> ("a kernel socket" is not necessarily the same as "a kernel socket > intended for core dumping") Indeed. The usermodehelper is a kernel protocol. Here it's the task with its own credentials that's connecting to a userspace socket. Which makes this very elegant because it's just userspace IPC. No one is running around with kernel credentials anywhere.