One Hat Cyber Team

Edit File Name : makedumpfile.conf.sample

## Filter config file
##
## Description:
## Configuration file to specify filter commands to filter out desired
## kernel data from vmcore. It supports erasing of symbol data and
## it's members of any data type. In case of filtering of data pointed by
## void * pointer, user needs to provide size to filter out.
##
## Please refer to manpage makedumpfile.conf(5) for more details.
##
##
## - Module section
## =========================================================
## Syntax:
## [ModuleName]
##
## Define the module section where the symbols specified in subsequent erase
## commands belong to. The section name is a kernel module name (including
## vmlinux). The unnamed section defaults to [vmlinux] section.
##
## NOTE: There should not be any whitespaces before or after the ModuleName.
##
## e.g.
##	[vmlinux] # Symbols in erase command belongs to main kernel (vmlinux)
##	erase modules
##	erase cred_jar.name
##	erase cred_jar.name size 10
##	erase cred_jar.array
##	erase vmlist.addr nullify
##
##	[z90crypt] # Symbols in erase command belongs to kernel module z90crypt
##	erase ap_device_list
##
##	# erase entire CPRBX structure
##	erase static_cprbx
##
##
## - To erase kernel data referred through a kernel Symbol
## =========================================================
## Syntax:
## erase <Symbol>[.member[...]] [size <SizeValue>[K|M]]
## erase <Symbol>[.member[...]] [size <SizeSymbol>]
## erase <Symbol>[.member[...]] [nullify]]
##
## where
##	<Symbol>
##		A variable name from the kernel or module, which is part of
##		global symbols '/proc/kallsyms'.
##	<SizeValue>
##		Integer value that specifies size of data to be erased. The
##		suffixes 'K' and 'M' can be used to specify kilobytes and
##		megabytes respectively where, K means 1024 bytes and M means
##		1024 ^ 2 = 1048576 bytes.
##	<SizeSymbol>
##		A simple axpression of the form <Symbol>[.member[...]] that
##		denotes a symbol which contains a positive integer value as a
##		size of the data in bytes to be erased.
##
## Filter out the specified size of the data referred by symbol/member.
## If size option is not provided then the size of <Symbol> will be calculated
## according to it's data type. For 'char *' data type, string length will be
## determined with an upper limit of 1024.
##
## If specified <Symbol> is of type 'void *', then user needs to provide
## either 'size' or 'nullify' option. Otherwise erase command will not have
## any effect.
##
## The option 'nullify' will work only if filter symbol/member is a pointer and
## is used to set NULL value to the pointer type symbol/member.
##
## NOTE: Please note that by nullifying pointer values will affect the
## debug ability of created DUMPFILE. Use 'nullify' option only when size of
## data to be filter out is not known e.g. data pointed by 'void *'.
##
## e.g.
##	[vmlinux]
##	erase modules
##	erase cred_jar.name
##	erase cred_jar.name size 10
##	erase cred_jar.array
##	erase vmlist.addr nullify
##
##
## - To filter kernel data referred through Array/list_head Symbol
## =================================================================
## Syntax:
## for <id> in { <ArrayVar> |
##		 <StructVar> via <NextMember> |
##		 <ListHeadVar> within <StructName>:<ListHeadMember> }
##	erase <id>[.MemberExpression] [size <SizeExpression>|nullify]
##	[erase <id> ...]
##	[...]
## endfor
##
## where
##	<id>
##		Arbitrary name used to temporarily point to elements of the
##		list. Referred as iteration variable.
##	<ArrayVar>
##		A simple expression in the form of <Symbol>[.member[...]] that
##		results into an array variable.
##	<StructVar>
##		A simple expression in the form of <Symbol>[.member[...]] that
##		results into a variable that points to a structure.
##	<NextMember>
##		Member within <StructVar> that points to an object of same
##		type that of <StructVar>.
##	<ListHeadVar>
##		A simple expression in the form of <Symbol>[.member[...]] that
##		results into a variable of type struct list_head.
##	<StructName>
##		Name of the structure type that can be traversed using
##		HEAD variable <ListHeadVar> and contains a member named
##		<ListHeadMember>.
##	<ListHeadMember>
##		Name of a member in <StructName>, of type struct list_head.
##	<MemberExpression>
##		A simple expression in the form of [.member[...]] to specify a
##		member or component of a member in <ArrayVar>, <StructVar> or
##		<StructName>.
##	<SizeExpression>
##		One of the following:
##		- An integer value.
##		- <Symbol>[.member[...]]
##		- <id>[.MemberExpresion]
##
## The <ArrayVar>, <StructVar> and <ListHeadVar> is also referred as LIST
## entry
##
## Filter out the specified size of the data accessible through LIST entries.
## e.g.
##	[vmlinux]
##	# Traversing <ListHeadVar>
##	for m in modules.next within module:list
##		erase m.holders_dir.name
##	endfor
##	# Traversing <ArrayVar>
##	for lc in lowcore_ptr
##		erase lc
##	endfor
##	# Traversing link-list
##	for cj in cred_jar via slabp_cache
##		erase cj.name
##	endfor
##	[z90crypt]
##	for ap_dev in ap_device_list.next within ap_device:list
##		erase ap_dev.reply.message size ap_dev.reply.length
##	endfor
##