[Crash-utility] [patch] crash: Show warning message if specified dumpfile has its kernel data scrubbed out.

Dave Anderson anderson at redhat.com
Fri Sep 16 18:07:57 UTC 2011



----- Original Message -----
> The new version of makedumpfile 1.4.0 allows user to filter out kernel data
> (e.g. security keys, confidential/secret information etc.) from the vmcore.
> The data to be filtered out is poisoned with character 'X' (0x58 in Hex).
> The filtered ELF kdump now carries a new ELF note section "ERASEINFO" that
> contains eraseinfo data. The filtered compressed kdump now contains new
> members (offset_eraseinfo, size_eraseinfo) int the sub header with new header
> version 5.
> 
> With the above change in place, there may be instances where the filtered
> dumpfile may not be readable OR may not be helpful in analyzing the problem
> using crash tool. Most of the time crash tool will be able to read/analyze
> the dump unless someone scrubs out the data on which crash utility is
> dependent on. Hence, This patch adds support into crash utility to detect the
> above changes and show early warning message to the user about the fact that
> he is dealing with filtered dumpfile.
> 
> This patch adds support for "help -n" output to display the filter data
> strings that are appended to the dumpfile or stored in an ELF note.
> 
> Signed-off-by: Mahesh Salgaonkar <mahesh at linux.vnet.ibm.com>

Hi Mahesh,

This patch looks good -- I rewrote the warning message to look like this:

WARNING: /var/crash/2010-08-15-15:49/vmcore:
         Kernel data has been erased from this dumpfile.  This may cause
         the crash session to fail entirely, cause commands to fail, or
         result in unpredictable runtime behavior.

Queued for crash-5.1.8.

Thanks,
  Dave




More information about the Crash-utility mailing list