Hacker News new | past | comments | ask | show | jobs | submit login
An obscure kernel feature to get more info about dying processes (timetobleed.com)
132 points by ice799 on Sept 20, 2010 | hide | past | favorite | 28 comments



This is actually quite interesting - I didn't know you could do that, and I will likely employ it in the future, especially with a remote web server or something you can't immediately get to. So as you roll in, you check your email on your phone, and know walking in what you're getting into and likely how to fix it. From a time-optimization viewpoint, this is nigh-invaluable.

Plus this guy has some other very nifty articles.

But I guess (glancing at first few comments) that "haterz gonna hate."


Fedora's Automated Bug Reporting Tool (abrt) uses this to automatically produce crash reports, which you can sanitize and approve to post in a central location for developers. I imagine that Ubuntu does something similar.


So what happens if the helper application crashes and tries to dump core? Would it try to run another instance of it to handle that crash, and so on, leading to a "core bomb"?


[deleted]


Did you even read some of the other articles on his website?

GCC Optimisations that fail: http://timetobleed.com/gcc-optimization-flag-makes-your-64bi...

Symbol tables on Linux and Mac OS X and how to hook them: http://timetobleed.com/dynamic-linking-elf-vs-mach-o/ http://timetobleed.com/dynamic-symbol-table-duel-elf-vs-mach...

Building a Ruby memory profiler: http://timetobleed.com/string-together-global-offset-tables-... http://timetobleed.com/rewrite-your-ruby-vm-at-runtime-to-ho...

Hooking inlined functions: http://timetobleed.com/hot-patching-inlined-functions-with-x...

He even spoke at DefCon 18: http://vimeo.com/14951625

What have you accomplished? What knowledge have you posted out there for the rest of the world to use?


[deleted]


don't let the door hit you on the way out.

the original author wasn't writing his blog post for you, and he didn't submit it here. the post is at the top of the front page because 26 other HN users found it interesting. i learned something new, and i'm grateful.


I don't feel like this is a particularly fair criticism of this post. First, this guy is rooting around in the kernel code for fun. Why are we criticizing this? Second, I've done a fair amount of C programming and mucking about at the OS level, and I wasn't aware of this feature. Maybe that's because most of my production deployment has been on BSD and Solaris, not Linux, but I found the post useful. Third, I didn't feel like the author was particularly tooting his own horn, just saying "Hey I found about about this cool thing; maybe you will find this useful too".


u mad!


Let's go through some of your "points".

The comparison with Torvalds is bizarre. Linus has done an enormous amount of self-promotion (warranted as it is), and even admits to having an ego the size of Joe's biceps. So I don't know what point you're trying to make there.

Next and most importantly. While you (a bastard love-child of Kernighan perhaps) may find this feature banal, a decent number of C programmers aren't familiar with this method; and if they are, they haven't done shit with it. So hating on someone for actually writing free code that makes a bunch of dev's lives easier is, well, just kinda jealous.

Lastly. If a comment like your comment, does, in fact, generate a large number of 'U Mad' replies -- well, that is strong evidence that you are, in fact, mad.

(btw, Joe is not 20 years old. "20" actually refers to the number of women Joe sleeps with in a typical night.)


I read it as simply that he was excited about something cool he found. And it is cool. Perhaps you already knew about it; I didn't. Either way, there's no need to be an asshole. ("This plebe"? That's crossing the A-line.)


Thinking this guy is a 'Ruby person' and branding him as one to try and make some point is just not even wrong. It's completely besides anything near reality. Check out some of his others posts before climbing on your favorite hobbyhorse. He is as much a C programmer as you are.


Ruby and Python guys can be C guys. Even Matz and Guido are C guys before they are Ruby and Python guys, respectively.

There is no one language, toolkit or framework.


[deleted]


Why is it embarrassing?


Sounds like you're annoyed with these folks for discovering something new (to them) and being excited about it in public. What exactly bothers you about that?


[deleted]


If common lisp were obscure and not something that was very common knowledge you would have a point. I had never heard of this ability that he brought out in the open, because of having this posted on HN I now learned something new today, something I can take with me and teach others or use in my daily job.

That in and of itself is fantastic and exactly why I like posts such as the one he made.


Let me make sure I'm understanding you correctly: You're saying that the Linux kernel's ability to easily run arbitrary code when a core dump occurs is fundamental knowledge that all reasonably experienced C programmers (and most HN readers) possess?


Why you mad tho?


[deleted]



Don't hate, Joe Damato is teh man sex.


It is nice to know that Linux has this feature, but it essentially amounts to a JIT debugger, and has been in other OSes for a long time. In Windows, it's been there since at least NT 4.


Hook root when a process crashes? How long until an exploit?


If you have the ability to modify or create files in /proc you almost certainly already control the system.


Not necessarily. You can trick someone who does have access to write /proc into writing something to /proc for you via symlink or another method.

Disclosure: I work on the unrEVOked rooting tool for android and we do stuff like this all the time.


You only need to modify the tool that runs as the hook script...which may or may not be protected


on the other hand, it makes for an interesting rootkit hook.


Which is more dangerous than all the others things you can do as root - like inserting an arbitrary kernel module - how?


Dangerous: no, but he said interesting, so perhaps. The advantage of using little known features, for rootkits, is that people are less likely to look for them.


i never said more dangerous nor intended it.

it's not a very good rootkit by itself, certainly, as typically rootkits will monkey with the kernel to hide processes and network sockets.

it's interesting because it's probably the simplest rootkit method i can think of (next to setuid binaries). it's less obvious than a setuid. it's not something that anyone sane would use by itself because like i said--it doesn't hide you.


it's not (yet) an obvious place to look.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: