The checks in is_banned_path() for a path prefix not under /usr needed
to be connected with a logical AND, not OR, as implied by the recent
changes.
Also, use an explicit logical OR for the other two groups of
conditionals so that they are grouped similarly to the checks that
required an AND.
Signed-off-by: Patrick McCarty <patrick.mccarty@intel.com>
As far as I can tell, the standard library doesn't have a function to
check for an ASCII string. Equivalently, we can iterate over each
character in the string, byte by byte, and verify that only 7-bit
characters are present.
Signed-off-by: Patrick McCarty <patrick.mccarty@intel.com>
One more binary was using GOptionContext: telem-record-gen. Convert it
to use getopt_long() as well.
Signed-off-by: Patrick McCarty <patrick.mccarty@intel.com>
Continuing the removal of dependency on glib, switch to use
getopt_long() instead of the GOptionContext API for the crash probe.
Signed-off-by: Patrick McCarty <patrick.mccarty@intel.com>
Linux 4.10 introduced some format changes for oopses; one of the changes
was removing memory addresses from each stack frame.
This commit adds support for the new format and retains compatibility
for the previous format (4.9 and earlier).
Signed-off-by: Patrick McCarty <patrick.mccarty@intel.com>
The former skip_spaces() function only skipped a single space, so rename
it to skip_space(), and make skip_spaces() greedily consume spaces.
Signed-off-by: Patrick McCarty <patrick.mccarty@intel.com>
The previous logic concatenates log messages on initial startup, when
the entire journal is read to process existing messages. But doing so
might run into the payload size limit (8KB), and thus fail to create a
record.
Sending one record per log message will ensure that the payload size
remains relatively small, almost always below the 8KB size limit.
Signed-off-by: Patrick McCarty <patrick.mccarty@intel.com>
To avoid having to read the repetitive error handling when adding
journal filters, add some helper macros.
Signed-off-by: Patrick McCarty <patrick.mccarty@intel.com>
Previous behavior was to only filter LOG_ERR messages from the
telemetrics crashprobe, but it will be helpful to make this probe more
generic to capture log messages with the highest log levels.
Signed-off-by: Patrick McCarty <patrick.mccarty@intel.com>
There are some filters in place that prevent probes from collecting
specific types of data. In particular, the oops probe will report "zero"
or "non-zero" for register values in oopses instead of the actual
values. And the crash probe does not send backtraces if binaries live
outside of /usr or under /usr/local.
This commit keeps these filters in place but offers the capability to
disable the filters by creating a file named
/etc/telemetrics/opt-in-no-privacy-filters
Any future telemetry privacy filters can check for this file to alter
the reporting level.
Signed-off-by: Patrick McCarty <patrick.mccarty@intel.com>
Since only one path is being checked for a program, and it returns a
boolean, rename the function and call site appropriately.
Signed-off-by: Patrick McCarty <patrick.mccarty@intel.com>
Missing symbols in backtraces might indicate missing debuginfo from the
crashed program, but another possibility is that on-the-fly debuginfo
has not finished downloading. The Clear Linux OS uses an on-the-fly
debuginfo setup, so this condition is likely for the first instance of a
program crashing on the system.
To decrease likelihood of missing symbols appearing, scan the backtrace
for a frame with incomplete data after first processing, and if found,
reprocess the core file after a 10 second pause.
Signed-off-by: Patrick McCarty <patrick.mccarty@intel.com>
For future reuse of the code for processing a core file, move it to a
new function, and call it from main().
Signed-off-by: Patrick McCarty <patrick.mccarty@intel.com>
For future reuse of the code to initialize elfutils for processing a
core file, move it to a new function, and call it from main().
Signed-off-by: Patrick McCarty <patrick.mccarty@intel.com>
When frame addresses detected during the stack scan were not previously
found by unwinding, the string "? " is added as a prefix to the function
name.
However, the current oops parsing code strips "? " if encountered, so
the backtraces from kernel oopses are missing vital information; the
presence of "? " provides a hint for debugging a stack trace and
indicates that the frame info is "unreliable".
This commit removes the "? " strip code, ensuring the prefix is retained
by the function name, and updates unit tests that check for oops lines
that should contain the prefix.
Signed-off-by: Patrick McCarty <patrick.mccarty@intel.com>
stderr could be used for logging or in libtelemetry in DEBUG mode but
when crashprobe is launched through kernel core_pattern, stderr is not
open, only stdin (fd 0), see this dump from gdb:
(gdb) shell ls -l /proc/15478/fd
total 0
lr-x------ 1 root root 64 24 juin 15:02 0 -> pipe:[82555]
If stderr is not open, when socket to telemd is open it could take
fd 2 and in this case all fprint to stderr are written to socket which
is bad ... this is the case when doing static linking, which ends to
telemd crashed.
Fix it by ensuring stderr is open.
Signed-off-by: Jeremy Rocher <jeremy.rocher@intel.com>
Arjan van de Ven