grsecurity forums

Doesn't seem to matter what values I set for RES_CORE, no core files are ever produced. At least not with a kill -11 [pid] or CTRL-\ I discovered this when trying to _disable_ core files so i'm not overly concearned about it... just curious. Note that i __did__ up the ulimit -c for the process and tested both core producing methods mentioned above after gradm -D and got the cores i expected. Hmmm, I just noticed that the core_limit **IS** increased correctly for each process by setting the RES_CORE value in an acl. Even so, for some reason, core files are still not produced.

the corefile resource works a little strangely. When a core file is written out, there's certain data it can write to it. You can think of these as being in chunks. Let's say you specify a limit of 100K, and the total size of the coredump is expected to be over that...instead of not dumping a core at all, the kernel will dump the chunks it can that will be under that 100K. Don't know what to tell you about your problem though. I'm not doing anything tricky, just using the same code that's already in the kernel. It's been working fine for me. What's your RES_CORE line look like?

-Brad

well... wish i had a better answer than this. Came back after several hours and had to reboot my little test box for another reason. When i looked at the core file weirdness again everything worked exactly as it should.... GRRRRRsecurity

Can't help but think this one was an administrator error