427 lines
14 KiB
Diff
427 lines
14 KiB
Diff
http://sourceware.org/ml/gdb-patches/2012-03/msg00171.html
|
|
Subject: [patch 3/3] attach-fail-reasons: SELinux deny_ptrace
|
|
|
|
Hi,
|
|
|
|
and here is the last bit for new SELinux 'deny_ptrace':
|
|
https://bugzilla.redhat.com/show_bug.cgi?id=786878
|
|
|
|
As even PTRACE_TRACEME fails in such case it needs to install hook for even
|
|
that event.
|
|
|
|
|
|
Thanks,
|
|
Jan
|
|
|
|
|
|
gdb/
|
|
2012-03-06 Jan Kratochvil <jan.kratochvil@redhat.com>
|
|
|
|
* common/linux-ptrace.c [HAVE_SELINUX_SELINUX_H]: include
|
|
selinux/selinux.h.
|
|
(linux_ptrace_attach_warnings): Call linux_ptrace_create_warnings.
|
|
(linux_ptrace_create_warnings): New.
|
|
* common/linux-ptrace.h (linux_ptrace_create_warnings): New declaration.
|
|
* config.in: Regenerate.
|
|
* configure: Regenerate.
|
|
* configure.ac: Check selinux/selinux.h and the selinux library.
|
|
* inf-ptrace.c (inf_ptrace_me): Check the ptrace result.
|
|
* linux-nat.c (linux_nat_create_inferior): New variable ex. Wrap
|
|
to_create_inferior into TRY_CATCH, call linux_ptrace_create_warnings.
|
|
|
|
gdb/gdbserver/
|
|
* config.in: Regenerate.
|
|
* configure: Regenerate.
|
|
* configure.ac: Check selinux/selinux.h and the selinux library.
|
|
* linux-low.c (linux_traceme): New function.
|
|
(linux_create_inferior, linux_tracefork_child): Call it instead of
|
|
direct ptrace.
|
|
|
|
Index: gdb-7.8.50.20141228/gdb/nat/linux-ptrace.c
|
|
===================================================================
|
|
--- gdb-7.8.50.20141228.orig/gdb/nat/linux-ptrace.c 2015-01-01 21:38:14.691209094 +0100
|
|
+++ gdb-7.8.50.20141228/gdb/nat/linux-ptrace.c 2015-01-01 21:39:34.670157506 +0100
|
|
@@ -25,6 +25,10 @@
|
|
|
|
#include <stdint.h>
|
|
|
|
+#ifdef HAVE_SELINUX_SELINUX_H
|
|
+# include <selinux/selinux.h>
|
|
+#endif /* HAVE_SELINUX_SELINUX_H */
|
|
+
|
|
/* Stores the currently supported ptrace options. A value of
|
|
-1 means we did not check for features yet. A value of 0 means
|
|
there are no supported features. */
|
|
@@ -53,6 +57,8 @@ linux_ptrace_attach_fail_reason (pid_t p
|
|
buffer_xml_printf (buffer, _("process %d is a zombie "
|
|
"- the process has already terminated"),
|
|
(int) pid);
|
|
+
|
|
+ linux_ptrace_create_warnings (buffer);
|
|
}
|
|
|
|
#if defined __i386__ || defined __x86_64__
|
|
@@ -568,6 +574,22 @@ linux_ptrace_init_warnings (void)
|
|
linux_ptrace_test_ret_to_nx ();
|
|
}
|
|
|
|
+/* Print all possible reasons we could fail to create a traced process. */
|
|
+
|
|
+void
|
|
+linux_ptrace_create_warnings (struct buffer *buffer)
|
|
+{
|
|
+#ifdef HAVE_LIBSELINUX
|
|
+ /* -1 is returned for errors, 0 if it has no effect, 1 if PTRACE_ATTACH is
|
|
+ forbidden. */
|
|
+ if (security_get_boolean_active ("deny_ptrace") == 1)
|
|
+ buffer_xml_printf (buffer,
|
|
+ _("the SELinux boolean 'deny_ptrace' is enabled, "
|
|
+ "you can disable this process attach protection by: "
|
|
+ "(gdb) shell sudo setsebool deny_ptrace=0"));
|
|
+#endif /* HAVE_LIBSELINUX */
|
|
+}
|
|
+
|
|
/* Set additional ptrace flags to use. Some such flags may be checked
|
|
by the implementation above. This function must be called before
|
|
any other function in this file; otherwise the flags may not take
|
|
Index: gdb-7.8.50.20141228/gdb/nat/linux-ptrace.h
|
|
===================================================================
|
|
--- gdb-7.8.50.20141228.orig/gdb/nat/linux-ptrace.h 2015-01-01 21:38:21.280204844 +0100
|
|
+++ gdb-7.8.50.20141228/gdb/nat/linux-ptrace.h 2015-01-01 21:39:00.542179519 +0100
|
|
@@ -90,6 +90,7 @@ struct buffer;
|
|
|
|
extern void linux_ptrace_attach_fail_reason (pid_t pid, struct buffer *buffer);
|
|
extern void linux_ptrace_init_warnings (void);
|
|
+extern void linux_ptrace_create_warnings (struct buffer *buffer);
|
|
extern void linux_enable_event_reporting (pid_t pid, int attached);
|
|
extern void linux_disable_event_reporting (pid_t pid);
|
|
extern int linux_supports_tracefork (void);
|
|
Index: gdb-7.8.50.20141228/gdb/configure.ac
|
|
===================================================================
|
|
--- gdb-7.8.50.20141228.orig/gdb/configure.ac 2015-01-01 21:38:14.692209094 +0100
|
|
+++ gdb-7.8.50.20141228/gdb/configure.ac 2015-01-01 21:38:21.281204843 +0100
|
|
@@ -2116,6 +2116,10 @@ case $host_os in
|
|
esac
|
|
AC_DEFINE_UNQUOTED(GDBINIT,"$gdbinit",[The .gdbinit filename.])
|
|
|
|
+dnl Check security_get_boolean_active availability.
|
|
+AC_CHECK_HEADERS(selinux/selinux.h)
|
|
+AC_CHECK_LIB(selinux, security_get_boolean_active)
|
|
+
|
|
dnl Handle optional features that can be enabled.
|
|
|
|
# Support for --with-sysroot is a copy of GDB_AC_WITH_DIR,
|
|
Index: gdb-7.8.50.20141228/gdb/gdbserver/configure.ac
|
|
===================================================================
|
|
--- gdb-7.8.50.20141228.orig/gdb/gdbserver/configure.ac 2015-01-01 21:38:14.693209093 +0100
|
|
+++ gdb-7.8.50.20141228/gdb/gdbserver/configure.ac 2015-01-01 21:38:21.281204843 +0100
|
|
@@ -461,6 +461,10 @@ if $want_ipa ; then
|
|
fi
|
|
fi
|
|
|
|
+dnl Check security_get_boolean_active availability.
|
|
+AC_CHECK_HEADERS(selinux/selinux.h)
|
|
+AC_CHECK_LIB(selinux, security_get_boolean_active)
|
|
+
|
|
AC_SUBST(GDBSERVER_DEPFILES)
|
|
AC_SUBST(GDBSERVER_LIBS)
|
|
AC_SUBST(srv_xmlbuiltin)
|
|
Index: gdb-7.8.50.20141228/gdb/gdbserver/linux-low.c
|
|
===================================================================
|
|
--- gdb-7.8.50.20141228.orig/gdb/gdbserver/linux-low.c 2015-01-01 21:38:14.695209091 +0100
|
|
+++ gdb-7.8.50.20141228/gdb/gdbserver/linux-low.c 2015-01-01 21:38:21.282204843 +0100
|
|
@@ -537,6 +537,29 @@ add_lwp (ptid_t ptid)
|
|
return lwp;
|
|
}
|
|
|
|
+/* Execute PTRACE_TRACEME with error checking. */
|
|
+
|
|
+static void
|
|
+linux_traceme (const char *program)
|
|
+{
|
|
+ int save_errno;
|
|
+ struct buffer buffer;
|
|
+
|
|
+ errno = 0;
|
|
+ if (ptrace (PTRACE_TRACEME, 0,
|
|
+ (PTRACE_TYPE_ARG3) 0, (PTRACE_TYPE_ARG4) 0) == 0)
|
|
+ return;
|
|
+
|
|
+ save_errno = errno;
|
|
+ buffer_init (&buffer);
|
|
+ linux_ptrace_create_warnings (&buffer);
|
|
+ buffer_grow_str0 (&buffer, "");
|
|
+ fprintf (stderr, _("%sCannot trace created process %s: %s.\n"),
|
|
+ buffer_finish (&buffer), program, strerror (save_errno));
|
|
+ fflush (stderr);
|
|
+ _exit (0177);
|
|
+}
|
|
+
|
|
/* Start an inferior process and returns its pid.
|
|
ALLARGS is a vector of program-name and args. */
|
|
|
|
@@ -578,7 +601,7 @@ linux_create_inferior (char *program, ch
|
|
if (pid == 0)
|
|
{
|
|
close_most_fds ();
|
|
- ptrace (PTRACE_TRACEME, 0, (PTRACE_TYPE_ARG3) 0, (PTRACE_TYPE_ARG4) 0);
|
|
+ linux_traceme (program);
|
|
|
|
#ifndef __ANDROID__ /* Bionic doesn't use SIGRTMIN the way glibc does. */
|
|
signal (__SIGRTMIN + 1, SIG_DFL);
|
|
Index: gdb-7.8.50.20141228/gdb/inf-ptrace.c
|
|
===================================================================
|
|
--- gdb-7.8.50.20141228.orig/gdb/inf-ptrace.c 2015-01-01 21:38:14.695209091 +0100
|
|
+++ gdb-7.8.50.20141228/gdb/inf-ptrace.c 2015-01-01 21:38:21.282204843 +0100
|
|
@@ -66,7 +66,15 @@ static void
|
|
inf_ptrace_me (void)
|
|
{
|
|
/* "Trace me, Dr. Memory!" */
|
|
+ errno = 0;
|
|
ptrace (PT_TRACE_ME, 0, (PTRACE_TYPE_ARG3)0, 0);
|
|
+ if (errno != 0)
|
|
+ {
|
|
+ fprintf_unfiltered (gdb_stderr, _("Cannot create process: %s\n"),
|
|
+ safe_strerror (errno));
|
|
+ gdb_flush (gdb_stderr);
|
|
+ _exit (0177);
|
|
+ }
|
|
}
|
|
|
|
/* Start a new inferior Unix child process. EXEC_FILE is the file to
|
|
Index: gdb-7.8.50.20141228/gdb/linux-nat.c
|
|
===================================================================
|
|
--- gdb-7.8.50.20141228.orig/gdb/linux-nat.c 2015-01-01 21:38:14.697209090 +0100
|
|
+++ gdb-7.8.50.20141228/gdb/linux-nat.c 2015-01-01 21:38:21.283204842 +0100
|
|
@@ -1099,6 +1099,7 @@ linux_nat_create_inferior (struct target
|
|
#ifdef HAVE_PERSONALITY
|
|
int personality_orig = 0, personality_set = 0;
|
|
#endif /* HAVE_PERSONALITY */
|
|
+ volatile struct gdb_exception ex;
|
|
|
|
/* The fork_child mechanism is synchronous and calls target_wait, so
|
|
we have to mask the async mode. */
|
|
@@ -1123,7 +1124,10 @@ linux_nat_create_inferior (struct target
|
|
/* Make sure we report all signals during startup. */
|
|
linux_nat_pass_signals (ops, 0, NULL);
|
|
|
|
- linux_ops->to_create_inferior (ops, exec_file, allargs, env, from_tty);
|
|
+ TRY_CATCH (ex, RETURN_MASK_ERROR)
|
|
+ {
|
|
+ linux_ops->to_create_inferior (ops, exec_file, allargs, env, from_tty);
|
|
+ }
|
|
|
|
#ifdef HAVE_PERSONALITY
|
|
if (personality_set)
|
|
@@ -1135,6 +1139,24 @@ linux_nat_create_inferior (struct target
|
|
safe_strerror (errno));
|
|
}
|
|
#endif /* HAVE_PERSONALITY */
|
|
+
|
|
+ if (ex.reason < 0)
|
|
+ {
|
|
+ struct buffer buffer;
|
|
+ char *message, *buffer_s;
|
|
+
|
|
+ message = xstrdup (ex.message);
|
|
+ make_cleanup (xfree, message);
|
|
+
|
|
+ buffer_init (&buffer);
|
|
+ linux_ptrace_create_warnings (&buffer);
|
|
+
|
|
+ buffer_grow_str0 (&buffer, "");
|
|
+ buffer_s = buffer_finish (&buffer);
|
|
+ make_cleanup (xfree, buffer_s);
|
|
+
|
|
+ throw_error (ex.error, "%s%s", buffer_s, message);
|
|
+ }
|
|
}
|
|
|
|
static void
|
|
Index: gdb-7.8.50.20141228/gdb/config.in
|
|
===================================================================
|
|
--- gdb-7.8.50.20141228.orig/gdb/config.in 2015-01-01 21:38:14.697209090 +0100
|
|
+++ gdb-7.8.50.20141228/gdb/config.in 2015-01-01 21:38:21.284204842 +0100
|
|
@@ -213,6 +213,9 @@
|
|
/* Define if librpm library is being used. */
|
|
#undef HAVE_LIBRPM
|
|
|
|
+/* Define to 1 if you have the `selinux' library (-lselinux). */
|
|
+#undef HAVE_LIBSELINUX
|
|
+
|
|
/* Define to 1 if you have the <libunwind-ia64.h> header file. */
|
|
#undef HAVE_LIBUNWIND_IA64_H
|
|
|
|
@@ -342,6 +345,9 @@
|
|
/* Define to 1 if you have the `scm_new_smob' function. */
|
|
#undef HAVE_SCM_NEW_SMOB
|
|
|
|
+/* Define to 1 if you have the <selinux/selinux.h> header file. */
|
|
+#undef HAVE_SELINUX_SELINUX_H
|
|
+
|
|
/* Define to 1 if you have the `setlocale' function. */
|
|
#undef HAVE_SETLOCALE
|
|
|
|
Index: gdb-7.8.50.20141228/gdb/configure
|
|
===================================================================
|
|
--- gdb-7.8.50.20141228.orig/gdb/configure 2015-01-01 21:38:14.701209087 +0100
|
|
+++ gdb-7.8.50.20141228/gdb/configure 2015-01-01 21:38:21.286204840 +0100
|
|
@@ -13269,6 +13269,64 @@ cat >>confdefs.h <<_ACEOF
|
|
_ACEOF
|
|
|
|
|
|
+for ac_header in selinux/selinux.h
|
|
+do :
|
|
+ ac_fn_c_check_header_mongrel "$LINENO" "selinux/selinux.h" "ac_cv_header_selinux_selinux_h" "$ac_includes_default"
|
|
+if test "x$ac_cv_header_selinux_selinux_h" = x""yes; then :
|
|
+ cat >>confdefs.h <<_ACEOF
|
|
+#define HAVE_SELINUX_SELINUX_H 1
|
|
+_ACEOF
|
|
+
|
|
+fi
|
|
+
|
|
+done
|
|
+
|
|
+{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for security_get_boolean_active in -lselinux" >&5
|
|
+$as_echo_n "checking for security_get_boolean_active in -lselinux... " >&6; }
|
|
+if test "${ac_cv_lib_selinux_security_get_boolean_active+set}" = set; then :
|
|
+ $as_echo_n "(cached) " >&6
|
|
+else
|
|
+ ac_check_lib_save_LIBS=$LIBS
|
|
+LIBS="-lselinux $LIBS"
|
|
+cat confdefs.h - <<_ACEOF >conftest.$ac_ext
|
|
+/* end confdefs.h. */
|
|
+
|
|
+/* Override any GCC internal prototype to avoid an error.
|
|
+ Use char because int might match the return type of a GCC
|
|
+ builtin and then its argument prototype would still apply. */
|
|
+#ifdef __cplusplus
|
|
+extern "C"
|
|
+#endif
|
|
+char security_get_boolean_active ();
|
|
+int
|
|
+main ()
|
|
+{
|
|
+return security_get_boolean_active ();
|
|
+ ;
|
|
+ return 0;
|
|
+}
|
|
+_ACEOF
|
|
+if ac_fn_c_try_link "$LINENO"; then :
|
|
+ ac_cv_lib_selinux_security_get_boolean_active=yes
|
|
+else
|
|
+ ac_cv_lib_selinux_security_get_boolean_active=no
|
|
+fi
|
|
+rm -f core conftest.err conftest.$ac_objext \
|
|
+ conftest$ac_exeext conftest.$ac_ext
|
|
+LIBS=$ac_check_lib_save_LIBS
|
|
+fi
|
|
+{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_lib_selinux_security_get_boolean_active" >&5
|
|
+$as_echo "$ac_cv_lib_selinux_security_get_boolean_active" >&6; }
|
|
+if test "x$ac_cv_lib_selinux_security_get_boolean_active" = x""yes; then :
|
|
+ cat >>confdefs.h <<_ACEOF
|
|
+#define HAVE_LIBSELINUX 1
|
|
+_ACEOF
|
|
+
|
|
+ LIBS="-lselinux $LIBS"
|
|
+
|
|
+fi
|
|
+
|
|
+
|
|
|
|
# Support for --with-sysroot is a copy of GDB_AC_WITH_DIR,
|
|
# except that the argument to --with-sysroot is optional.
|
|
Index: gdb-7.8.50.20141228/gdb/gdbserver/config.in
|
|
===================================================================
|
|
--- gdb-7.8.50.20141228.orig/gdb/gdbserver/config.in 2015-01-01 21:38:14.702209087 +0100
|
|
+++ gdb-7.8.50.20141228/gdb/gdbserver/config.in 2015-01-01 21:38:39.365193179 +0100
|
|
@@ -75,6 +75,9 @@
|
|
/* Define to 1 if you have the `mcheck' library (-lmcheck). */
|
|
#undef HAVE_LIBMCHECK
|
|
|
|
+/* Define to 1 if you have the `selinux' library (-lselinux). */
|
|
+#undef HAVE_LIBSELINUX
|
|
+
|
|
/* Define if the target supports branch tracing. */
|
|
#undef HAVE_LINUX_BTRACE
|
|
|
|
@@ -142,6 +145,9 @@
|
|
/* Define to 1 if you have the `pwrite' function. */
|
|
#undef HAVE_PWRITE
|
|
|
|
+/* Define to 1 if you have the <selinux/selinux.h> header file. */
|
|
+#undef HAVE_SELINUX_SELINUX_H
|
|
+
|
|
/* Define to 1 if you have the <sgtty.h> header file. */
|
|
#undef HAVE_SGTTY_H
|
|
|
|
Index: gdb-7.8.50.20141228/gdb/gdbserver/configure
|
|
===================================================================
|
|
--- gdb-7.8.50.20141228.orig/gdb/gdbserver/configure 2015-01-01 21:38:14.704209086 +0100
|
|
+++ gdb-7.8.50.20141228/gdb/gdbserver/configure 2015-01-01 21:38:21.288204839 +0100
|
|
@@ -6199,6 +6199,64 @@ if $want_ipa ; then
|
|
fi
|
|
fi
|
|
|
|
+for ac_header in selinux/selinux.h
|
|
+do :
|
|
+ ac_fn_c_check_header_mongrel "$LINENO" "selinux/selinux.h" "ac_cv_header_selinux_selinux_h" "$ac_includes_default"
|
|
+if test "x$ac_cv_header_selinux_selinux_h" = x""yes; then :
|
|
+ cat >>confdefs.h <<_ACEOF
|
|
+#define HAVE_SELINUX_SELINUX_H 1
|
|
+_ACEOF
|
|
+
|
|
+fi
|
|
+
|
|
+done
|
|
+
|
|
+{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for security_get_boolean_active in -lselinux" >&5
|
|
+$as_echo_n "checking for security_get_boolean_active in -lselinux... " >&6; }
|
|
+if test "${ac_cv_lib_selinux_security_get_boolean_active+set}" = set; then :
|
|
+ $as_echo_n "(cached) " >&6
|
|
+else
|
|
+ ac_check_lib_save_LIBS=$LIBS
|
|
+LIBS="-lselinux $LIBS"
|
|
+cat confdefs.h - <<_ACEOF >conftest.$ac_ext
|
|
+/* end confdefs.h. */
|
|
+
|
|
+/* Override any GCC internal prototype to avoid an error.
|
|
+ Use char because int might match the return type of a GCC
|
|
+ builtin and then its argument prototype would still apply. */
|
|
+#ifdef __cplusplus
|
|
+extern "C"
|
|
+#endif
|
|
+char security_get_boolean_active ();
|
|
+int
|
|
+main ()
|
|
+{
|
|
+return security_get_boolean_active ();
|
|
+ ;
|
|
+ return 0;
|
|
+}
|
|
+_ACEOF
|
|
+if ac_fn_c_try_link "$LINENO"; then :
|
|
+ ac_cv_lib_selinux_security_get_boolean_active=yes
|
|
+else
|
|
+ ac_cv_lib_selinux_security_get_boolean_active=no
|
|
+fi
|
|
+rm -f core conftest.err conftest.$ac_objext \
|
|
+ conftest$ac_exeext conftest.$ac_ext
|
|
+LIBS=$ac_check_lib_save_LIBS
|
|
+fi
|
|
+{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_lib_selinux_security_get_boolean_active" >&5
|
|
+$as_echo "$ac_cv_lib_selinux_security_get_boolean_active" >&6; }
|
|
+if test "x$ac_cv_lib_selinux_security_get_boolean_active" = x""yes; then :
|
|
+ cat >>confdefs.h <<_ACEOF
|
|
+#define HAVE_LIBSELINUX 1
|
|
+_ACEOF
|
|
+
|
|
+ LIBS="-lselinux $LIBS"
|
|
+
|
|
+fi
|
|
+
|
|
+
|
|
|
|
|
|
|