CVS commit: src/sys/kern

["Kamil Rytarowski" <kamil%netbsd.org@localhost>]

Module Name:    src
Committed By:   kamil
Date:           Sun Apr 29 04:28:10 UTC 2018

Modified Files:
        src/sys/kern: sys_ptrace_common.c

Log Message:
Harden the NetBSD PT_TRACE_ME operation

You can't say to the parent of a process to start tracing if:
        (1) the parent is initproc,
        (2) the child is already traced.

Rationale:
 (1) - It has a side effect of being an anti-debugger functionality,
       as we cannot kill initproc (PID1) and reset the traced flag.
     - initproc is not a debugger, raising debugging events from a child
       to initproc can result in at least a stopped/hanging process
       in the system.
 (2) - It does not make sense to be simultanously traced by two debuggers.
     - It does not make sense to be traced twice by the same debugger.

Permit enable tracing for a parent that has been chroot(8)ed, as this is
harmless and the parent is already monitoring for child signals.

The same semantics exist in FreeBSD.

If you are looking for an antidebugging trick for old NetBSD (pre 8.0)
or other popular kernels, here is an example:

$ cat antidebug.c
#include <sys/types.h>
#include <sys/ptrace.h>

#include <stdlib.h>
#include <unistd.h>
#include <stdio.h>
#include <errno.h>

int
main(int argc, char **argv)
{
        pid_t child;
        int rv;
        int n = 0;

        child = fork();
        if (child == 0) {
                while (getppid() != 1)
                        continue;
                rv = ptrace(PT_TRACE_ME, 0, 0, 0);
                if (rv != 0)
                        abort();
                printf("Try to detach to me with a debugger!! ");
                printf("haha My PID is %d\n", getpid());
                while (1) {
                        printf("%d\n", n++);
                        sleep(1);
                }
        }
        exit(0);
}

A developer is no longer able to attach GDB, strace or LLDB to this program
without killing the initproc (your favourite system daemon).. this action
would be fatal for the operation of the whole Operating System stability.

Examples from a current non-NetBSD popular kernel:

$ ps -o ppid= -p 17904
    1

$ strace -p 17904
strace: attach: ptrace(PTRACE_SEIZE, 17904): Operation not permitted

$ gdb -p 17904
[...]
Attaching to process 17904
warning: process 17904 is already traced by process 1
ptrace: Operation not permitted.
(gdb)

$ lldb-3.9 -p 17904
(lldb) process attach --pid 17904
error: attach failed: unable to attach

On NetBSD 8.0 and newer it is now guaranteed to have an option to kill
a malevolent (fake?) debugger and attach with a new tracer to the process.

Sponsored by <The NetBSD Foundation>


To generate a diff of this commit:
cvs rdiff -u -r1.37 -r1.38 src/sys/kern/sys_ptrace_common.c

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.