Linux — /proc/pid Directory Part Two

Deep dive into Linux /proc/pid directory

proc/<pid> directory content continued:

/proc/<pid>/coredump_filter

Since kernel 2.6.23, this file can be used to control which memory segments are written to the core dump file in the event that a core dump is performed for the process with the corresponding process ID. The value in the file is a bit mask of memory mapping types.

• bit 0 Dump anonymous private mappings.
• bit 1 Dump anonymous shared mappings.
• bit 2 Dump file-backed private mappings.
• bit 3 Dump file-backed shared mappings.
• bit 4 (kernel 2.6.24) Dump ELF headers.
• bit 5 (kernel 2.6.28) Dump private huge pages.
• bit 6 (kernel 2.6.28) Dump shared huge pages.
• bit 7 (kernel 4.4) Dump private DAX pages.
• bit 8 (kernel 4.4) Dump shared DAX pages.

Use sshd process as an example, its coredump_filter value is

$  cat coredump_filter
00000033

If you convert 00000033 into 8 bit binary, it’s 00110011, which means that bits 0 (anonymous private mappings), 1 (anonymous shared mappings), 4 (ELF…