{"record":{"id":"549b90531152b1a6","repo":"dotnet/runtime","slug":"problem-launching-createdump-may-not-have-execute","errorCode":null,"errorMessage":"Problem launching createdump (may not have execute permissions): execv(%s) FAILED %s (%d)\\n","messagePattern":"Problem launching createdump \\(may not have execute permissions\\): execv\\((.+?)\\) FAILED (.+?) \\((.+?)\\)\\\\n","errorType":"console","errorClass":null,"httpStatus":null,"severity":"error","filePath":"src/coreclr/nativeaot/Runtime/unix/PalCreateDump.cpp","lineNumber":277,"sourceCode":"            close(child_write_pipe);\n            exit(-1);\n        }\n\n        // Only dup the child's stderr if there is error buffer\n        if (errorMessageBuffer != nullptr)\n        {\n            dup2(child_write_pipe, STDERR_FILENO);\n        }\n        // Execute the createdump program\n        if (execv(argv[0], (char* const *)argv) == -1)\n        {\n            if (errno == ENOENT)\n            {\n                fprintf(stderr, \"DOTNET_DbgEnableMiniDump is set and the createdump binary does not exist: %s\\n\", argv[0]);\n            }\n            else\n            {\n                fprintf(stderr, \"Problem launching createdump (may not have execute permissions): execv(%s) FAILED %s (%d)\\n\", argv[0], strerror(errno), errno);\n            }\n            exit(-1);\n        }\n    }\n    else\n    {\n        close(child_read_pipe);\n        close(child_write_pipe);\n#if HAVE_PRCTL_H && HAVE_PR_SET_PTRACER\n        // Gives the child process permission to use /proc/<pid>/mem and ptrace\n        if (prctl(PR_SET_PTRACER, childpid, 0, 0, 0) == -1)\n        {\n            // Ignore any error because on some CentOS and OpenSUSE distros, it isn't\n            // supported but createdump works just fine.\n#ifdef _DEBUG\n            fprintf(stderr, \"CreateCrashDump: prctl() FAILED %s (%d)\\n\", strerror(errno), errno);\n#endif\n        }","sourceCodeStart":259,"sourceCodeEnd":295,"githubUrl":"https://github.com/dotnet/runtime/blob/290d5ab72cc1102813fbc0406fb186ceadabc340/src/coreclr/nativeaot/Runtime/unix/PalCreateDump.cpp#L259-L295","documentation":"Emitted by the NativeAOT crash-dump helper in CreateCrashDump (PalCreateDump.cpp:277). After fork(), the child first blocks reading a one-byte prctl(PR_SET_PTRACER) signal from the parent, then calls execv() on g_szCreateDumpPath to overlay itself with the createdump utility. This fprintf fires when execv() returns -1 with an errno OTHER than ENOENT (ENOENT has its own message at line 273), i.e. the path resolved but the kernel refused to execute it; the child then exit(-1) and no core dump is written. The 'may not have execute permissions' text points at EACCES, but ENOEXEC, E2BIG and ENOMEM reach this same branch.","triggerScenarios":"A NativeAOT-published process launched with DOTNET_DbgEnableMiniDump=1 (the DbgEnableMiniDump runtimeconfig key) encounters an unhandled crash; PalCreateCrashDumpIfEnabled() forks and the child reaches execv(argv[0]). argv[0] is g_szCreateDumpPath, computed in PalCreateDumpInitialize() either from DOTNET_DbgCreateDumpToolPATH concatenated with 'createdump', or from the directory of the CoreCLR native library discovered via dladdr(&PalCreateDumpInitialize). execv fails with a non-ENOENT errno.","commonSituations":"createdump shipped without the executable bit (chmod stripped during a custom copy/publish step); the runtime directory sits on a noexec mount (/tmp noexec, hardened container images); a createdump built for the wrong architecture was copied in (cross-arch publish); SELinux/AppArmor denying exec_trans; a truncated or corrupt createdump binary (ENOEXEC); argument list overflow (E2BIG) from a pathologically long DOTNET_DbgMiniDumpName.","solutions":["Resolve the exact path the runtime uses (echo $DOTNET_DbgCreateDumpToolPath, or the directory of libcoreclr.so) and run `ls -l <dir>/createdump`; fix the mode with chmod +x if missing.","If createdump is absent, repair your publish/copy pipeline so it ships next to the native runtime library; for trimmed/single-file NativeAOT scenarios verify createdump was not excluded.","Check for noexec: run `mount | grep noexec` against the directory holding createdump; if present, move the runtime tree or remount exec.","Point DOTNET_DbgCreateDumpToolPath at a known-good, executable createdump directory and re-run.","On RHEL/CentOS/SuSE with SELinux, inspect `ausearch -m AVC -ts recent` for EXEC denials on createdump and adjust policy/labels."],"exampleFix":"# before: createdump has no exec bit\n$ ls -l /opt/app/createdump\n-rw-r--r-- 1 app app 123456 createdump\n# DOTNET_DbgEnableMiniDump=1 ./app   -> execv FAILED Permission denied (13)\n\n# after\n$ chmod +x /opt/app/createdump\n$ DOTNET_DbgEnableMiniDump=1 DOTNET_DbgCreateDumpToolPath=/opt/app ./app","handlingStrategy":"validation","validationCode":"# Validate the createdump binary the NativeAOT runtime will execv before enabling dumps.\nDIR=\"${DOTNET_DbgCreateDumpToolPath:-$(dirname \"$(find / -name 'libcoreclr*' 2>/dev/null | head -n1)\")\"\nBIN=\"$DIR/createdump\"\n[ -x \"$BIN\" ] || { echo \"createdump missing or not executable: $BIN\"; exit 1; }\nfile \"$BIN\" | grep -qi \"$(uname -m)\" || { echo \"createdump wrong arch\"; exit 1; }\nmount | grep -q \" $(df \"$DIR\" --output=mountpoint | tail -n1) .*noexec\" && { echo \"noexec mount\"; exit 1; }\nexport DOTNET_DbgEnableMiniDump=1\nexec \"$@\"","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Always publish/copy createdump next to the native runtime library and preserve the executable bit (use cp -p or a tarball that stores mode).","Never place the runtime on a noexec mount in containers; verify with `mount | grep noexec`.","For NativeAOT, set DOTNET_DbgCreateDumpToolPath explicitly to a directory you control rather than relying on dladdr-derived discovery.","Add a pre-launch check in your container entrypoint that `[ -x ]` the createdump binary before enabling DOTNET_DbgEnableMiniDump.","Keep createdump architecture-aligned with the process; verify with `file createdump`."],"tags":["dotnet","nativeaot","createdump","crash-dump","linux","diagnostics","permissions"],"analyzedSha":"290d5ab72cc1102813fbc0406fb186ceadabc340","analyzedAt":"2026-08-06T19:57:01.276Z","schemaVersion":2},"datasetVersion":"2026-08-06T23:17:07.152Z"}