notifier detects crashes before core is finished being written

[Kees Cook]

Binary package hint: apport

When a very large program crashes (say... firefox), the crash notifier will pop up before the crash file has been written out all the way, causing a number of issues:
 - repeated "new crash" notification popups as the crash file grows
 - apport-gtk complains the crash is corrupted (since it is still growing)

I would suggest an rsync-style "temp" filename to be used until apport is finished building the crash file, which can then be moved into place.

[Martin Pitt (pitti)]

That's indeed weird, since the .crash file is created with permissions 000, and only chmod'ed to 600 after it is completely written. apport-checkreports ignores files which are inaccessible, so this shouldn't happen (and doesn't for me). Can you please trigger a firefox or evo crash (or anything else which takes a while to coredump) and check the permissions of the /var/crash/ file while it is being written? Seems that chmodding doesn't work properly for you?

[Mackenzie Morgan (maco.m)]

We are closing this bug report because it lacks the information we need to investigate the problem, as described in the previous comments. Please reopen it if you can give us the missing information, and don't hesitate to submit bug reports in the future. To reopen the bug report you can click on the current status, under the Status column, and change the Status back to "New". Thanks again!

[Kees Cook (kees)]

Before the crash:

$ ls -latr /var/crash
total 12348
drwxr-xr-x 17 root root 4096 2007-02-09 12:13 ../
-rw------- 1 kees kees 50072 2008-09-04 16:33 _usr_bin_aumix.501.crash
-rw------- 1 root root 73086 2008-09-04 17:54 bacula-director-sqlite3.0.crash
-rw------- 1 root root 143059 2008-09-04 17:54 _usr_sbin_bacula-dir.0.crash
-rw------- 1 kees kees 1534981 2008-09-06 21:17 _usr_bin_gstreamer-properties.501.crash
-rw------- 1 kees kees 137494 2008-09-08 09:19 _usr_lib_gvfs_gvfsd-trash.501.crash
-rw------- 1 root root 337556 2008-09-08 17:55 _usr_sbin_console-kit-daemon.0.crash
-rwxr-xr-x 1 root root 0 2008-09-09 08:54 .lock*
drwxrwxrwt 2 root root 4096 2008-09-09 08:54 ./
-rw------- 1 kees kees 10308786 2008-09-09 08:54 _usr_lib_nspluginwrapper_i386_linux_npviewer.bin.501.crash

Crash starting (trimmed to just show the crash file):

---------- 1 kees kees 615567 2008-09-09 22:26 _usr_lib_firefox-3.0.1_firefox.501.crash

notification pops up (see attached screenshot):

---------- 1 kees kees 6972559 2008-09-09 22:26 _usr_lib_firefox-3.0.1_firefox.501.crash

opening notification (see next screenshot):

---------- 1 kees kees 17532047 2008-09-09 22:26 _usr_lib_firefox-3.0.1_firefox.501.crash

crash finished:

-rw------- 1 kees kees 24533900 2008-09-09 22:26 _usr_lib_firefox-3.0.1_firefox.501.crash

Possible non-default situation, I have / mounted noatime:

/dev/mapper/systemvg-root2lv on / type ext3 (rw,noatime)

[Kees Cook (kees)]

Here is the "corrupted" message Screenshot.

After I close this, apport then progresses through all the reports, prompting me for the other crashes I haven't taken action on and eventually gets to the firefox crash (since it has finished crashing) and correctly prompts for it.

However, while firefox crashes, I get repeated notification pop-ups that a crash is happening.

[Kees Cook (kees)]

Perhaps the notification tool is seeing a change, but ignoring specifically the mode-0000 file, but sees the other unhandled crashes, and pops the notification for those (repeatedly)?

[Marco Rodrigues (gothicx)]

It could be the 'noatime' attribute. I've relatime and it works fine. I've reproduced the problem and update notifier only shows the popup after it being written.

(Before)
$ ls -latr /var/crash/
total 31460
drwxr-xr-x 16 root root 4096 2009-07-01 20:14 ..
-rw------- 1 kmos kmos 406999 2009-09-08 22:48 _usr_bin_update-notifier.1000.crash
-rw------- 1 kmos kmos 610551 2009-09-11 23:35 _bin_bash.1000.crash
-rwxr-xr-x 1 root root 0 2009-09-13 09:50 .lock
drwxrwxrwt 2 root root 4096 2009-09-13 09:50 .
---------- 1 kmos kmos 31176366 2009-09-13 09:51 _usr_lib_firefox-3.5.3_firefox.1000.crash

(After)
$ ls -latr /var/crash/
total 32804
drwxr-xr-x 16 root root 4096 2009-07-01 20:14 ..
-rw------- 1 kmos kmos 406999 2009-09-08 22:48 _usr_bin_update-notifier.1000.crash
-rw------- 1 kmos kmos 610551 2009-09-11 23:35 _bin_bash.1000.crash
-rwxr-xr-x 1 root root 0 2009-09-13 09:50 .lock
drwxrwxrwt 2 root root 4096 2009-09-13 09:50 .
-rw------- 1 kmos kmos 32550943 2009-09-13 09:51 _usr_lib_firefox-3.5.3_firefox.1000.crash

[Marcus Tomlinson (marcustomlinson)]

This release of Ubuntu is no longer receiving maintenance updates. If this is still an issue on a maintained version of Ubuntu please let us know.

[Launchpad Janitor (janitor)]

[Expired for apport (Ubuntu) because there has been no activity for 60 days.]