core(5) File Formats Manual core(5) core - . ( gdb(1)) . signal(7). RLIMIT_CORE " " getrlimit(2) . : o . ( core core.pid pid . .) ( ). o ( ) . o (inodes) . o . o RLIMIT_CORE ( ) RLIMIT_FSIZE ( ) getrlimit(2) ulimit (limit csh(1)). RLIMIT_CORE . o . ( -- -- .) o set-user-ID (set-group-ID) () () ( capabilities(7)). ( prctl(2) PR_SET_DUMPABLE /proc/sys/fs/suid_dumpable proc(5).) o /proc/sys/kernel/core_pattern /proc/sys/kernel/core_uses_pid 0. ( .) /proc/sys/kernel/core_pattern /proc/sys/kernel/core_uses_pid 1 .pid ls(1) -a. o ( 3.7) CONFIG_COREDUMP. madvise(2) MADV_DONTDUMP. systemd(1) init systemd(1). . core /proc/sys/kernel/core_pattern ( 2.6 2.4.21) . % : %% % . %c ( 2.6.24). %C (CPU) ( 6.2). %d -- prctl(2) PR_GET_DUMPABLE ( 3.7). %e comm ( 15 ) /proc/pid/comm /proc/pid/task/tid/comm proc(5). %E ('/') ('!') ( 3.0). %f %e ( 5.9). %F PIDFD ( 6.16). %g GID . %h ( nodename uname(2)). %i TID PID ( 3.18). %I TID PID ( 3.18). %p PID PID . %P PID PID ( 3.12). %s . %t 1970-01-01 00:00:00 +0000 (UTC). %u UID . % % . . '/' . 128 (64 2.6.19). "core". /proc/sys/kernel/core_pattern %p /proc/sys/kernel/core_uses_pid ( ) .PID . . ( mount_namespaces(7)) ( getcwd(2)) ( chroot(2)). 2.4 . /proc/sys/kernel/core_uses_pid 0 core. core.PID. 3.6 /proc/sys/fs/suid_dumpable 2 ("suidsafe") ( '/' ) . 2.6.19 /proc/sys/kernel/core_pattern. (|) ( ) . 5.3.0 . . %e %E . . . . : o ( /) '|'. o % . PID %p . o root. o root . LSMs ( SELinux) /proc/pid. o . ( ) . o (PID ) . %P /proc/pid / . o . %P /proc/pid/cwd. o ( 2.6.24) ( 128 ). o RLIMIT_CORE . /proc/sys/kernel/core_pipe_limit /proc/pid . /proc/pid . . 2.6.32 /proc/sys/kernel/core_pipe_limit . . . 0 . ( /proc/). 0. 2.6.23 /proc/pid/coredump_filter . ( mmap(2)). . : bit 0 . bit 1 . bit 2 . bit 3 . bit 4 ( 2.6.24) ELF. bit 5 ( 2.6.28) . bit 6 ( 2.6.28) . bit 7 ( 4.4) DAX . bit 8 ( 4.4) DAX . : 0 1 4 ( CONFIG_CORE_DUMP_DEFAULT_ELF_HEADERS ) 5. coredump_filter. . ( 33.) / DSO (vdso(7)) coredump_filter. fork(2) coredump_filter coredump_filter execve(2). coredump_filter : $ echo 0x7 > /proc/self/coredump_filter $ ./some_program CONFIG_ELF_CORE. systemd init systemd(1) systemd(1). systemd(1) core_pattern . systemd-coredump(8): $ cat /proc/sys/kernel/core_pattern; |/usr/lib/systemd/systemd-coredump %P %u %g %s %t %c %e systemd-coredump(8) lz4(1) /var/lib/systemd/coredump/. systemd-coredump(8) coredumpctl(1): $ coredumpctl list | tail -5; Wed 2017-10-11 22:25:30 CEST 2748 1000 1000 3 present /usr/bin/sleep Thu 2017-10-12 06:29:10 CEST 2716 1000 1000 3 present /usr/bin/sleep Thu 2017-10-12 06:30:50 CEST 2767 1000 1000 3 present /usr/bin/sleep Thu 2017-10-12 06:37:40 CEST 2918 1000 1000 3 present /usr/bin/cat Thu 2017-10-12 08:13:07 CEST 2955 1000 1000 3 present /usr/bin/cat (PID) (UID) (GID) . coredumpctl(1) systemd(1) . 2955 core : $ coredumpctl dump 2955 -o core; coredumpctl(1). systemd(1) ( ) Linux systemd(1) : # echo "kernel.core_pattern=core.%p" > \; /etc/sysctl.d/50-coredump.conf # /lib/systemd/systemd-sysctl; core_pattern ( ) ( ): # sysctl -w kernel.core_pattern="%e-%s.core"; gdb(1) gcore . 2.6.27 ( CLONE_VM clone(2)) %p /proc/sys/kernel/core_pattern. ( LinuxThreads .) /proc/sys/kernel/core_pattern. ( core_pattern_pipe_test): $ cc -o core_pattern_pipe_test core_pattern_pipe_test.c $ su Password: # echo "|$PWD/core_pattern_pipe_test %p UID=%u GID=%g sig=%s" > \ /proc/sys/kernel/core_pattern # exit $ sleep 100 ^\ # type control-backslash Quit (core dumped) $ cat core.info argc=5 argc[0]= argc[1]=<20575> argc[2]= argc[3]= argc[4]= Total bytes in core dump: 282624 /* core_pattern_pipe_test.c */ #define _GNU_SOURCE #include #include #include #include #include #include #define BUF_SIZE 1024 int main(int argc, char *argv[]) { ssize_t nread, tot; char buf[BUF_SIZE]; FILE *fp; char cwd[PATH_MAX]; /* Change our current working directory to that of the crashing process. */ snprintf(cwd, PATH_MAX, "/proc/%s/cwd", argv[1]); chdir(cwd); /* Write output to file "core.info" in that directory. */ fp = fopen("core.info", "w+"); if (fp == NULL) exit(EXIT_FAILURE); /* Display command-line arguments given to core_pattern pipe program. */ fprintf(fp, "argc=%d\n", argc); for (size_t j = 0; j < argc; j++) fprintf(fp, "argc[%zu]=<%s>\n", j, argv[j]); /* Count bytes in standard input (the core dump). */ tot = 0; while ((nread = read(STDIN_FILENO, buf, BUF_SIZE)) > 0) tot += nread; fprintf(fp, "Total bytes in core dump: %zd\n", tot); fclose(fp); exit(EXIT_SUCCESS); } bash(1), coredumpctl(1), gdb(1), getrlimit(2), mmap(2), prctl(2), sigaction(2), elf(5), proc(5), pthreads(7), signal(7), systemd-coredump(8) 3 . . : . 6.18 16 2026 core(5)