[src/trunk]: src/sys/kern Harden PT_ATTACH in ptrace(2)

[kamil <kamil%NetBSD.org@localhost>]

details:   https://anonhg.NetBSD.org/src/rev/904e35bc410e
branches:  trunk
changeset: 362180:904e35bc410e
user:      kamil <kamil%NetBSD.org@localhost>
date:      Tue May 29 23:34:18 2018 +0000

description:
Harden PT_ATTACH in ptrace(2)

Don't allow to PT_ATTACH from a vfork(2)ed child (before exec(3)/_exit(3))
to its parent. Return error with EPERM errno.

This scenario does not have a purpose and there is no clear picture how to
route signals.

Sponsored by <The NetBSD Foundation>

diffstat:

 sys/kern/sys_ptrace_common.c |  14 ++++++++++----
 1 files changed, 10 insertions(+), 4 deletions(-)

diffs (40 lines):

diff -r 390abec93476 -r 904e35bc410e sys/kern/sys_ptrace_common.c
--- a/sys/kern/sys_ptrace_common.c      Tue May 29 19:45:31 2018 +0000
+++ b/sys/kern/sys_ptrace_common.c      Tue May 29 23:34:18 2018 +0000
@@ -1,4 +1,4 @@
-/*     $NetBSD: sys_ptrace_common.c,v 1.42 2018/05/20 04:00:35 kamil Exp $     */
+/*     $NetBSD: sys_ptrace_common.c,v 1.43 2018/05/29 23:34:18 kamil Exp $     */
 
 /*-
  * Copyright (c) 2008, 2009 The NetBSD Foundation, Inc.
@@ -118,7 +118,7 @@
  */
 
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: sys_ptrace_common.c,v 1.42 2018/05/20 04:00:35 kamil Exp $");
+__KERNEL_RCSID(0, "$NetBSD: sys_ptrace_common.c,v 1.43 2018/05/29 23:34:18 kamil Exp $");
 
 #ifdef _KERNEL_OPT
 #include "opt_ptrace.h"
@@ -419,13 +419,19 @@
                        return EPERM;
 
                /*
-                *      (4) it's already being traced, or
+                *      (4) it's already being traced,
                 */
                if (ISSET(t->p_slflag, PSL_TRACED))
                        return EBUSY;
 
                /*
-                *      (5) the tracer is chrooted, and its root directory is
+                *      (5) it's a vfork(2)ed parent of the current process, or
+                */
+               if (ISSET(p->p_lflag, PL_PPWAIT) && p->p_pptr == t)
+                       return EPERM;
+
+               /*
+                *      (6) the tracer is chrooted, and its root directory is
                 *          not at or above the root directory of the tracee
                 */
                mutex_exit(t->p_lock);  /* XXXSMP */