ubuntu when core dump is not happening when program ran as root(sudo)

Question

when I ran a program which will cause the segmentation fault as root user , the core is not dumped.. I checked the ulimit -c and it is unlimited...But if I ran as a normal user the program is dumping the core..

    suresh@suresh-desktop:~$ ulimit -c
    unlimited
    suresh@suresh-desktop:~$ ./main 
    Segmentation fault (core dumped)
    suresh@suresh-desktop:~$ sudo ./main 
    Segmentation fault
    suresh@suresh-desktop:~$ 








    root@suresh-desktop:~# ulimit -c unlimited
    root@suresh-desktop:~# ./main 
    Segmentation fault


    //main.c

        main()
        {

        *((int *)0xb80000) = 123;
        }   

root@suresh-desktop:~# ulimit -a -S
core file size          (blocks, -c) unlimited
data seg size           (kbytes, -d) unlimited
scheduling priority             (-e) 20
file size               (blocks, -f) unlimited
pending signals                 (-i) 16382
max locked memory       (kbytes, -l) 64
max memory size         (kbytes, -m) unlimited
open files                      (-n) 1024
pipe size            (512 bytes, -p) 8
POSIX message queues     (bytes, -q) 819200
real-time priority              (-r) 0
stack size              (kbytes, -s) 8192
cpu time               (seconds, -t) unlimited
max user processes              (-u) unlimited
virtual memory          (kbytes, -v) unlimited
file locks                      (-x) unlimited










root@suresh-desktop:~# ulimit -a -H
core file size          (blocks, -c) unlimited
data seg size           (kbytes, -d) unlimited
scheduling priority             (-e) 20
file size               (blocks, -f) unlimited
pending signals                 (-i) 16382
max locked memory       (kbytes, -l) 64
max memory size         (kbytes, -m) unlimited
open files                      (-n) 1024
pipe size            (512 bytes, -p) 8
POSIX message queues     (bytes, -q) 819200
real-time priority              (-r) 0
stack size              (kbytes, -s) unlimited
cpu time               (seconds, -t) unlimited
max user processes              (-u) unlimited
virtual memory          (kbytes, -v) unlimited
file locks                      (-x) unlimited

Answer 1

Just a quick query. Does the core file owned by user suresh still exist when you run as user root (and what are its permissions)?

It may be that the system will not overwrite an existing core dump if the permissions protect it (despite root's supposed super powers).

Try deleting the current core file before running as root (check the directory permissions as well to ensure root can create files there).

For what it's worth, there's a long list of reasons why core won't be dumped. Some of these don't apply to your situation but you should examine them for clues (if my hypothesis above is incorrect).

• The core would have been larger than the current ulimit.
• You don't have permissions to dump core (directory and file).
• The file system isn't writable and hasn't sufficient free space.
• There's a sub directory named core in the working directory.
• There's a file named core with multiple hard links.
• The executable has the suid or sgid bit enabled. Ditto if you have execute permissions but no read permissions on the file.
• The segmentation fault could be a kernel oops, check the system logs.

Answer 2

sudo  sh -c "ulimit -c unlimited; ./main"
Segmentation fault (core dumped)

I am not sure if this is the correct and secure way, but it works. Sudo starts a new shell and new limit is set inside this shell just before the program is executed.

Answer 3

You might want to have a look at this to see why the core dump is not being written. The answer provided by paxdiablo is probably on the mark. What you might want to do is adjust how core dumps are written, i.e. core-{PID} instead of just 'core'. Its good practice to do that anyway.

man 5 core should provide the same information contained in the page that I linked.

Answer 4

setuid executables (sudo is an example) are subject to some limitations, try:

$ sudo -i
# echo -n 2 > /proc/sys/fs/suid_dumpable
# exit
$ sudo ./main

Make sure to delete any old 'core' file beforehand (an existing core file will not be overwritten)

There are potential security risks involved - search the net for "suid_dumpable"