Improved logging for core dumping. With Linux use PR_SET_DUMPABLE for imap/pop3.

--HG--
branch : HEAD

diff --git a/configure.in b/configure.in
index 18ac51f74fd97faca29ca6fe3f86b53b76ef82cc..75fae218e0a69d21959865f960f0e84b0f3dd3a5 100644 (file)
--- a/configure.in
+++ b/configure.in
@@ -1056,6 +1056,18 @@ AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[
   AC_DEFINE(HAVE_RLIMIT_CORE,, Define if you have RLIMIT_CORE for getrlimit())
 ],[])
 
+AC_MSG_CHECKING([PR_SET_DUMPABLE])
+AC_TRY_LINK([
+  #include <sys/prctl.h>
+], [
+  prctl(PR_SET_DUMPABLE, 1, 0, 0, 0);
+], [
+  AC_DEFINE(HAVE_PR_SET_DUMPABLE,, Define if you have prctl(PR_SET_DUMPABLE))
+  AC_MSG_RESULT(yes)
+], [
+  AC_MSG_RESULT(no)
+])
+
 dnl * Linux compatible mremap()
 AC_MSG_CHECKING([Linux compatible mremap()])
 AC_TRY_LINK([

diff --git a/src/imap/main.c b/src/imap/main.c
index a1a351dc96da126412bcc6ab5d699cb7431b06fc..fae6a844a81a1549b0d940fc3483384dabf72db9 100644 (file)
--- a/src/imap/main.c
+++ b/src/imap/main.c
@@ -157,6 +157,7 @@ static void drop_privileges(void)
        }
 
        restrict_access_by_env(!IS_STANDALONE());
+       restrict_access_allow_coredumps(TRUE);
 }
 
 static void main_init(void)

diff --git a/src/lib/restrict-access.c b/src/lib/restrict-access.c
index 0c411998475b240e9b390fb05cf7a25f38fbe5b0..8317126b53b9479d15692f74ad3b505fd2b8407a 100644 (file)
--- a/src/lib/restrict-access.c
+++ b/src/lib/restrict-access.c
@@ -13,6 +13,9 @@
 #include <time.h>
 #include <pwd.h>
 #include <grp.h>
+#ifdef HAVE_PR_SET_DUMPABLE
+#  include <sys/prctl.h>
+#endif
 
 static gid_t process_primary_gid = (gid_t)-1;
 static gid_t process_privileged_gid = (gid_t)-1;
@@ -370,6 +373,13 @@ void restrict_access_by_env(bool disallow_root)
        env_put("RESTRICT_GID_LAST=");
 }
 
+void restrict_access_allow_coredumps(bool allow ATTR_UNUSED)
+{
+#ifdef HAVE_PR_SET_DUMPABLE
+       (void)prctl(PR_SET_DUMPABLE, allow, 0, 0, 0);
+#endif
+}
+
 int restrict_access_use_priv_gid(void)
 {
        i_assert(!process_using_priv_gid);

diff --git a/src/lib/restrict-access.h b/src/lib/restrict-access.h
index 601c505aaab8631d2d0a78569b1bdb02747bae83..db2b527b0ea3090dc659cd2bf1ff419d17e3f157 100644 (file)
--- a/src/lib/restrict-access.h
+++ b/src/lib/restrict-access.h
@@ -15,6 +15,10 @@ void restrict_access_set_env(const char *user, uid_t uid,
    environment settings and we have root uid or gid. */
 void restrict_access_by_env(bool disallow_root);
 
+/* Try to set up the process in a way that core dumps are still allowed
+   after calling restrict_access_by_env(). */
+void restrict_access_allow_coredumps(bool allow);
+
 /* If privileged_gid was set, these functions can be used to temporarily
    gain access to the group. */
 int restrict_access_use_priv_gid(void);

diff --git a/src/master/child-process.c b/src/master/child-process.c
index 1b0c365111049e98fb4ecfd73be2b33a564f8604..5814cb437a403094cb7996e1e386cbb1ea62bc81 100644 (file)
--- a/src/master/child-process.c
+++ b/src/master/child-process.c
@@ -127,6 +127,35 @@ static const char *get_exit_status_message(enum fatal_exit_status status,
        return NULL;
 }
 
+static void
+log_coredump(string_t *str, enum process_type process_type, int status)
+{
+#ifdef WCOREDUMP
+       int signum = WTERMSIG(status);
+
+       if (WCOREDUMP(status)) {
+               str_append(str, " (core dumped)");
+               return;
+       }
+
+       if (signum != SIGABRT && signum != SIGSEGV && signum != SIGBUS)
+               return;
+
+       /* let's try to figure out why we didn't get a core dump */
+       if (process_type != PROCESS_TYPE_IMAP &&
+           process_type != PROCESS_TYPE_POP3)
+               str_append(str, " (core not dumped)");
+#ifndef HAVE_PR_SET_DUMPABLE
+       else if (!settings_root->defaults->mail_drop_priv_before_exec)
+               str_append(str, " (core not dumped - set mail_drop_priv_before_exec=yes)");
+#endif
+       else if (core_dumps_disabled)
+               str_printfa(str, " (core dumps disabled)");
+       else
+               str_append(str, " (core not dumped - is home dir set?)");
+#endif
+}
+
 static void sigchld_handler(int signo ATTR_UNUSED,
                            void *context ATTR_UNUSED)
 {
@@ -181,6 +210,7 @@ static void sigchld_handler(int signo ATTR_UNUSED,
                        str_printfa(str, "child %s (%s) killed with signal %d",
                                    dec2str(pid), process_type_name,
                                    WTERMSIG(status));
+                       log_coredump(str, process_type, status);
                }
 
                if (str_len(str) > 0) {

diff --git a/src/master/common.h b/src/master/common.h
index fc25c0d57d3e25a6d51c7cecf1e22fc799dbe75f..b694407a11f7a6bc71e2d39074d507b0719a4085 100644 (file)
--- a/src/master/common.h
+++ b/src/master/common.h
@@ -15,6 +15,7 @@ extern char program_path[];
 extern char ssl_manual_key_password[];
 extern const char *env_tz;
 extern bool auth_success_written;
+extern bool core_dumps_disabled;
 #ifdef DEBUG
 extern bool gdb;
 #endif

diff --git a/src/master/main.c b/src/master/main.c
index 8be820a84a74678275f2ee761c723c5d6ea597be..0b5c626bc7883bdddc337cc3746ab78d2f1c3eb9 100644 (file)
--- a/src/master/main.c
+++ b/src/master/main.c
@@ -46,6 +46,7 @@ char program_path[PATH_MAX];
 char ssl_manual_key_password[100];
 const char *env_tz;
 bool auth_success_written;
+bool core_dumps_disabled;
 #ifdef DEBUG
 bool gdb;
 #endif
@@ -264,7 +265,9 @@ static void main_log_startup(void)
 #define STARTUP_STRING PACKAGE_NAME" v"VERSION" starting up"
        rlim_t core_limit;
 
-       if (restrict_get_core_limit(&core_limit) == 0 && core_limit == 0)
+       core_dumps_disabled = restrict_get_core_limit(&core_limit) == 0 &&
+               core_limit == 0;
+       if (core_dumps_disabled)
                i_info(STARTUP_STRING" (core dumps disabled)");
        else
                i_info(STARTUP_STRING);

diff --git a/src/pop3/main.c b/src/pop3/main.c
index 2c92a51270a6ed98f59f391b10ea40bfe2afde3e..60c1ef9eb4cba2385ba87db11d853c9097817271 100644 (file)
--- a/src/pop3/main.c
+++ b/src/pop3/main.c
@@ -178,6 +178,7 @@ static void drop_privileges(void)
        }
 
        restrict_access_by_env(!IS_STANDALONE());
+       restrict_access_allow_coredumps(TRUE);
 }
 
 static bool main_init(void)