Core File Creation

[William R Bowen]

Does a user have the ability to create a core file or is it just from system calls and application. If the user can do this, is there a command to identify the user?

[Steven E. Protter]

By default yes.

If you want to stop it system wide, add this to /etc/profile

ulimit -Sc 0

SEP

[Raj D.]

Hi David,

Core files are generated automatically , when ever an application or sevice terminates or stops abnormally. And it generates , from the information from running kernel and system memory informations,.

If a user runs a command periodically , that terminates and generates a core file , thus a user can generate a core file , else not.

/usr/include/sys/core.h
Here is the c header file, that determinces the format of core image file.

Cheers,
Raj.

[Torsten.]

Signals can cause a process to get core dumped. Every user can send signals to his own processes (kill -).
Locate a core and do

file /..path../core

This telling you the process and the reason.
The file owner is the user.

[James R. Ferguson]

Hi David:

If you want to create a core file do a 'kill -quit '. This can be trapped, but will otherwise terminate the process and produce a core file.

Regards!

...JRF...

[Bill Hassell]

A program will generate a core file when certain programming errors occur, but a user can also generate a core file by sending the program a signal such as kill -3 or kill -SIGQUIT. However, good system management will not allow programs to be owned (and therefore signaled or killed) by anyone except reserved user names. A user can only kill a process that they own.

That said, a user could certainly exploit a bug in the program by entering wrong data (special characters when numbers are expected, etc). The command to see why a core file was generated is the file command, as in:

file core

Now the message might say:

core: core file from 'myprog' - received SIGQUIT

but that's all the information you'll get. The core file is always left in the current working directory, so if a user kills a process that was started from /tmp but changes to /home/username, then the core file will be in the user's home directory.