linux-kernel - Re: [RFC] Proposal for ptrace improvements

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <AANLkTinpVJAsUW83Wu3GNqTzXk=QEamJ=G3N-nrJjJhO@mail.gmail.com>
Date:	Tue, 1 Mar 2011 23:59:02 +0100
From:	Denys Vlasenko <vda.linux@...glemail.com>
To:	Tejun Heo <tj@...nel.org>
Cc:	Oleg Nesterov <oleg@...hat.com>,
	Roland McGrath <roland@...hat.com>, jan.kratochvil@...hat.com,
	linux-kernel@...r.kernel.org, torvalds@...ux-foundation.org,
	akpm@...ux-foundation.org
Subject: Re: [RFC] Proposal for ptrace improvements

On Tue, Mar 1, 2011 at 4:24 PM, Tejun Heo <tj@...nel.org> wrote:
> PROPOSAL
> --------
>
> P1. Always TASK_TRACED while ptraced
> P2. Fix notifications to the real parent
> P3. Keep ptrace resume separate from and beneath jctl stop
> P4. PTRACE_SEIZE
> P5. "^Z" and "fg" for tracees

Since this plan might get transformed into a file in Documentation/,
I would like to chime in a few less important things we might want
to clarify while we are at it.

P6. Make PTRACE_GETSIGINFO useful for determining the type of ptrace stop.

PTRACE_GETSIGINFO on real signal should return associated struct siginfo.

PTRACE_GETSIGINFO on job control stops and process exits (WEXITED /
WSIGNALED) should error out.

What does PTRACE_GETSIGINFO return on various ptrace-generated
SIGTRAPs and SIGSTOPs?
Error? If not, what value is returned in siginfo->si_code?

We have the following kinds of SIGTRAPs:

* real SIGTRAP signal sent by breakpoint instruction
* real SIGTRAP signal sent by other process
* entering syscall (after PTRACE_SYSCALL)
* exiting syscall (after PTRACE_SYSCALL)
* after single step (after PTRACE_SINGLESTEP)
* after execve (if PTRACE_O_TRACEEXEC opt is not on)
* after execve (if PTRACE_O_TRACEEXEC opt is on)
* in parent after fork (if PTRACE_O_TRACEFORK opt is on)
* in parent after vfork (if PTRACE_O_TRACEVFORK opt is on)
* in parent after clone (if PTRACE_O_TRACECLONE opt is on)
* in child after vfork (if PTRACE_O_TRACEVFORKDONE opt is on)
* before exit (if PTRACE_O_TRACEEXIT opt is on)

Currently strace has to keep precise track on the alternating sequence
of syscall enter/syscall exit stops. Which gets even trickier
with extra magic SIGTRAP thrown in by execve and such.
There were (and I suspect will be) hard to debug bugs when strace
was getting out-of sync and printing garbage.

Defining the PTRACE_GETSIGINFO's si_code so that each of these stops
can be easily distinguished would be useful. I propose using values
of SI_KERNEL + 1, SI_KERNEL + 2 etc, suitably #defined of course.

We also have magic SIGSTOPs (magic in a sense they aren't
real signals sent by other processes):
* at PTRACE_ATTACH
* in child (if PTRACE_O_TRACE[V]FORK or PTRACE_O_TRACECLONE opt is on)

For example, flagging PTRACE_ATTACH SIGSTOP so that it can be
uniquely identified would solve some problems gdb is having with it.

I propose to similarly do it by using unique si_code for each.

-- 
vda
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/