In Ubuntu, the use of ptrace is restricted. The default allowed relationship between the debugger and the debuggee is that parents are allowed to ptrace their descendants. This means that running “gdb /some/program” and “strace /some/program” Just Works. Using gdb‘s “attach” and strace‘s “-p” options need CAP_SYS_PTRACE, care of sudo.
The next most common use-case was that of crash handlers needing to do a live ptrace of a crashing program (in the rare case of Apport being insufficient). For example, KDE applications have a segfault handler that calls out to kdeinit and requests that the crash handling process be started on it, and then sits in a loop waiting to be attached to. While kdeinit is the parent of both the crashing program (debuggee) and the crash handling program (debugger), the debugger cannot attach to the debugee since they are siblings, not parent/descendant. To solve this, a prctl() call was added so that the debugee could declare who’s descendants were going to attach to it. KDE patched their segfault handler to make the prctl() and everything Just Works again.
Breakpad, the crash handler for Firefox and Chromium, was updated to do effectively the same thing, though they had to add code to pass the process id back to the debuggee since they didn’t have it handy like KDE.
Another use-case was Wine, where for emulation to work correctly, they needed to allow all Wine processes to ptrace each other to correctly emulate Windows. For this, they just declared that all descendants of the wine-server could debug a given Wine process, there-by confining their ptrace festival to just Wine programs.
One of the remaining use-cases is that of a debugging IDE that doesn’t directly use ptrace itself. For example, qtcreator will launch a program and then later attach to it by launching gdb and using the “attach” command. This looks a lot like the crash handler use-case, except that the debuggee doesn’t have any idea that it is running under an IDE. A simple solution for this is to have the IDE run its programs with the LD_PRELOAD environment variable aimed at a short library that just calls prctl() with the parent process id, and suddenly the IDE and its descendants (i.e. gdb) can debug the program all day long.
I’ve got an example of this preloadable library written. If it turns out this is generally useful for IDEs, I could package it up like fakeroot and faketime.
© 2011, Kees Cook. This work is licensed under a Creative Commons Attribution-ShareAlike 4.0 License.
This is definitely good progress! I wrote http://iki.fi/lindi/screenify almost 8 years ago and ever since I’ve been afraid of the power of ptrace :-)
I tested that at least on maverick a simple “strace -p $(pidof sftp-server)” fails. If somebody backdoors my university account it is now possible for me to read .bashrc without running it…
Btw, this was on planet.debian.org, when should we expect this in Debian? Unstable has procps 1:3.2.8-10 which does not include /etc/sysctl.d/10-ptrace.conf
Comment by Timo Juhani Lindfors — February 19, 2011 @ 2:02 am
Hmm, PR_SET_PTRACER isn’t upstream in the kernel? What’s going on?
Comment by waldo — February 19, 2011 @ 3:40 am
@waldo right, the first link in the blog post describes the feature; it’s not in upstream yet because I got the run-around on it. http://lwn.net/Articles/398607/
Comment by kees — February 21, 2011 @ 12:00 pm