core file generate

/proc/sys/fs/suid_dumpable
0 => 1

/etc/profile
ulimit -c unlimited

/etc/security/limits.conf
+*               soft    core            unlimited
+*               hard    core            unlimited

 

 

Home » The /proc filesystem documentation » /proc/sys » /proc/sys/fs

suid_dumpable

Submitted by admin on Thu, 2006-06-01 01:45

The value in this file determines whether core dump files are produced for set-user-ID or otherwise protected/tainted binaries. Three different integer values can be specified:

• 0 (default) - This provides the traditional behaviour. A core dump will not be produced for a process which has changed credentials (by calling seteuid(2), setgid(2), or similar, or by executing a set-user-ID or set-group-ID program) or whose binary does not have read permission enabled.
• 1 ("debug") - All processes dump core when possible. The core dump is owned by the file system user ID of the dumping process and no security is applied. This is intended for system debugging situations only. Ptrace is unchecked.
• 2 ("suidsafe") - Any binary which normally would not be dumped (see "0" above) is dumped readable by root only. This allows the user to remove the core dump file but not to read it. For security reasons core dumps in this mode will not overwrite one another or other files. This mode is appropriate when administrators are attempting to debug problems in a normal environment.