linux-kernel - Re: [RFC] Proposal for ptrace improvements

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20110302112756.GI3319@htj.dyndns.org>
Date:	Wed, 2 Mar 2011 12:27:56 +0100
From:	Tejun Heo <tj@...nel.org>
To:	Denys Vlasenko <vda.linux@...glemail.com>
Cc:	Oleg Nesterov <oleg@...hat.com>,
	Roland McGrath <roland@...hat.com>, jan.kratochvil@...hat.com,
	linux-kernel@...r.kernel.org, torvalds@...ux-foundation.org,
	akpm@...ux-foundation.org
Subject: Re: [RFC] Proposal for ptrace improvements

On Wed, Mar 02, 2011 at 12:21:28PM +0100, Denys Vlasenko wrote:
> > I think WSTOPSIG should be SIGTRAP as the tracee left group stop and
> > entered ptrace trap.
> 
> This would be, by my count, 13th kind of SIGTRAP use by ptrace.
> Which makes multi-level if's in debuggers even more complex
> and more error-prone.

Of course, all ptrace traps are SIGTRAPs.

> Why not SIGCONT? This event is, after all, caused by SIGCONT.
> It would be so much nicer to be able to detect it with single if()
> in the debugger...

I disagree.  It's a ptrace trap.  It should use SIGTRAP.  We just need
well defined siginfo output to distinguish between them.  It's not
like we can avoid siginfo anyway.

> > No, it's not a signal delivery notification.  It's a ptrace trap
> > notification.  SIGCONT may not be delivered to this task.  Please
> > remember that it's the emission of SIGCONT which ends a group stop,
> > not delivery.
> 
> From userspace POV it's really a kernel's implementation detail.

Not really.  This is actually a visible difference.  Roland wrote in
the previous discussion.  One visible difference is that ptrace can
veto job control stop but it can't veto the end of job control.  Job
control actions happen before SIGCONT hits the signal delivery path
which is visible through ptrace.

> >> (b) does PTRACE_CONT(<other_sig>)? or
> >> (c) does PTRACE_CONT(0)?
> >
> > See above.
> 
> This means that SIGCONT handler will be executed in the tracee
> after debugger does PTRACE_CONT(<any_signo>) at this point.
> 
> Which makes SIGCONT special: debugger can suppress execution
> of other signal handlers in tracee, but not SIGCONT handler.
> Another special case. Can we avoid having it?

Hmmm.... I think you're confused about how SIGCONT is handled or maybe
I am.  Either way, please elaborate.  I can't really follow.

Thanks.

-- 
tejun
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/