Web Hosting Talk : Web Hosting Main Forums : Hosting Security and Technology : How to disable apache generating coredump file?

[rumahweb]

Recently I use suphp with fcgi on my cPanel Server. When I apply RLimitCPU for each vhost, I see that some scripts that potentially overloading the server is killed. I think this is a good way to control load on server.

But each time a php process killed, apache create a coredump files under users's directory that is large enough to fill user's space limit.

How to disable apache from creating core dump files?

I have try :
- set "ulimit -c 0" on users and root
- set "/proc/sys/fs/suid_dumpable" to 0
- set /etc/security/limits.conf with 0 limit for core parameter
- set CoreDumpDirectory to specific directory

Nothing works to stop apache from generating coredump files

FYI, my system is :
- CENTOS Enterprise 5.2 x86_64
- Apache/2.2.9
- PHP 5.2.6 (cli) (built: Jun 26 2008 01:07:50)
Copyright (c) 1997-2008 The PHP Group
Zend Engine v2.2.0, Copyright (c) 1998-2008 Zend Technologies
with eAccelerator v0.9.5.3, Copyright (c) 2004-2006 eAccelerator, by eAccelerator
with the ionCube PHP Loader v3.1.33, Copyright (c) 2002-2007, by ionCube Ltd., and
with Zend Extension Manager v1.2.2, Copyright (c) 2003-2007, by Zend Technologies
with Suhosin v0.9.23, Copyright (c) 2007, by SektionEins GmbH
with Zend Optimizer v3.3.3, Copyright (c) 1998-2007, by Zend Technologies
- FCGI & suPHP

[johnny-l]

Originally Posted by rumahweb

But each time a php process killed, apache create a coredump files under users's directory

Are you sure is Apache creating the Core Dump, and not PHP ?

[rumahweb]

PHP I guess. When I debug on core.* file, I see that PHP script hits the RLIMIT.

[johnny-l]

Originally Posted by rumahweb

PHP I guess. When I debug on core.* file, I see that PHP script hits the RLIMIT.

So maybe you should patch/instruct PHP/Rlimit to not create core dumps, rather than focusing on apache.

PHP runs as the user (su-php), so maybe core dump limits should be set to zero for each user. I am not a debug expert, just throwing some wild guesses: good luck with your issue :-)

[rumahweb]

Originally Posted by johnny-l

So maybe you should patch/instruct PHP/Rlimit to not create core dumps, rather than focusing on apache.

That's what I'm looking for. How disable coredump file generation

Originally Posted by johnny-l

PHP runs as the user (su-php), so maybe core dump limits should be set to zero for each user

I try to set it on /etc/security/limits.conf and ulimit -c 0,
but still - not worked

[johnny-l]

Originally Posted by rumahweb

That's what I'm looking for. How disable coredump file generation

Yep, but you were asking about "How to disable APACHE generating coredump" ... while I guess you should be patching rlimit/php.

[zacharooni]

Did you already gdb backtrace the corefile?
Do this:

;Replace 89283 with the actual corefile name (most recent usually)
gdb -c core.89283
gdb> bt
;Look for the 'program', then:
gdb> q
gdb -c core.89283 /usr/bin/program
gdb> bt

Then paste out the #1 #2 #3 that you see here.

[rumahweb]

Step #1
# gdb -c core.6341
GNU gdb Red Hat Linux (6.5-37.el5_2.2rh)
Copyright (C) 2006 Free Software Foundation, Inc.
GDB is free software, covered by the GNU General Public License, and you are
welcome to change it and/or distribute copies of it under certain conditions.
Type "show copying" to see the conditions.
There is absolutely no warranty for GDB. Type "show warranty" for details.
This GDB was configured as "x86_64-redhat-linux-gnu".
Core was generated by `/usr/bin/php /home/pengki/public_html/resources.php'.
Program terminated with signal 24, CPU time limit exceeded.
#0 0x0000003ff0c0442b in ?? ()

Step #2
(gdb) bt
#0 0x0000003ff0c0442b in ?? ()
#1 0x00000000187937f8 in ?? ()
#2 0x00000000187937f0 in ?? ()
#3 0x00000000187937f8 in ?? ()
#4 0x00002b07b7bbfbb3 in ?? ()
#5 0x000000000063bde0 in ?? ()
#6 0x000000001879f3b0 in ?? ()
#7 0x000000000000045e in ?? ()
#8 0x000000003340485f in ?? ()
#9 0x0000000000000000 in ?? ()
(gdb) q

Step #3
#gdb -c core.6341 /usr/bin/php
GNU gdb Red Hat Linux (6.5-37.el5_2.2rh)
Copyright (C) 2006 Free Software Foundation, Inc.
GDB is free software, covered by the GNU General Public License, and you are
welcome to change it and/or distribute copies of it under certain conditions.
Type "show copying" to see the conditions.
There is absolutely no warranty for GDB. Type "show warranty" for details.
This GDB was configured as "x86_64-redhat-linux-gnu"...Using host libthread_db library "/lib64/libthread_db.so.1".

Reading symbols from /usr/lib64/libstdc++.so.6...done.
Loaded symbols for /usr/lib64/libstdc++.so.6
Reading symbols from /lib64/libcrypt.so.1...done.
Loaded symbols for /lib64/libcrypt.so.1
Reading symbols from /lib64/libssl.so.6...done.
Loaded symbols for /lib64/libssl.so.6
Reading symbols from /lib64/libcrypto.so.6...done.
Loaded symbols for /lib64/libcrypto.so.6
Reading symbols from /lib64/libpam.so.0...done.
Loaded symbols for /lib64/libpam.so.0
Reading symbols from /usr/lib64/libfreetype.so.6...done.
Loaded symbols for /usr/lib64/libfreetype.so.6
Reading symbols from /usr/lib64/libX11.so.6...done.
Loaded symbols for /usr/lib64/libX11.so.6
Reading symbols from /usr/lib64/libXpm.so.4...done.
Loaded symbols for /usr/lib64/libXpm.so.4
Reading symbols from /usr/lib64/libpng12.so.0...done.
Loaded symbols for /usr/lib64/libpng12.so.0
Reading symbols from /usr/lib64/libjpeg.so.62...done.
Loaded symbols for /usr/lib64/libjpeg.so.62
Reading symbols from /lib64/libresolv.so.2...done.
Loaded symbols for /lib64/libresolv.so.2
Reading symbols from /lib64/libm.so.6...done.
Loaded symbols for /lib64/libm.so.6
Reading symbols from /lib64/libnsl.so.1...done.
Loaded symbols for /lib64/libnsl.so.1
Reading symbols from /usr/lib64/libgssapi_krb5.so.2...done.
Loaded symbols for /usr/lib64/libgssapi_krb5.so.2
Reading symbols from /usr/lib64/libkrb5.so.3...done.
Loaded symbols for /usr/lib64/libkrb5.so.3
Reading symbols from /usr/lib64/libk5crypto.so.3...done.
Loaded symbols for /usr/lib64/libk5crypto.so.3
Reading symbols from /lib64/libcom_err.so.2...done.
Loaded symbols for /lib64/libcom_err.so.2
Reading symbols from /opt/curlssl/lib/libcurl.so.4...done.
Loaded symbols for /opt/curlssl//lib/libcurl.so.4
Reading symbols from /usr/lib64/libidn.so.11...done.
Loaded symbols for /usr/lib64/libidn.so.11
Reading symbols from /lib64/librt.so.1...done.
Loaded symbols for /lib64/librt.so.1
Reading symbols from /usr/lib64/libmysqlclient.so.15...done.
Loaded symbols for /usr/lib64/libmysqlclient.so.15
Reading symbols from /opt/xml2/lib/libxml2.so.2...done.
Loaded symbols for /opt/xml2/lib/libxml2.so.2
Reading symbols from /lib64/libdl.so.2...done.
Loaded symbols for /lib64/libdl.so.2
Reading symbols from /lib64/libc.so.6...done.
Loaded symbols for /lib64/libc.so.6
Reading symbols from /lib64/libgcc_s.so.1...done.
Loaded symbols for /lib64/libgcc_s.so.1
Reading symbols from /lib64/ld-linux-x86-64.so.2...done.
Loaded symbols for /lib64/ld-linux-x86-64.so.2
Reading symbols from /usr/lib64/libz.so.1...done.
Loaded symbols for /usr/lib64/libz.so.1
Reading symbols from /lib64/libaudit.so.0...done.
Loaded symbols for /lib64/libaudit.so.0
Reading symbols from /usr/lib64/libXau.so.6...done.
Loaded symbols for /usr/lib64/libXau.so.6
Reading symbols from /usr/lib64/libXdmcp.so.6...done.
Loaded symbols for /usr/lib64/libXdmcp.so.6
Reading symbols from /usr/lib64/libkrb5support.so.0...done.
Loaded symbols for /usr/lib64/libkrb5support.so.0
Reading symbols from /lib64/libkeyutils.so.1...done.
Loaded symbols for /lib64/libkeyutils.so.1
Reading symbols from /lib64/libpthread.so.0...done.
Loaded symbols for /lib64/libpthread.so.0
Reading symbols from /lib64/libselinux.so.1...done.
Loaded symbols for /lib64/libselinux.so.1
Reading symbols from /lib64/libsepol.so.1...done.
Loaded symbols for /lib64/libsepol.so.1
Reading symbols from /usr/local/IonCube/ioncube_loader_lin_5.2.so...done.
Loaded symbols for /usr/local/IonCube/ioncube_loader_lin_5.2.so
Reading symbols from /usr/local/Zend/lib/ZendExtensionManager.so...done.
Loaded symbols for /usr/local/Zend/lib/ZendExtensionManager.so
Reading symbols from /usr/local/lib/php/extensions/no-debug-non-zts-20060613/eaccelerator.so...done.
Loaded symbols for /usr/local/lib/php/extensions/no-debug-non-zts-20060613/eaccelerator.so
Reading symbols from /usr/local/lib/php/extensions/no-debug-non-zts-20060613/pdo.so...done.
Loaded symbols for /usr/local/lib/php/extensions/no-debug-non-zts-20060613/pdo.so
Reading symbols from /usr/local/lib/php/extensions/no-debug-non-zts-20060613/pdo_sqlite.so...done.
Loaded symbols for /usr/local/lib/php/extensions/no-debug-non-zts-20060613/pdo_sqlite.so
Reading symbols from /usr/local/lib/php/extensions/no-debug-non-zts-20060613/sqlite.so...done.
Loaded symbols for /usr/local/lib/php/extensions/no-debug-non-zts-20060613/sqlite.so
Reading symbols from /usr/local/lib/php/extensions/no-debug-non-zts-20060613/pdo_mysql.so...done.
Loaded symbols for /usr/local/lib/php/extensions/no-debug-non-zts-20060613/pdo_mysql.so
Reading symbols from /lib64/libnss_files.so.2...done.
Loaded symbols for /lib64/libnss_files.so.2
Reading symbols from /usr/local/Zend/lib/Optimizer-3.3.3/php-5.2.x/ZendOptimizer.so...done.
Loaded symbols for /usr/local/Zend/lib/Optimizer-3.3.3/php-5.2.x/ZendOptimizer.so
Reading symbols from /lib64/libnss_dns.so.2...done.
Loaded symbols for /lib64/libnss_dns.so.2
Core was generated by `/usr/bin/php /home/pengki/public_html/resources.php'.
Program terminated with signal 24, CPU time limit exceeded.
#0 0x0000003ff0c0442b in clock_gettime () from /lib64/librt.so.1

[zacharooni]

There you go right there:

Core was generated by `/usr/bin/php /home/pengki/public_html/resources.php'.
Program terminated with signal 24, CPU time limit exceeded.

[rumahweb]

Yes, but how to make PHP/Apache to stop generating core dump files without removing Rlimit configuration?

My goal is to limit resource per vhost but I dont want core dump files to be created. Or at least I can make all core dump files on specfic folder rather than having them all over user's directory.

It can really eat up user's space very quickly especialy for user who have a "high load" type script.

[zacharooni]

You can disable coredumps in /etc/security/limits.conf, Just add this line to the end:

* hard core 0

[rumahweb]

I have try :
- set "ulimit -c 0" on users and root
- set "/proc/sys/fs/suid_dumpable" to 0
- set /etc/security/limits.conf with 0 limit for core parameter
- set CoreDumpDirectory to specific directory

Nothing works to stop apache from generating coredump files

[rumahweb]

I found a simple stupid solution. I hope it can help if you have same problem :

I add ulimit -c 0 on /etc/init.d/httpd below other ulimit setting.

No more apache coredump generated