From: Emanuele Rocca Date: Wed, 6 May 2026 15:46:21 +0000 (+0000) Subject: coredump: add COREDUMP_CODE field for signal reason X-Git-Tag: v261-rc1~91^2 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=ed143d8623086ebc835679c7f29ae3ff7a69cde3;p=thirdparty%2Fsystemd.git coredump: add COREDUMP_CODE field for signal reason Introduce COREDUMP_CODE as a new captured field alongside the existing COREDUMP_SIGNAL. While COREDUMP_SIGNAL identifies the signal number that terminated the process, COREDUMP_CODE provides the reason the signal was sent. For example, a process terminated by SIGSEGV due to invalid permissions would produce COREDUMP_SIGNAL=11 and COREDUMP_CODE=2 (SEGV_ACCERR). The kernel exposes coredump_code via pidfd starting with v7.1: https://git.kernel.org/torvalds/c/701f7f4fbabbf4989ba6fbf033b160dd943221d5 System administrators can find both the signal and code in coredumpctl info: $ coredumpctl info | grep Signal: Signal: 11 (SEGV) si_code: SEGV_MAPERR Signed-off-by: Emanuele Rocca --- diff --git a/man/systemd-coredump.xml b/man/systemd-coredump.xml index d499600dc15..c27981bd89b 100644 --- a/man/systemd-coredump.xml +++ b/man/systemd-coredump.xml @@ -201,6 +201,7 @@ COREDUMP_UID=1000 COREDUMP_GID=1000 COREDUMP_SIGNAL_NAME=SIGSEGV COREDUMP_SIGNAL=11 +COREDUMP_CODE=2 COREDUMP_TIMESTAMP=1614342930000000 COREDUMP_COMM=Web Content COREDUMP_EXE=/usr/lib64/firefox/firefox @@ -327,6 +328,19 @@ COREDUMP_FILENAME=/var/lib/systemd/coredump/core.Web….552351.….zst + + COREDUMP_CODE= + + The reason why the signal was sent as a numerical value. The code is defined as + field si_code in the siginfo_t structure and + documented in sigaction2. + + + + + + COREDUMP_CWD= COREDUMP_ROOT= diff --git a/src/coredump/coredump-context.c b/src/coredump/coredump-context.c index 6cacae4eff1..24d273499a3 100644 --- a/src/coredump/coredump-context.c +++ b/src/coredump/coredump-context.c @@ -14,6 +14,7 @@ #include "memstream-util.h" #include "namespace-util.h" #include "parse-util.h" +#include "pidfd-util.h" #include "process-util.h" #include "signal-util.h" #include "special.h" @@ -38,6 +39,7 @@ static const char * const metadata_field_table[_META_MAX] = { [META_UNIT] = "COREDUMP_UNIT=", [META_PROC_AUXV] = "COREDUMP_PROC_AUXV=", [META_THREAD_NAME] = "COREDUMP_THREAD_NAME=", + [META_CODE] = "COREDUMP_CODE=", }; DEFINE_PRIVATE_STRING_TABLE_LOOKUP_TO_STRING(metadata_field, MetadataField); @@ -176,6 +178,34 @@ static int get_process_container_parent_cmdline(PidRef *pid, char** ret_cmdline) return 1; } +/* The kernel passes si_signo through core_pattern (%s). Starting with v7.1, + * si_code is reported as well via pidfd. */ +static int coredump_context_read_pidfd_info(CoredumpContext *context) { + struct pidfd_info info = { + .mask = PIDFD_INFO_COREDUMP, + }; + int r; + + assert(context); + assert(pidref_is_set(&context->pidref)); + + if (!context->got_pidfd || context->pidref.fd < 0) + return 0; + + r = pidfd_get_info(context->pidref.fd, &info); + if (ERRNO_IS_NEG_NOT_SUPPORTED(r)) + return log_debug_errno(r, "PIDFD_INFO_COREDUMP not supported, ignoring: %m"); + if (r < 0) + return log_debug_errno(r, "Failed to get pidfd coredump info, ignoring: %m"); + + if (FLAGS_SET(info.mask, PIDFD_INFO_COREDUMP_CODE)) { + context->code = (int) info.coredump_code; + context->got_code = true; + } + + return 0; +} + int coredump_context_build_iovw(CoredumpContext *context) { char *t; int r; @@ -213,6 +243,10 @@ int coredump_context_build_iovw(CoredumpContext *context) { return log_error_errno(r, "Failed to add COREDUMP_SIGNAL= field: %m"); (void) iovw_put_string_field(&context->iovw, "COREDUMP_SIGNAL_NAME=SIG", signal_to_string(context->signo)); + + /* Emit si_code if we learned it from pidfd_info */ + if (context->got_code) + (void) iovw_put_string_fieldf(&context->iovw, "COREDUMP_CODE=", "%i", context->code); } r = iovw_put_string_fieldf(&context->iovw, "COREDUMP_TIMESTAMP=", USEC_FMT, context->timestamp); @@ -367,6 +401,8 @@ static int coredump_context_parse_from_procfs(CoredumpContext *context) { if (r < 0) log_warning_errno(r, "Failed to get auxv, ignoring: %m"); + (void) coredump_context_read_pidfd_info(context); + r = pidref_verify(&context->pidref); if (r < 0) return log_error_errno(r, "PIDFD validation failed: %m"); @@ -499,6 +535,17 @@ static int context_parse_one(CoredumpContext *context, MetadataField meta, bool case META_THREAD_NAME: return free_and_strdup_warn(&context->thread_name, s); + case META_CODE: + /* We must accept both positive and negative values. The former + * are reserved for kernel-generated signals, the latter for signals requested + * from userspace. See /usr/include/bits/siginfo-consts.h. */ + r = safe_atoi(s, &context->code); + if (r < 0) + log_warning_errno(r, "Failed to parse code \"%s\", ignoring: %m", s); + else + context->got_code = true; + return 0; + case META_PROC_AUXV: { char *t = memdup_suffix0(s, size); if (!t) diff --git a/src/coredump/coredump-context.h b/src/coredump/coredump-context.h index 7fedfde2adb..a2ce16b8531 100644 --- a/src/coredump/coredump-context.h +++ b/src/coredump/coredump-context.h @@ -42,6 +42,7 @@ typedef enum MetadataField { META_UNIT, META_PROC_AUXV, META_THREAD_NAME, + META_CODE, /* code of signal causing dump (eg: 2 for SEGV_ACCERR). Since v7.1. */ _META_MAX, _META_INVALID = -EINVAL, } MetadataField; @@ -51,6 +52,7 @@ struct CoredumpContext { uid_t uid; /* META_ARGV_UID */ gid_t gid; /* META_ARGV_GID */ int signo; /* META_ARGV_SIGNAL */ + int code; /* META_CODE */ usec_t timestamp; /* META_ARGV_TIMESTAMP */ uint64_t rlimit; /* META_ARGV_RLIMIT */ char *hostname; /* META_ARGV_HOSTNAME */ @@ -63,6 +65,7 @@ struct CoredumpContext { size_t auxv_size; /* META_PROC_AUXV */ char *thread_name; /* META_THREAD_NAME */ bool got_pidfd; /* META_ARGV_PIDFD */ + bool got_code; /* META_CODE */ bool same_pidns; bool forwarded; int input_fd; diff --git a/src/coredump/coredumpctl.c b/src/coredump/coredumpctl.c index 3b31471ab4d..9b26e23d629 100644 --- a/src/coredump/coredumpctl.c +++ b/src/coredump/coredumpctl.c @@ -585,6 +585,7 @@ typedef enum CoredumpField { COREDUMP_FIELD_UID, COREDUMP_FIELD_GID, COREDUMP_FIELD_SGNL, + COREDUMP_FIELD_CODE, COREDUMP_FIELD_EXE, COREDUMP_FIELD_COMM, COREDUMP_FIELD_CMDLINE, @@ -615,6 +616,7 @@ static const char* const coredump_field_table[_COREDUMP_FIELD_MAX] = { [COREDUMP_FIELD_UID] = "COREDUMP_UID", [COREDUMP_FIELD_GID] = "COREDUMP_GID", [COREDUMP_FIELD_SGNL] = "COREDUMP_SIGNAL", + [COREDUMP_FIELD_CODE] = "COREDUMP_CODE", [COREDUMP_FIELD_EXE] = "COREDUMP_EXE", [COREDUMP_FIELD_COMM] = "COREDUMP_COMM", [COREDUMP_FIELD_CMDLINE] = "COREDUMP_CMDLINE", @@ -770,9 +772,23 @@ static int print_info(FILE *file, sd_journal *j, bool need_space) { int sig; const char *name = f.normal_coredump ? "Signal" : "Reason"; - if (f.normal_coredump && safe_atoi(f.fields[COREDUMP_FIELD_SGNL], &sig) >= 0) - fprintf(file, " %s: %s (%s)\n", name, f.fields[COREDUMP_FIELD_SGNL], signal_to_string(sig)); - else + if (f.normal_coredump && safe_atoi(f.fields[COREDUMP_FIELD_SGNL], &sig) >= 0) { + fprintf(file, " %s: %s (%s)", name, f.fields[COREDUMP_FIELD_SGNL], signal_to_string(sig)); + + if (f.fields[COREDUMP_FIELD_CODE]) { + int n; + const char *s; + + if (safe_atoi(f.fields[COREDUMP_FIELD_CODE], &n) >= 0) + s = signal_code_to_string(sig, n); + else + s = NULL; + + fprintf(file, " si_code: %s", s ?: f.fields[COREDUMP_FIELD_CODE]); + } + + fputc('\n', file); + } else fprintf(file, " %s: %s\n", name, f.fields[COREDUMP_FIELD_SGNL]); } @@ -893,7 +909,8 @@ static int print_info_json(FILE *file, sd_journal *j) { pid_t pid_as_int = 0, tid_as_int = 0; uid_t uid_as_int = UID_INVALID, owner_uid_as_int = UID_INVALID; gid_t gid_as_int = GID_INVALID; - int sig_as_int = 0; + int sig_as_int = 0, code_as_int = 0; + bool code_is_valid = false; usec_t ts = USEC_INFINITY; int r; @@ -916,6 +933,8 @@ static int print_info_json(FILE *file, sd_journal *j) { (void) parse_uid(f.fields[COREDUMP_FIELD_OWNER_UID], &owner_uid_as_int); if (f.normal_coredump && f.fields[COREDUMP_FIELD_SGNL]) (void) safe_atoi(f.fields[COREDUMP_FIELD_SGNL], &sig_as_int); + if (f.normal_coredump && f.fields[COREDUMP_FIELD_CODE]) + code_is_valid = safe_atoi(f.fields[COREDUMP_FIELD_CODE], &code_as_int) >= 0; if (f.fields[COREDUMP_FIELD_TIMESTAMP]) (void) safe_atou64(f.fields[COREDUMP_FIELD_TIMESTAMP], &ts); @@ -932,6 +951,8 @@ static int print_info_json(FILE *file, sd_journal *j) { SD_JSON_BUILD_PAIR_CONDITION(f.normal_coredump && sig_as_int > 0, "Signal", SD_JSON_BUILD_INTEGER(sig_as_int)), SD_JSON_BUILD_PAIR_CONDITION(f.normal_coredump && sig_as_int > 0 && !!signal_to_string(sig_as_int), "SignalName", SD_JSON_BUILD_STRING(signal_to_string(sig_as_int))), SD_JSON_BUILD_PAIR_CONDITION(f.normal_coredump && sig_as_int <= 0 && !!f.fields[COREDUMP_FIELD_SGNL], "Signal", SD_JSON_BUILD_STRING(f.fields[COREDUMP_FIELD_SGNL])), + SD_JSON_BUILD_PAIR_CONDITION(f.normal_coredump && code_is_valid, "SignalCode", SD_JSON_BUILD_INTEGER(code_as_int)), + SD_JSON_BUILD_PAIR_CONDITION(f.normal_coredump && !code_is_valid && !!f.fields[COREDUMP_FIELD_CODE], "SignalCode", SD_JSON_BUILD_STRING(f.fields[COREDUMP_FIELD_CODE])), SD_JSON_BUILD_PAIR_CONDITION(!f.normal_coredump && !!f.fields[COREDUMP_FIELD_SGNL], "Reason", SD_JSON_BUILD_STRING(f.fields[COREDUMP_FIELD_SGNL])), SD_JSON_BUILD_PAIR_CONDITION(ts != USEC_INFINITY, "Timestamp", SD_JSON_BUILD_UNSIGNED(ts)), SD_JSON_BUILD_PAIR_CONDITION(ts == USEC_INFINITY && !!f.fields[COREDUMP_FIELD_TIMESTAMP], "Timestamp", SD_JSON_BUILD_STRING(f.fields[COREDUMP_FIELD_TIMESTAMP])), diff --git a/test/units/TEST-87-AUX-UTILS-VM.coredump.sh b/test/units/TEST-87-AUX-UTILS-VM.coredump.sh index 30252132ff8..675d37184b5 100755 --- a/test/units/TEST-87-AUX-UTILS-VM.coredump.sh +++ b/test/units/TEST-87-AUX-UTILS-VM.coredump.sh @@ -166,6 +166,12 @@ coredumpctl info "$CORE_TEST_BIN" | grep "TID:" >/dev/null # Check the field is queryable in the journal coredumpctl -F COREDUMP_TID +# If COREDUMP_CODE= is present, check that the expected code is SI_USER (0). +if coredumpctl -F COREDUMP_CODE | grep "^0$" >/dev/null; then + coredumpctl info "$CORE_TEST_BIN" | grep --fixed-strings "Signal: 5 (TRAP) si_code: SI_USER" >/dev/null + coredumpctl info --json=short "$CORE_TEST_BIN" | jq -se 'any(.[]; .SignalCode == 0)' +fi + coredumpctl debug --debugger=/bin/true "$CORE_TEST_BIN" SYSTEMD_DEBUGGER=/bin/true coredumpctl debug "$CORE_TEST_BIN" coredumpctl debug --debugger=/bin/true --debugger-arguments="-this --does --not 'do anything' -a -t --all" "${CORE_TEST_BIN##*/}"