suricata
util-coredump-config.c
Go to the documentation of this file.
1 /* Copyright (C) 2007-2010 Open Information Security Foundation
2  *
3  * You can copy, redistribute or modify this Program under the terms of
4  * the GNU General Public License version 2 as published by the Free
5  * Software Foundation.
6  *
7  * This program is distributed in the hope that it will be useful,
8  * but WITHOUT ANY WARRANTY; without even the implied warranty of
9  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10  * GNU General Public License for more details.
11  *
12  * You should have received a copy of the GNU General Public License
13  * version 2 along with this program; if not, write to the Free Software
14  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
15  * 02110-1301, USA.
16  */
17 
18 /**
19  * \file
20  *
21  * \author Eileen Donlon <emdonlo@gmail.com>
22  *
23  * Coredump configuration
24  */
25 
26 #include "suricata-common.h"
27 #define _FILE_OFFSET_BITS 64
29 #include "conf.h"
30 #ifdef HAVE_SYS_RESOURCE_H
31 #include <sys/resource.h>
32 #endif
33 #ifdef HAVE_SYS_PRCTL_H
34 #include <sys/prctl.h>
35 #endif
36 #include "util-debug.h"
37 
38 #ifdef OS_WIN32
39 
40 void CoredumpEnable(void) {
41 }
42 
43 int32_t CoredumpLoadConfig(void) {
44  /* todo: use the registry to get/set dump configuration */
45  SCLogInfo("Configuring core dump is not yet supported on Windows.");
46  return 0;
47 }
48 
49 #else
50 
51 static bool unlimited = false;
52 static rlim_t max_dump = 0;
53 
54 /**
55  * \brief Enable coredumps on systems where coredumps can and need to
56  * be enabled.
57  */
58 void CoredumpEnable(void)
59 {
60  if (!unlimited && !max_dump) {
61  return;
62  }
63 #if HAVE_SYS_PRCTL_H
64  /* Linux specific core dump configuration; set dumpable flag if needed */
65  int dumpable = 0;
66  dumpable = prctl(PR_GET_DUMPABLE, 0, 0, 0, 0);
67  if (dumpable == -1) {
68  SCLogNotice("Failed to get dumpable state of process, "
69  "core dumps may not be enabled: %s",
70  strerror(errno));
71  }
72  else if (unlimited || max_dump > 0) {
73  /* try to enable core dump for this process */
74  if (prctl(PR_SET_DUMPABLE, 1, 0, 0, 0) == -1) {
75  SCLogInfo("Unable to make this process dumpable.");
76  } else {
77  SCLogDebug("Process is dumpable.");
78  }
79  }
80  /* don't clear dumpable flag since this will have other effects;
81  * just set dump size to 0 below */
82 #endif /* HAVE_SYS_PRCTL_H */
83 }
84 
85 /**
86  * \brief Configures the core dump size.
87  *
88  * \retval Returns 1 on success and 0 on failure.
89  *
90  */
91 int32_t CoredumpLoadConfig (void)
92 {
93 #ifdef HAVE_SYS_RESOURCE_H
94  /* get core dump configuration settings for suricata */
95  const char *dump_size_config = NULL;
96  size_t rlim_size = sizeof(rlim_t);
97 
98  if (ConfGet ("coredump.max-dump", &dump_size_config) == 0) {
99  SCLogDebug ("core dump size not specified");
100  return 1;
101  }
102  if (dump_size_config == NULL) {
103  SCLogError("malformed value for coredump.max-dump: NULL");
104  return 0;
105  }
106  if (strcasecmp (dump_size_config, "unlimited") == 0) {
107  unlimited = true;
108  }
109  else {
110  /* disallow negative values */
111  if (strchr (dump_size_config, '-') != NULL) {
112  SCLogInfo ("Negative value for core dump size; ignored.");
113  return 0;
114  }
115  /* the size of rlim_t is platform dependent */
116  if (rlim_size > 8) {
117  SCLogInfo ("Unexpected type for rlim_t");
118  return 0;
119  }
120  errno = 0;
121  if (rlim_size == 8) {
122  max_dump = (rlim_t) strtoull (dump_size_config, NULL, 10);
123  }
124  else if (rlim_size == 4) {
125  max_dump = (rlim_t) strtoul (dump_size_config, NULL, 10);
126  }
127  if ((errno == ERANGE) || (errno != 0 && max_dump == 0)) {
128  SCLogInfo ("Illegal core dump size: %s.", dump_size_config);
129  return 0;
130  }
131  SCLogInfo ("Max dump is %"PRIu64, (uint64_t) max_dump);
132  }
133 
134  CoredumpEnable();
135 
136  struct rlimit lim; /*existing limit*/
137  struct rlimit new_lim; /*desired limit*/
138 
139  /* get the current core dump file configuration */
140  if (getrlimit (RLIMIT_CORE, &lim) == -1) {
141  SCLogInfo ("Can't read coredump limit for this process.");
142  return 0;
143  }
144 
145  if (unlimited) {
146  /* we want no limit on coredump size */
147  if (lim.rlim_max == RLIM_INFINITY && lim.rlim_cur == RLIM_INFINITY) {
148  SCLogConfig ("Core dump size is unlimited.");
149  return 1;
150  }
151  else {
152  new_lim.rlim_max = RLIM_INFINITY;
153  new_lim.rlim_cur = RLIM_INFINITY;
154  if (setrlimit (RLIMIT_CORE, &new_lim) == 0) {
155  SCLogConfig ("Core dump size set to unlimited.");
156  return 1;
157  }
158  if (errno == EPERM) {
159  /* couldn't raise the hard limit to unlimited;
160  * try increasing the soft limit to the hard limit instead */
161  if (lim.rlim_cur < lim.rlim_max) {
162  new_lim.rlim_cur = lim.rlim_max;
163  if (setrlimit (RLIMIT_CORE, & new_lim) == 0) {
164  SCLogInfo ("Could not set core dump size to unlimited; core dump size set to the hard limit.");
165  return 0;
166  }
167  else {
168  SCLogInfo ("Failed to set core dump size to unlimited or to the hard limit.");
169  return 0;
170  }
171  }
172  SCLogInfo ("Could not set core dump size to unlimited; it's set to the hard limit.");
173  return 0;
174  }
175  }
176  }
177  else {
178  /* we want a non-infinite soft limit on coredump size */
179  new_lim.rlim_cur = max_dump;
180 
181  /* check whether the hard limit needs to be adjusted */
182  if (lim.rlim_max == RLIM_INFINITY) {
183  /* keep the current value (unlimited) for the hard limit */
184  new_lim.rlim_max = lim.rlim_max;
185  }
186 #ifdef RLIM_SAVED_MAX
187  else if (lim.rlim_max == RLIM_SAVED_MAX) {
188  /* keep the current value (unknown) for the hard limit */
189  new_lim.rlim_max = lim.rlim_max;
190  }
191 #endif
192  else if (lim.rlim_max < max_dump) {
193  /* need to raise the hard coredump size limit */
194  new_lim.rlim_max = max_dump;
195  }
196  else {
197  /* hard limit is ample */
198  new_lim.rlim_max = lim.rlim_max;
199  }
200  if (setrlimit (RLIMIT_CORE, &new_lim) == 0) {
201  SCLogInfo ("Core dump setting attempted is %"PRIu64, (uint64_t) new_lim.rlim_cur);
202  struct rlimit actual_lim;
203  if (getrlimit (RLIMIT_CORE, &actual_lim) == 0) {
204  if (actual_lim.rlim_cur == RLIM_INFINITY) {
205  SCLogConfig ("Core dump size set to unlimited.");
206  }
207 #ifdef RLIM_SAVED_CUR
208  else if (actual_lim.rlim_cur == RLIM_SAVED_CUR) {
209  SCLogInfo ("Core dump size set to soft limit.");
210  }
211 #endif
212  else {
213  SCLogInfo ("Core dump size set to %"PRIu64, (uint64_t) actual_lim.rlim_cur);
214  }
215  }
216  return 1;
217  }
218 
219  if (errno == EINVAL || errno == EPERM) {
220  /* couldn't increase the hard limit, or the soft limit exceeded the hard
221  * limit; try to raise the soft limit to the hard limit */
222  if ((lim.rlim_cur < max_dump && lim.rlim_cur < lim.rlim_max)
223 #ifdef RLIM_SAVED_CUR
224  || (lim.rlim_cur == RLIM_SAVED_CUR)
225 #endif
226  ){
227  new_lim.rlim_max = lim.rlim_max;
228  new_lim.rlim_cur = lim.rlim_max;
229  if (setrlimit (RLIMIT_CORE, &new_lim) == 0) {
230  SCLogInfo("Core dump size set to the hard limit.");
231  return 0;
232  }
233  }
234  }
235  }
236  /* failed to set the coredump limit */
237  SCLogInfo("Couldn't set coredump size to %s.", dump_size_config);
238 #endif /* HAVE_SYS_RESOURCE_H */
239  return 0;
240 }
241 
242 #endif /* OS_WIN32 */
SCLogDebug
#define SCLogDebug(...)
Definition: util-debug.h:269
util-coredump-config.h
ConfGet
int ConfGet(const char *name, const char **vptr)
Retrieve the value of a configuration node.
Definition: conf.c:335
util-debug.h
CoredumpLoadConfig
int32_t CoredumpLoadConfig(void)
Configures the core dump size.
Definition: util-coredump-config.c:91
conf.h
SCLogInfo
#define SCLogInfo(...)
Macro used to log INFORMATIONAL messages.
Definition: util-debug.h:224
suricata-common.h
SCLogConfig
struct SCLogConfig_ SCLogConfig
Holds the config state used by the logging api.
SCLogError
#define SCLogError(...)
Macro used to log ERROR messages.
Definition: util-debug.h:261
CoredumpEnable
void CoredumpEnable(void)
Enable coredumps on systems where coredumps can and need to be enabled.
Definition: util-coredump-config.c:58
SCLogNotice
#define SCLogNotice(...)
Macro used to log NOTICE messages.
Definition: util-debug.h:237