journal_field(int fd
, size_t size
, char **ret
, size_t *ret_size
) {
446 _cleanup_free_
char *field
= NULL
;
453 if (lseek(fd
, 0, SEEK_SET
) == (off_t
) -1)
454 return log_warning_errno(errno
, "Failed to seek: %m");
456 field
= malloc(9 + size
);
458 log_warning("Failed to allocate memory for coredump, coredump will not be stored.");
462 memcpy(field
, "COREDUMP=", 9);
464 n
= read(fd
, field
+ 9, size
);
466 return log_error_errno((int) n
, "Failed to read core data: %m");
467 if ((size_t) n
< size
) {
468 log_error("Core data too short.");
473 *ret_size
= size
+ 9;
480 /* Joins /proc/[pid]/fd/ and /proc/[pid]/fdinfo/ into the following lines:
494 static int compose_open_fds(pid_t pid
, char **open_fds
) {
495 _cleanup_closedir_
DIR *proc_fd_dir
= NULL
;
496 _cleanup_close_
int proc_fdinfo_fd
= -1;
497 _cleanup_free_
char *buffer
= NULL
;
498 _cleanup_fclose_
FILE *stream
= NULL
;
499 const char *fddelim
= "", *path
;
500 struct dirent
*dent
= NULL
;
505 assert(open_fds
!= NULL
);
507 path
= procfs_file_alloca(pid
, "fd");
508 proc_fd_dir
= opendir(path
);
512 proc_fdinfo_fd
= openat(dirfd(proc_fd_dir
), "../fdinfo", O_DIRECTORY
|O_NOFOLLOW
|O_CLOEXEC
|O_PATH
);
513 if (proc_fdinfo_fd
< 0)
516 stream
= open_memstream(&buffer
, &size
);
520 FOREACH_DIRENT(dent
, proc_fd_dir
, return -errno
) {
521 _cleanup_fclose_
FILE *fdinfo
= NULL
;
522 _cleanup_free_
char *fdname
= NULL
;
526 r
= readlinkat_malloc(dirfd(proc_fd_dir
), dent
->d_name
, &fdname
);
530 fprintf(stream
, "%s%s:%s\n", fddelim
, dent
->d_name
, fdname
);
533 /* Use the directory entry from /proc/[pid]/fd with /proc/[pid]/fdinfo */
534 fd
= openat(proc_fdinfo_fd
, dent
->d_name
, O_NOFOLLOW
|O_CLOEXEC
|O_RDONLY
);
538 fdinfo
= fdopen(fd
, "re");
539 if (fdinfo
== NULL
) {
544 FOREACH_LINE(line
, fdinfo
, break) {
546 if (!endswith(line
, "\n"))
552 stream
= safe_fclose(stream
);
563 static int change_uid_gid(const char *context
[]) {
568 r
= parse_uid(context
[CONTEXT_UID
], &uid
);
572 if (uid
<= SYSTEM_UID_MAX
) {
573 const char *user
= "systemd-coredump";
575 r
= get_user_creds(&user
, &uid
, &gid
, NULL
, NULL
);
577 log_warning_errno(r
, "Cannot resolve %s user. Proceeding to dump core as root: %m", user
);
581 r
= parse_gid(context
[CONTEXT_GID
], &gid
);
586 return drop_privileges(uid
, gid
, 0);
589 static int submit_coredump(
590 const char *context
[_CONTEXT_MAX
],
592 size_t n_iovec_allocated
,
596 _cleanup_close_
int coredump_fd
= -1, coredump_node_fd
= -1;
597 _cleanup_free_
char *core_message
= NULL
, *filename
= NULL
, *coredump_data
= NULL
;
598 uint64_t coredump_size
;
603 assert(n_iovec_allocated
>= n_iovec
+ 3);
604 assert(input_fd
>= 0);
606 /* Vacuum before we write anything again */
607 (void) coredump_vacuum(-1, arg_keep_free
, arg_max_use
);
609 /* Always stream the coredump to disk, if that's possible */
610 r
= save_external_coredump(context
, input_fd
, &filename
, &coredump_node_fd
, &coredump_fd
, &coredump_size
);
612 /* Skip whole core dumping part */
615 /* If we don't want to keep the coredump on disk, remove it now, as later on we will lack the privileges for
616 * it. However, we keep the fd to it, so that we can still process it and log it. */
617 r
= maybe_remove_external_coredump(filename
, coredump_size
);
621 const char *coredump_filename
;
623 coredump_filename
= strjoina("COREDUMP_FILENAME=", filename
);
624 IOVEC_SET_STRING(iovec
[n_iovec
++], coredump_filename
);
627 /* Vacuum again, but exclude the coredump we just created */
628 (void) coredump_vacuum(coredump_node_fd
>= 0 ? coredump_node_fd
: coredump_fd
, arg_keep_free
, arg_max_use
);
630 /* Now, let's drop privileges to become the user who owns the segfaulted process and allocate the coredump
631 * memory under the user's uid. This also ensures that the credentials journald will see are the ones of the
632 * coredumping user, thus making sure the user gets access to the core dump. Let's also get rid of all
633 * capabilities, if we run as root, we won't need them anymore. */
634 r
= change_uid_gid(context
);
636 return log_error_errno(r
, "Failed to drop privileges: %m");
639 /* Try to get a strack trace if we can */
640 if (coredump_size
<= arg_process_size_max
) {
641 _cleanup_free_
char *stacktrace
= NULL
;
643 r
= coredump_make_stack_trace(coredump_fd
, context
[CONTEXT_EXE
], &stacktrace
);
645 core_message
= strjoin("MESSAGE=Process ", context
[CONTEXT_PID
], " (", context
[CONTEXT_COMM
], ") of user ", context
[CONTEXT_UID
], " dumped core.\n\n", stacktrace
, NULL
);
646 else if (r
== -EINVAL
)
647 log_warning("Failed to generate stack trace: %s", dwfl_errmsg(dwfl_errno()));
649 log_warning_errno(r
, "Failed to generate stack trace: %m");
655 core_message
= strjoin("MESSAGE=Process ", context
[CONTEXT_PID
], " (", context
[CONTEXT_COMM
], ") of user ", context
[CONTEXT_UID
], " dumped core.", NULL
);
657 IOVEC_SET_STRING(iovec
[n_iovec
++], core_message
);
659 /* Optionally store the entire coredump in the journal */
660 if (IN_SET(arg_storage
, COREDUMP_STORAGE_JOURNAL
, COREDUMP_STORAGE_BOTH
) &&
661 coredump_size
<= arg_journal_size_max
) {
664 /* Store the coredump itself in the journal */
666 r
= allocate_journal_field(coredump_fd
, (size_t) coredump_size
, &coredump_data
, &sz
);
668 iovec
[n_iovec
].iov_base
= coredump_data
;
669 iovec
[n_iovec
].iov_len
= sz
;
674 assert(n_iovec
<= n_iovec_allocated
);
676 r
= sd_journal_sendv(iovec
, n_iovec
);
678 return log_error_errno(r
, "Failed to log coredump: %m");
683 static void map_context_fields(const struct iovec
*iovec
, const char *context
[]) {
685 static const char * const context_field_names
[_CONTEXT_MAX
] = {
686 [CONTEXT_PID
] = "COREDUMP_PID=",
687 [CONTEXT_UID
] = "COREDUMP_UID=",
688 [CONTEXT_GID
] = "COREDUMP_GID=",
689 [CONTEXT_SIGNAL
] = "COREDUMP_SIGNAL=",
690 [CONTEXT_TIMESTAMP
] = "COREDUMP_TIMESTAMP=",
691 [CONTEXT_COMM
] = "COREDUMP_COMM=",
692 [CONTEXT_EXE
] = "COREDUMP_EXE=",
693 [CONTEXT_RLIMIT
] = "COREDUMP_RLIMIT=",
701 for (i
= 0; i
< _CONTEXT_MAX
; i
++) {
704 l
= strlen(context_field_names
[i
]);
705 if (iovec
->iov_len
< l
)
708 if (memcmp(iovec
->iov_base
, context_field_names
[i
], l
) != 0)
711 /* Note that these strings are NUL terminated, because we made sure that a trailing NUL byte is in the
712 * buffer, though not included in the iov_len count. (see below) */
713 context
[i
] = (char*) iovec
->iov_base
+ l
;
718 static int process_socket(int fd
) {
719 _cleanup_close_
int coredump_fd
= -1;
720 struct iovec
*iovec
= NULL
;
721 size_t n_iovec
= 0, n_iovec_allocated
= 0, i
;
722 const char *context
[_CONTEXT_MAX
] = {};
727 log_set_target(LOG_TARGET_AUTO
);
728 log_parse_environment();
733 struct cmsghdr cmsghdr
;
734 uint8_t buf
[CMSG_SPACE(sizeof(int))];
737 .msg_control
= &control
,
738 .msg_controllen
= sizeof(control
),
744 if (!GREEDY_REALLOC(iovec
, n_iovec_allocated
, n_iovec
+ 3)) {
749 if (ioctl(fd
, FIONREAD
, &l
) < 0) {
750 r
= log_error_errno(errno
, "FIONREAD failed: %m");
756 iovec
[n_iovec
].iov_len
= l
;
757 iovec
[n_iovec
].iov_base
= malloc(l
+ 1);
759 if (!iovec
[n_iovec
].iov_base
) {
764 mh
.msg_iov
= iovec
+ n_iovec
;
766 n
= recvmsg(fd
, &mh
, MSG_NOSIGNAL
|MSG_CMSG_CLOEXEC
);
768 free(iovec
[n_iovec
].iov_base
);
769 r
= log_error_errno(errno
, "Failed to receive datagram: %m");
774 struct cmsghdr
*cmsg
, *found
= NULL
;
775 /* The final zero-length datagram carries the file descriptor and tells us that we're done. */
777 free(iovec
[n_iovec
].iov_base
);
779 CMSG_FOREACH(cmsg
, &mh
) {
780 if (cmsg
->cmsg_level
== SOL_SOCKET
&&
781 cmsg
->cmsg_type
== SCM_RIGHTS
&&
782 cmsg
->cmsg_len
== CMSG_LEN(sizeof(int))) {
789 log_error("Coredump file descriptor missing.");
794 assert(coredump_fd
< 0);
795 coredump_fd
= *(int*) CMSG_DATA(found
);
799 /* Add trailing NUL byte, in case these are strings */
800 ((char*) iovec
[n_iovec
].iov_base
)[n
] = 0;
801 iovec
[n_iovec
].iov_len
= (size_t) n
;
804 map_context_fields(iovec
+ n_iovec
, context
);
808 if (!GREEDY_REALLOC(iovec
, n_iovec_allocated
, n_iovec
+ 3)) {
813 /* Make sure we we got all data we really need */
814 assert(context
[CONTEXT_PID
]);
815 assert(context
[CONTEXT_UID
]);
816 assert(context
[CONTEXT_GID
]);
817 assert(context
[CONTEXT_SIGNAL
]);
818 assert(context
[CONTEXT_TIMESTAMP
]);
819 assert(context
[CONTEXT_RLIMIT
]);
820 assert(context
[CONTEXT_COMM
]);
821 assert(coredump_fd
>= 0);
823 r
= submit_coredump(context
, iovec
, n_iovec_allocated
, n_iovec
, coredump_fd
);
826 for (i
= 0; i
< n_iovec
; i
++)
827 free(iovec
[i
].iov_base
);
833 static int send_iovec(const struct iovec iovec
[], size_t n_iovec
, int input_fd
) {
835 static const union sockaddr_union sa
= {
836 .un
.sun_family
= AF_UNIX
,
837 .un
.sun_path
= "/run/systemd/coredump",
839 _cleanup_close_
int fd
= -1;
843 assert(iovec
|| n_iovec
<= 0);
844 assert(input_fd
>= 0);
846 fd
= socket(AF_UNIX
, SOCK_SEQPACKET
|SOCK_CLOEXEC
, 0);
848 return log_error_errno(errno
, "Failed to create coredump socket: %m");
850 if (connect(fd
, &sa
.sa
, offsetof(union sockaddr_union
, un
.sun_path
) + strlen(sa
.un
.sun_path
)) < 0)
851 return log_error_errno(errno
, "Failed to connect to coredump service: %m");
853 for (i
= 0; i
< n_iovec
; i
++) {
855 assert(iovec
[i
].iov_len
> 0);
857 n
= send(fd
, iovec
[i
].iov_base
, iovec
[i
].iov_len
, MSG_NOSIGNAL
);
859 return log_error_errno(errno
, "Failed to send coredump datagram: %m");
862 r
= send_one_fd(fd
, input_fd
, 0);
864 return log_error_errno(r
, "Failed to send coredump fd: %m");
869 static int process_journald_crash(const char *context
[], int input_fd
) {
870 _cleanup_close_
int coredump_fd
= -1, coredump_node_fd
= -1;
871 _cleanup_free_
char *filename
= NULL
;
872 uint64_t coredump_size
;
876 assert(input_fd
>= 0);
878 /* If we are journald, we cut things short, don't write to the journal, but still create a coredump. */
880 if (arg_storage
!= COREDUMP_STORAGE_NONE
)
881 arg_storage
= COREDUMP_STORAGE_EXTERNAL
;
883 r
= save_external_coredump(context
, input_fd
, &filename
, &coredump_node_fd
, &coredump_fd
, &coredump_size
);
887 r
= maybe_remove_external_coredump(filename
, coredump_size
);
891 log_info("Detected coredump of the journal daemon itself, diverted to %s.", filename
);
895 static int process_kernel(int argc
, char* argv
[]) {
897 /* The small core field we allocate on the stack, to keep things simple */
899 *core_pid
= NULL
, *core_uid
= NULL
, *core_gid
= NULL
, *core_signal
= NULL
,
900 *core_session
= NULL
, *core_exe
= NULL
, *core_comm
= NULL
, *core_cmdline
= NULL
,
901 *core_cgroup
= NULL
, *core_cwd
= NULL
, *core_root
= NULL
, *core_unit
= NULL
,
902 *core_user_unit
= NULL
, *core_slice
= NULL
, *core_timestamp
= NULL
, *core_rlimit
= NULL
;
904 /* The larger ones we allocate on the heap */
906 *core_owner_uid
= NULL
, *core_open_fds
= NULL
, *core_proc_status
= NULL
,
907 *core_proc_maps
= NULL
, *core_proc_limits
= NULL
, *core_proc_cgroup
= NULL
, *core_environ
= NULL
;
909 _cleanup_free_
char *exe
= NULL
, *comm
= NULL
;
910 const char *context
[_CONTEXT_MAX
];
911 struct iovec iovec
[25];
919 if (argc
< CONTEXT_COMM
+ 1) {
920 log_error("Not enough arguments passed from kernel (%i, expected %i).", argc
- 1, CONTEXT_COMM
+ 1 - 1);
924 r
= parse_pid(argv
[CONTEXT_PID
+ 1], &pid
);
926 return log_error_errno(r
, "Failed to parse PID.");
928 r
= get_process_comm(pid
, &comm
);
930 log_warning_errno(r
, "Failed to get COMM, falling back to the command line: %m");
931 comm
= strv_join(argv
+ CONTEXT_COMM
+ 1, " ");
936 r
= get_process_exe(pid
, &exe
);
938 log_warning_errno(r
, "Failed to get EXE, ignoring: %m");
940 context
[CONTEXT_PID
] = argv
[CONTEXT_PID
+ 1];
941 context
[CONTEXT_UID
] = argv
[CONTEXT_UID
+ 1];
942 context
[CONTEXT_GID
] = argv
[CONTEXT_GID
+ 1];
943 context
[CONTEXT_SIGNAL
] = argv
[CONTEXT_SIGNAL
+ 1];
944 context
[CONTEXT_TIMESTAMP
] = argv
[CONTEXT_TIMESTAMP
+ 1];
945 context
[CONTEXT_RLIMIT
] = argv
[CONTEXT_RLIMIT
+ 1];
946 context
[CONTEXT_COMM
] = comm
;
947 context
[CONTEXT_EXE
] = exe
;
949 if (cg_pid_get_unit(pid
, &t
) >= 0) {
951 if (streq(t
, SPECIAL_JOURNALD_SERVICE
)) {
953 return process_journald_crash(context
, STDIN_FILENO
);
956 core_unit
= strjoina("COREDUMP_UNIT=", t
);
959 IOVEC_SET_STRING(iovec
[n_iovec
++], core_unit
);
962 /* OK, now we know it's not the journal, hence we can make use of it now. */
963 log_set_target(LOG_TARGET_JOURNAL_OR_KMSG
);
966 if (cg_pid_get_user_unit(pid
, &t
) >= 0) {
967 core_user_unit
= strjoina("COREDUMP_USER_UNIT=", t
);
970 IOVEC_SET_STRING(iovec
[n_iovec
++], core_user_unit
);
973 core_pid
= strjoina("COREDUMP_PID=", context
[CONTEXT_PID
]);
974 IOVEC_SET_STRING(iovec
[n_iovec
++], core_pid
);
976 core_uid
= strjoina("COREDUMP_UID=", context
[CONTEXT_UID
]);
977 IOVEC_SET_STRING(iovec
[n_iovec
++], core_uid
);
979 core_gid
= strjoina("COREDUMP_GID=", context
[CONTEXT_GID
]);
980 IOVEC_SET_STRING(iovec
[n_iovec
++], core_gid
);
982 core_signal
= strjoina("COREDUMP_SIGNAL=", context
[CONTEXT_SIGNAL
]);
983 IOVEC_SET_STRING(iovec
[n_iovec
++], core_signal
);
985 core_rlimit
= strjoina("COREDUMP_RLIMIT=", context
[CONTEXT_RLIMIT
]);
986 IOVEC_SET_STRING(iovec
[n_iovec
++], core_rlimit
);
988 if (sd_pid_get_session(pid
, &t
) >= 0) {
989 core_session
= strjoina("COREDUMP_SESSION=", t
);
992 IOVEC_SET_STRING(iovec
[n_iovec
++], core_session
);
995 if (sd_pid_get_owner_uid(pid
, &owner_uid
) >= 0) {
996 r
= asprintf(&core_owner_uid
, "COREDUMP_OWNER_UID=" UID_FMT
, owner_uid
);
998 IOVEC_SET_STRING(iovec
[n_iovec
++], core_owner_uid
);
1001 if (sd_pid_get_slice(pid
, &t
) >= 0) {
1002 core_slice
= strjoina("COREDUMP_SLICE=", t
);
1005 IOVEC_SET_STRING(iovec
[n_iovec
++], core_slice
);
1009 core_comm
= strjoina("COREDUMP_COMM=", comm
);
1010 IOVEC_SET_STRING(iovec
[n_iovec
++], core_comm
);
1014 core_exe
= strjoina("COREDUMP_EXE=", exe
);
1015 IOVEC_SET_STRING(iovec
[n_iovec
++], core_exe
);
1018 if (get_process_cmdline(pid
, 0, false, &t
) >= 0) {
1019 core_cmdline
= strjoina("COREDUMP_CMDLINE=", t
);
1022 IOVEC_SET_STRING(iovec
[n_iovec
++], core_cmdline
);
1025 if (cg_pid_get_path_shifted(pid
, NULL
, &t
) >= 0) {
1026 core_cgroup
= strjoina("COREDUMP_CGROUP=", t
);
1029 IOVEC_SET_STRING(iovec
[n_iovec
++], core_cgroup
);
1032 if (compose_open_fds(pid
, &t
) >= 0) {
1033 core_open_fds
= strappend("COREDUMP_OPEN_FDS=", t
);
1037 IOVEC_SET_STRING(iovec
[n_iovec
++], core_open_fds
);
1040 p
= procfs_file_alloca(pid
, "status");
1041 if (read_full_file(p
, &t
, NULL
) >= 0) {
1042 core_proc_status
= strappend("COREDUMP_PROC_STATUS=", t
);
1045 if (core_proc_status
)
1046 IOVEC_SET_STRING(iovec
[n_iovec
++], core_proc_status
);
1049 p
= procfs_file_alloca(pid
, "maps");
1050 if (read_full_file(p
, &t
, NULL
) >= 0) {
1051 core_proc_maps
= strappend("COREDUMP_PROC_MAPS=", t
);
1055 IOVEC_SET_STRING(iovec
[n_iovec
++], core_proc_maps
);
1058 p
= procfs_file_alloca(pid
, "limits");
1059 if (read_full_file(p
, &t
, NULL
) >= 0) {
1060 core_proc_limits
= strappend("COREDUMP_PROC_LIMITS=", t
);
1063 if (core_proc_limits
)
1064 IOVEC_SET_STRING(iovec
[n_iovec
++], core_proc_limits
);
1067 p
= procfs_file_alloca(pid
, "cgroup");
1068 if (read_full_file(p
, &t
, NULL
) >=0) {
1069 core_proc_cgroup
= strappend("COREDUMP_PROC_CGROUP=", t
);
1072 if (core_proc_cgroup
)
1073 IOVEC_SET_STRING(iovec
[n_iovec
++], core_proc_cgroup
);
1076 if (get_process_cwd(pid
, &t
) >= 0) {
1077 core_cwd
= strjoina("COREDUMP_CWD=", t
);
1080 IOVEC_SET_STRING(iovec
[n_iovec
++], core_cwd
);
1083 if (get_process_root(pid
, &t
) >= 0) {
1084 core_root
= strjoina("COREDUMP_ROOT=", t
);
1087 IOVEC_SET_STRING(iovec
[n_iovec
++], core_root
);
1090 if (get_process_environ(pid
, &t
) >= 0) {
1091 core_environ
= strappend("COREDUMP_ENVIRON=", t
);
1095 IOVEC_SET_STRING(iovec
[n_iovec
++], core_environ
);
1098 core_timestamp
= strjoina("COREDUMP_TIMESTAMP=", context
[CONTEXT_TIMESTAMP
], "000000", NULL
);
1099 IOVEC_SET_STRING(iovec
[n_iovec
++], core_timestamp
);
1101 IOVEC_SET_STRING(iovec
[n_iovec
++], "MESSAGE_ID=fc2e22bc6ee647b6b90729ab34a250b1");
1103 assert_cc(2 == LOG_CRIT
);
1104 IOVEC_SET_STRING(iovec
[n_iovec
++], "PRIORITY=2");
1106 assert(n_iovec
<= ELEMENTSOF(iovec
));
1108 return send_iovec(iovec
, n_iovec
, STDIN_FILENO
);
1111 int main(int argc
, char *argv
[]) {
1114 /* First, log to a safe place, since we don't know what crashed and it might be journald which we'd rather not
1117 log_set_target(LOG_TARGET_KMSG
);
1120 /* Make sure we never enter a loop */
1121 (void) prctl(PR_SET_DUMPABLE
, 0);
1123 /* Ignore all parse errors */
1124 (void) parse_config();
1126 log_debug("Selected storage '%s'.", coredump_storage_to_string(arg_storage
));
1127 log_debug("Selected compression %s.", yes_no(arg_compress
));
1129 r
= sd_listen_fds(false);
1131 log_error_errno(r
, "Failed to determine number of file descriptor: %m");
1135 /* If we got an fd passed, we are running in coredumpd mode. Otherwise we are invoked from the kernel as
1136 * coredump handler */
1138 r
= process_kernel(argc
, argv
);
1140 r
= process_socket(SD_LISTEN_FDS_START
);
1142 log_error("Received unexpected number of file descriptors.");
1147 return r
< 0 ? EXIT_FAILURE
: EXIT_SUCCESS
;