<html> <head> <base href="https://bugs.freedesktop.org/"> </head> <body> <div> <a class="bz_bug_link bz_status_NEW " title="NEW - RFE: Collect Python backtraces" href="https://bugs.freedesktop.org/show_bug.cgi?id=82507#c8">Comment # 8</a> on <a class="bz_bug_link bz_status_NEW " title="NEW - RFE: Collect Python backtraces" href="https://bugs.freedesktop.org/show_bug.cgi?id=82507">bug 82507</a> from <a class="email" href="mailto:filak.jakub@gmail.com" title="Jakub Filak <filak.jakub@gmail.com>"> Jakub Filak</a> <pre>(In reply to Zbigniew Jedrzejewski-Szmek from <a href="show_bug.cgi?id=82507#c7">comment #7</a>) > (In reply to Jakub Filak from <a href="show_bug.cgi?id=82507#c6">comment #6</a>) > > For example, we might need to join process' user and mount namespaces and > > run rpm there to get packaging information. We usually gather packaging > > information post-mortem but this is impossible if the process was the only > > process in its namespaces. > > That's perfect then. This information is gathered in the same way for > coredumps > and exceptions (for example the COREDUMP_CONTAINER_CMDLINE= stuff that you > added), so whatever is done in or after systemd-coredump to solve this, > will also benefit the case of Python programs. > I noticed, I've explored your systemd-coredump-python repository. Your solution is really smart. But I'm talking about data we cannot get from /proc/[pid]: <a href="https://lists.fedoraproject.org/archives/list/security@lists.fedoraproject.org/message/BN5DN7EZTDOEIRHXRKADATMSCQF43ZGK/">https://lists.fedoraproject.org/archives/list/security@lists.fedoraproject.org/message/BN5DN7EZTDOEIRHXRKADATMSCQF43ZGK/</a> In the world of containers, an ABRT systemd-journal watcher would be running in a different namespaces than the process that encountered an error. The watcher wouldn't be able to run 'rpm' in the process' root because the root would be gone. Hence, the watcher must be able to run 'rpm' before the process exits. Forking a new process from the crashing process would not work because of SELinux. In your approach you detect an exception in a container and you log the exception in the container. If we need to get packaging information we must do it in systemd-coredump and that doesn't seem acceptable. On the contrary, ABRT detects an exception in a container and logs the exception in a daemon running in its own container with all the required tools and the daemon can run whatever it needs.</pre> </div> <hr> You are receiving this mail because: <ul> <li>You are the assignee for the bug.</li> <li>You are the QA Contact for the bug.</li> </ul> </body> </html>