linux-kernel - PTRACE_DETACH without stop [Re: [PATCH 04/11] ptrace: implement PTRACE

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Sun, 15 May 2011 18:10:00 +0200
From:	Jan Kratochvil <jan.kratochvil@...hat.com>
To:	Tejun Heo <tj@...nel.org>
Cc:	Denys Vlasenko <vda.linux@...glemail.com>,
	Oleg Nesterov <oleg@...hat.com>, linux-kernel@...r.kernel.org,
	torvalds@...ux-foundation.org, akpm@...ux-foundation.org,
	indan@....nu
Subject: PTRACE_DETACH without stop  [Re: [PATCH 04/11] ptrace: implement
 PTRACE_INTERRUPT]

On Wed, 11 May 2011 11:19:55 +0200, Tejun Heo wrote:
> On Tue, May 10, 2011 at 11:59:58PM +0200, Denys Vlasenko wrote:
> > Another note: even though PTRACE_INTERRUPT solves the problem that
> > PTRACE_DETACH of a running tracee was butt-ugly thing to do correctly,
> > the "new" way is still a bit ugly: tracer needs PTRACE_INTERRUPT,
> > waitpid, and only then PTRACE_DETACH. Why not go all the way
> > and make PTRACE_DETACH work on running tracee too?
> 
> I don't think I'll change that.  It's only three syscall sequence -
> INTERRUPT, wait(STOPPED) and DETACH which will always work reliably
> (unless tracee gets killed or something).

I do not think this change is much related to this patchset.

But having to PTRACE_INTERRUPT the tracee before PTRACE_DETACH has no
advantage, it is just a performance (see transparent tracking of 10000+ thread
	https://lkml.org/lkml/2011/5/15/115
) problem and also getting it correct.  As when one wait()s and gets
WIFSTOPPED one needs to respawn to signal otherwise the signal gets lost on
PTRACE_ATTACH.  How to respawn it?  By PTRACE_INTERRUPT with DATA==signal?
Or PTRACE_CONT with DATA==signal?  With rapid signalling of the tracee the
debugger may never have a chance to correctly quit.  Handling other cases
transparently for the original parent also may not be fully clear.

It would be nice to write documentation already while discussing this patch,
I do not know if PTRACE_INTERRUPT respects DATA etc., it may show ptrace is
still tricky.



Thanks,
Jan
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/