linux-kernel - Re: [RFC] Proposal for ptrace improvements

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Fri, 4 Mar 2011 14:59:32 +0100
From:	Denys Vlasenko <vda.linux@...glemail.com>
To:	Tejun Heo <tj@...nel.org>
Cc:	Oleg Nesterov <oleg@...hat.com>,
	Roland McGrath <roland@...hat.com>, jan.kratochvil@...hat.com,
	linux-kernel@...r.kernel.org, torvalds@...ux-foundation.org,
	akpm@...ux-foundation.org
Subject: Re: [RFC] Proposal for ptrace improvements

On Fri, Mar 4, 2011 at 2:41 PM, Tejun Heo <tj@...nel.org> wrote:
>> And again, I would like to ask you kernel guys to give
>> userspace a way to distinguish this stop from other possible stops.
>>
>> IOW: debugger PTRACE_SYSCALL(0)'ed a job control stopped task.
>> Debugger gets WIFSTOPPED, WSTOPSIG = SIGTRAP.
>> Debugger wants to know: is it a "syscall entry/exit" stop
>> or an "end of job control stop" stop?
>> Preferably without the need to query PTRACE_GETSIGINFO
>> on every SIGTRAP - that'd slow strace down a lot.
>
> There's no question that it should be distinguishible.  I was still
> mostly thinking about siginfo tho.  Is PTRACE_GETSIGINFO such big
> deal?  It's a very simple syscall.  It enters kernel, copyout the
> structure and returns.  Are you interested in adding GET_SIGINFO call
> to the current ptrace and see how much things actually slow down?

I would rather speed strace up than slow it down further, even if slightly.


>> I imagine one way to do it is to #define a PTRACE_EVENT_foo
>> for "end of job control stop" stop and return it in high byte
>> of waitpid status, just like other PTRACE_EVENTs are returned today.
>
> Maybe but I'm not fully sure yet because I think for debuggers the
> group stop status needs to be available for other ptrace traps too, so

By all means, do make this information accessible
with PTRACE_GETSIGINFO too. I have nothing against that.


> it might really not fit there.  I'd like to avoid twisting debugging
> API

It is *already* twisted that way. Other ptrace stops *already*
return extra information in waitpid status: run "man ptrace"
and read PTRACE_SETOPTIONS section. For example:

      "PTRACE_O_TRACEEXEC (since Linux 2.5.46)
             Stop  the  child  at  the next execve(2) call with
             SIGTRAP | PTRACE_EVENT_EXEC << 8."

I don't see why adding another PTRACE_EVENT_foo
is a big deal.

-- 
vda
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/