createdump requires root user

[dzrhythm]

Description

This troubleshooting article mentions that createdump can be run as a non-root user, but I have not been successful in doing so. I get the error:

open(/proc/7/mem) FAILED 13 (Permission denied)

I have not found any documentation stating that it requires a root user, only SYS_PTRACE capability.

Reproduction Steps

1. Run dotnet as a non-root user in a Linux container in Kubernetes with the SYS_PTRACE capability added.
2. Use kubectl exec to get a shell into the container as the non-root user and try to run createdump on the dotnet process.

Expected behavior

createdump can be run as a non-root user.

Actual behavior

Fails with: open(/proc/7/mem) FAILED 13 (Permission denied)

Regression?

No response

Known Workarounds

Run the container as root in Kubernetes.

Configuration

• .NET Core 3.1 and .NET 6.0.
• mcr.microsoft.com/dotnet/runtime:6.0 or mcr.microsoft.com/dotnet/runtime:3.1 base image.

Other information

No response

I couldn't figure out the best area label to add to this issue. If you have write-permissions please help me learn by adding exactly one area label.

Tagging subscribers to this area: @tommcdon
See info in area-owners.md if you want to be subscribed.

Issue Details

---

Description

This troubleshooting article mentions that createdump can be run as a non-root user, but I have not been successful in doing so. I get the error:

open(/proc/7/mem) FAILED 13 (Permission denied)

I have not found any documentation stating that it requires a root user, only SYS_PTRACE capability.

Reproduction Steps

1. Run dotnet as a non-root user in a Linux container in Kubernetes with the SYS_PTRACE capability added.
2. Use kubectl exec to get a shell into the container as the non-root user and try to run createdump on the dotnet process.

Expected behavior

createdump can be run as a non-root user.

Actual behavior

Fails with: open(/proc/7/mem) FAILED 13 (Permission denied)

Regression?

No response

Known Workarounds

Run the container as root in Kubernetes.

Configuration

• .NET Core 3.1 and .NET 6.0.
• mcr.microsoft.com/dotnet/runtime:6.0 or mcr.microsoft.com/dotnet/runtime:3.1 base image.

Other information

No response

Author:	dzrhythm
Assignees:	-
Labels:	area-Diagnostics-coreclr, untriaged
Milestone:	-

[tommcdon]

Thanks for the bug report. Please see https://docs.microsoft.com/dotnet/core/diagnostics/debug-linux-dumps for more information on requirements for collecting dumps. In short, as you have correctly identified, collecting dumps with createdump requires that it to be run with sudo or su. and that the SYS_PTRACE capability is enabled. We have a backlog item to document createdump caveats in our other documentation here: dotnet/diagnostics#2246. I'll close this issue as the documentation issue is tracked on dotnet/diagnostics#2246.