Watch filesystem rather than polling about core-dump-handler HOT 7 CLOSED

Hey @alaniai
Interesting point but I don't think it adds any additional constraints above the one already mentioned in the security section.
https://github.com/IBM/core-dump-handler/#security-implications
Core dumps can contain sensitive runtime data and the storage bucket access must be managed accordingly.
That said the book will provide guidance on recommended configurations for deployment
e.g.. install in a dedicated namespace, only use private endpoints for S3 access.

from core-dump-handler.

;)
That's no problem at all just trying to get a bit of help.
I see there is an iNotify library that should be very easy to integrate
https://github.com/hannobraun/inotify-rs
I've marked this issue as 5.0.0 and I will be looking to get that out in November sometime along with the scheduling feature.

from core-dump-handler.

There was some initial consideration of this when I first wrote the agent but I 've not had good experiences with inotify on other projects so was a little hesitant leaning on it right away and polling is easier to reason about and debug.

That said it I agree it would be cleaner and I like your idea of falling back onto the poller on init.

I would be happy to take this as a PR that was flagged so the user has the option keeping the current functionality or using inotify.

Another feature that should be considered as part of this is a scheduled upload so that the dump uploads don't interfere with peak usage times.
The PR for inotify doesn't need to have a scheduler implementation but it needs to be mindful of the requirement.

from core-dump-handler.

@No9 - kinda obtuse, but if we scanned the "." on init/wake up - there is an 'avenue' here for a rogue process to create a "coredump" file , knowing that the handler will then export it out of the secure Environment - of course, a second exploit would be needed to fetch if from the s3:// resource.

A bad actor bound by firewalls etc.., could harness that

from core-dump-handler.

@No9 But I've never written rust code before... 😂

Actually, I'm working on something similar to core-dump-handler in my team, but there are some issues so I'm considering whether to use my solution or core-dump-handler. This is the reason why I recently posted a few issues.

I won't promise to do it, but I'll consider posting a PR someday.

from core-dump-handler.

Hey @isbee there is an initial implementation of iNotify here
https://github.com/IBM/core-dump-handler/tree/schedule-watch
You should be able to checkout that branch and run it with your usual settings but note the scheduled approach and Inotify are mutually exclusive.
As you suggested the service sweeps the folder on startup
https://github.com/IBM/core-dump-handler/blob/schedule-watch/core-dump-agent/src/main.rs#L121
Let us know how you get on with it and if you have any comments.

from core-dump-handler.

Merging as part of PR #43

from core-dump-handler.