linux-kernel - PTRACE_GET_SYSCALL_INFO requires PTRACE_O

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date:   Sat, 28 May 2022 00:03:39 -0600 (MDT)
From:   Nate Eldredge <nate@...tsmathematics.com>
To:     linux-kernel@...r.kernel.org
Subject: PTRACE_GET_SYSCALL_INFO requires PTRACE_O_TRACESYSGOOD but not
 documented

It seems that the PTRACE_GET_SYSCALL_INFO function of ptrace(2) only works 
properly if the tracer has set the PTRACE_O_TRACESYSGOOD option.  The man 
page doesn't mention this requirement.  Is it intentional?

The issue is that ptrace_get_syscall_info() in kernel/ptrace.c only calls 
the ptrace_get_syscall_info_{entry,exit} functions to fully populate the 
ptrace_syscall_info struct if child->last_siginfo->si_code == SIGTRAP | 
0x80.  And the 0x80 bit is only set when PTRACE_O_TRACESYSGOOD is in 
effect.  Otherwise, the struct always comes back to userspace with op == 
PTRACE_SYSCALL_INFO_NONE and the entry (or exit) member is not filled in 
with the system call arguments (or return value).

-- 
Nate Eldredge
nate@...tsmathematics.com