[RFC] Toward Shareable POSIX Signals

[dancol@dancol.org]

> On 03/09/2018 09:25 PM, Rich Felker wrote:
>> This is a very bad idea. Introspective crash logging/reporting is a
>> huge gift to attackers. If an attacker has compromised a process in a
>> manner to cause it to segfault, they almost surely have enough control
>> over the process state to force the handler to perform code execution
>> for them. There have been real-world CVEs along these lines.
>
> More importantly, in-process crash handlers also destroy evidence *why*
> the crash happened, or inhibit the crash altogether because they run
> into some sort of deadlock due to the corrupt state of the process.

The problems you mention are possible in theory. _In practice_, they
seldom occur. A carefully-programmed in-process crash reporter --- one
that's async-signal-safe (a requirement which helps avoid deadlocks) and
that issues system calls directly --- can almost always produce a crash
dump.