linux-kernel - Re: inconsistent behavior with ptrace(TRACEME) and fork/exec

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:	Mon, 27 Oct 2008 15:56:48 +0100
From:	Jan Kratochvil <jan.kratochvil@...hat.com>
To:	Mike Frysinger <vapier@...too.org>
Cc:	linux-kernel@...r.kernel.org
Subject: Re: inconsistent behavior with ptrace(TRACEME) and fork/exec

On Wed, 19 Jul 2006 21:18:29 +0200, Mike Frysinger wrote:
> my understanding is that if a parent forks and the child does
> a ptrace(TRACEME) right before doing an exec(), the kernel should always
> halt it and wait indefinitely for the parent to start ptracing it.

Yes, just the parent must process the event (signal).  In your testcase the
parent finished before the signal could be delivered.  If the tracer exits the
tracee's tracing is finished and it continues freely.

> unfortunately, this behavior seems to be unreliable.

Fixed the races in your code and I do not see there any problem, do you?
The ptrace problems/testsuite is being maintained at:
  http://sourceware.org/systemtap/wiki/utrace/tests

Regards,
Jan

View attachment "ptrace-vfork-traceme.c" of type "text/plain" (2201 bytes)

View attachment "ptrace-vfork-traceme.c.patch" of type "text/plain" (1859 bytes)