From owner-cvs-all Wed Sep 16 07:48:01 1998 Return-Path: Received: (from daemon@localhost) by hub.freebsd.org (8.8.8/8.8.8) id HAA21668 for cvs-all-outgoing; Wed, 16 Sep 1998 07:48:01 -0700 (PDT) (envelope-from owner-cvs-all) Received: from apollo.backplane.com (apollo.backplane.com [209.157.86.2]) by hub.freebsd.org (8.8.8/8.8.8) with ESMTP id HAA21622; Wed, 16 Sep 1998 07:47:51 -0700 (PDT) (envelope-from dillon@backplane.com) Received: (dillon@localhost) by apollo.backplane.com (8.8.8/8.6.5) id HAA24256; Wed, 16 Sep 1998 07:47:05 -0700 (PDT) Date: Wed, 16 Sep 1998 07:47:05 -0700 (PDT) From: Matthew Dillon Message-Id: <199809161447.HAA24256@apollo.backplane.com> To: Andrzej Bialecki Cc: John Polstra , cvs-committers@FreeBSD.ORG, cvs-all@FreeBSD.ORG Subject: Re: cvs commit: src/sys/kern imgact_elf.c References: Sender: owner-cvs-all@FreeBSD.ORG X-Loop: FreeBSD.org Precedence: bulk :On Tue, 15 Sep 1998, John Polstra wrote: : :> jdp 1998/09/15 14:46:35 PDT :> :> Modified files: :> sys/kern imgact_elf.c :> Log: :> Instead of just the data and stack segments, include all writable :> segments (except memory-mapped devices) in the ELF core file. This :> is really nice. You get access to the data areas of all shared :> libraries, and even to files that are mapped read-write. ^^^^^^^^^ ^^^^^^^^^^^^^^^^^^^^^ : ^^^^^^^^^ ^^^^^^^^^^^^^^^^^^^^^ :I wonder if it could be used to gather some security related info out of :core file... : :Andrzej Bialecki There have been many occassions where I have not been able to debug programs from core dumps due to the fact that the core dumps do not include process's entire memory area. I would be nice if all mmap'd segments were included in the core dump. Since core's do not occur for suid programs anyway, and since you can access all the segments when you attach a debugger to the running process, I do not see any particular security problem with doing this and it would make debugging core files more useablee. Right now there are several major programs which allocate memory via mmap() that cannot be debugged from a core dump due to the fact that the corefile does not contained the mmap'd segments. -Matt Matthew Dillon Engineering, HiWay Technologies, Inc. & BEST Internet Communications & God knows what else. (Please include original email in any response)