diff options
author | Sergio Durigan Junior <sergiodj@redhat.com> | 2019-08-16 19:36:37 -0400 |
---|---|---|
committer | Sergio Durigan Junior <sergiodj@redhat.com> | 2019-09-26 13:48:58 -0400 |
commit | 381beca6146ac68b57edf47d28cdb335fbd11635 (patch) | |
tree | d749798327198ef279f40fb49eef33feb06defdf /gdb/nat | |
parent | ececd218c5254902db3301d700546f6702112c85 (diff) | |
download | gdb-381beca6146ac68b57edf47d28cdb335fbd11635.zip gdb-381beca6146ac68b57edf47d28cdb335fbd11635.tar.gz gdb-381beca6146ac68b57edf47d28cdb335fbd11635.tar.bz2 |
Improve ptrace-error detection on Linux targets
In Fedora GDB, we carry the following patch:
https://src.fedoraproject.org/rpms/gdb/blob/8ac06474ff1e2aa4920d14e0666b083eeaca8952/f/gdb-attach-fail-reasons-5of5.patch
Its purpose is to try to detect a specific scenario where SELinux's
'deny_ptrace' option is enabled, which prevents GDB from ptrace'ing in
order to debug the inferior (PTRACE_ATTACH and PTRACE_TRACEME will
fail with EACCES in this case).
I like the idea of improving error detection and providing more
information to the user (a simple "Permission denied" can be really
frustrating), but I don't fully agree with the way the patch was
implemented: it makes GDB link against libselinux only for the sake of
consulting the 'deny_ptrace' setting, and then prints a warning if
ptrace failed and this setting is on.
My first thought (and attempt) was to make GDB print a generic warning
when a ptrace error happened; this message would just point the user
to our documentation, where she could find more information about
possible causes for the error (and try to diagnose/fix the problem).
This proved to be too simple, and I was convinced that it is actually
a good idea to go the extra kilometre and try to pinpoint the specific
problem (or problems) preventing ptrace from working, as well as
provide useful suggestions on how the user can fix things.
Here is the patch I came up with. It implements a new function,
'linux_ptrace_restricted_fail_reason', which does a few things to
check what's wrong with ptrace:
- It dlopen's "libselinux.so.1" and checks if the "deny_ptrace"
option is enabled.
- It reads the contents of "/proc/sys/kernel/yama/ptrace_scope" and
checks if it's different than 0.
For each of these checks, if it succeeds, the user will see a message
informing about the restriction in place, and how it can be disabled.
For example, if "deny_ptrace" is enabled, the user will see:
# gdb /usr/bin/true
...
Starting program: /usr/bin/true
warning: Could not trace the inferior process.
warning: ptrace: Permission denied
The SELinux 'deny_ptrace' option is enabled and preventing GDB
from using 'ptrace'. You can disable it by executing (as root):
setsebool deny_ptrace off
If you are debugging the inferior remotely, the ptrace restriction(s) need
to be disabled in the target system (e.g., where GDBserver is running).
During startup program exited with code 127.
(gdb)
In case "/proc/sys/kernel/yama/ptrace_scope" is > 0:
# gdb /usr/bin/true
...
Starting program: /usr/bin/true
warning: Could not trace the inferior process.
warning: ptrace: Operation not permitted
The Linux kernel's Yama ptrace scope is in effect, which can prevent
GDB from using 'ptrace'. You can disable it by executing (as root):
echo 0 > /proc/sys/kernel/yama/ptrace_scope
If you are debugging the inferior remotely, the ptrace restriction(s) need
to be disabled in the target system (e.g., where GDBserver is running).
During startup program exited with code 127.
(gdb)
If both restrictions are enabled, both messages will show up.
This works for gdbserver as well, and actually fixes a latent bug I
found: when ptrace is restricted, gdbserver would hang due to an
unchecked ptrace call:
# gdbserver :9988 /usr/bin/true
gdbserver: linux_ptrace_test_ret_to_nx: Cannot PTRACE_TRACEME: Operation not permitted
gdbserver: linux_ptrace_test_ret_to_nx: status 256 is not WIFSTOPPED!
gdbserver: linux_ptrace_test_ret_to_nx: failed to kill child pid 2668100 No such process
[ Here you would have to issue a C-c ]
Now, you will see:
# gdbserver :9988 /usr/bin/true
gdbserver: linux_ptrace_test_ret_to_nx: Cannot PTRACE_TRACEME: Permission denied
gdbserver: linux_ptrace_test_ret_to_nx: status 256 is not WIFSTOPPED!
gdbserver: linux_ptrace_test_ret_to_nx: failed to kill child pid 2766868 No such process
gdbserver: Could not trace the inferior process.
gdbserver: ptrace: Permission denied
The SELinux 'deny_ptrace' option is enabled and preventing GDB
from using 'ptrace'. You can disable it by executing (as root):
setsebool deny_ptrace off
If you are debugging the inferior remotely, the ptrace restriction(s) need
to be disabled in the target system (e.g., where GDBserver is running).
#
(I decided to keep all the other messages, even though I find them a
bit distracting).
If GDB can't determine the cause for the failure, it will still print
the generic error message which tells the user to check our
documentation:
There might be restrictions preventing ptrace from working. Please see
the appendix "Linux kernel ptrace restrictions" in the GDB documentation
for more details.
If you are debugging the inferior remotely, the ptrace restriction(s) need
to be disabled in the target system (e.g., where GDBserver is running).
This means that the patch expands our documentation and creates a new
appendix section named "Linux kernel ptrace restrictions", with
sub-sections for each possible restriction that might be in place.
Notice how, on every message, we instruct the user to "do the right
thing" if gdbserver is being used. This is because if the user
started gdbserver *before* any ptrace restriction was in place, and
then, for some reason, one or more restrictions get enabled, then the
error message will be displayed both on gdbserver *and* on the
connected GDB. Since the user will be piloting GDB, it's important to
explicitly say that the ptrace restrictions are enabled in the target,
where gdbserver is running.
The current list of possible restrictions is:
- SELinux's 'deny_ptrace' option (detected).
- YAMA's /proc/sys/kernel/yama/ptrace_scope setting (detected).
- seccomp on Docker containers (I couldn't find how to detect).
It's important to mention that all of this is Linux-specific; as far
as I know, SELinux, YAMA and seccomp are Linux-only features.
I tested this patch locally, on my Fedora 30 machine (actually, a
Fedora Rawhide VM), but I'm not proposing a testcase for it because of
the difficulty of writing one.
WDYT?
gdb/doc/ChangeLog:
2019-09-26 Sergio Durigan Junior <sergiodj@redhat.com>
* gdb.texinfo (Linux kernel ptrace restrictions): New appendix
section.
gdb/ChangeLog:
2019-09-26 Sergio Durigan Junior <sergiodj@redhat.com>
Jan Kratochvil <jan.kratochvil@redhat.com>
Pedro Alves <palves@redhat.com>
* gdbsupport/gdb-dlfcn.h (gdb_dlopen): Update comment and
mention that the function throws an error.
* inf-ptrace.c (default_inf_ptrace_me_fail_reason): New
function.
(inf_ptrace_me_fail_reason): New variable.
(inf_ptrace_me): Update call to 'trace_start_error_with_name'.
* inf-ptrace.h (inf_ptrace_me_fail_reason): New variable.
* linux-nat.c (attach_proc_task_lwp_callback): Call
'linux_ptrace_attach_fail_reason_lwp'.
(linux_nat_target::attach): Update call to
'linux_ptrace_attach_fail_reason'.
(_initialize_linux_nat): Set 'inf_ptrace_me_fail_reason'.
* nat/fork-inferior.c (trace_start_error_with_name): Add
optional 'append' argument.
* nat/fork-inferior.h (trace_start_error_with_name): Update
prototype.
* nat/linux-ptrace.c: Include "gdbsupport/gdb-dlfcn.h",
"gdbsupport/filestuff.h" and "nat/fork-inferior.h".
(selinux_ftype): New typedef.
(linux_ptrace_restricted_fail_reason): New function.
(linux_ptrace_attach_fail_reason_1): New function.
(linux_ptrace_attach_fail_reason): Change first argument type
from 'ptid_t' to 'pid_t'. Call
'linux_ptrace_attach_fail_reason_1' and
'linux_ptrace_restricted_fail_reason'.
(linux_ptrace_attach_fail_reason_lwp): New function.
(linux_ptrace_me_fail_reason): New function.
(errno_pipe): New variable.
(linux_fork_to_function): Initialize pipe before forking.
(linux_child_function): Deal with errno-passing from child.
Handle ptrace error.
(linux_check_child_ptrace_errno): New function.
(linux_check_child_ptrace_errno): Call
'linux_check_child_ptrace_errno'.
* nat/linux-ptrace.h (linux_ptrace_attach_fail_reason): Update
prototype.
(linux_ptrace_attach_fail_reason_lwp): New prototype.
(linux_ptrace_me_fail_reason): New prototype.
* remote.c (extended_remote_target::attach): Handle error
message passed by the server when attach fails.
gdb/gdbserver/ChangeLog:
2019-09-26 Sergio Durigan Junior <sergiodj@redhat.com>
Pedro Alves <palves@redhat.com>
* linux-low.c (linux_ptrace_fun): Call
'linux_ptrace_me_fail_reason'.
(attach_proc_task_lwp_callback): Call
'linux_ptrace_attach_fail_reason_lwp'.
(linux_attach): Call 'linux_ptrace_attach_fail_reason'.
* server.c (handle_v_attach): Use try..catch when calling
'attach_inferior', and send an error message to the client
when needed.
* thread-db.c (attach_thread): Call
'linux_ptrace_attach_fail_reason_lwp'.
Diffstat (limited to 'gdb/nat')
-rw-r--r-- | gdb/nat/fork-inferior.c | 4 | ||||
-rw-r--r-- | gdb/nat/fork-inferior.h | 7 | ||||
-rw-r--r-- | gdb/nat/linux-ptrace.c | 192 | ||||
-rw-r--r-- | gdb/nat/linux-ptrace.h | 27 |
4 files changed, 212 insertions, 18 deletions
diff --git a/gdb/nat/fork-inferior.c b/gdb/nat/fork-inferior.c index 355e9be..2ead4a4 100644 --- a/gdb/nat/fork-inferior.c +++ b/gdb/nat/fork-inferior.c @@ -591,7 +591,7 @@ trace_start_error (const char *fmt, ...) /* See nat/fork-inferior.h. */ void -trace_start_error_with_name (const char *string) +trace_start_error_with_name (const char *string, const char *append) { - trace_start_error ("%s: %s", string, safe_strerror (errno)); + trace_start_error ("%s: %s%s", string, safe_strerror (errno), append); } diff --git a/gdb/nat/fork-inferior.h b/gdb/nat/fork-inferior.h index 065496c..405f2cf 100644 --- a/gdb/nat/fork-inferior.h +++ b/gdb/nat/fork-inferior.h @@ -98,9 +98,10 @@ extern void trace_start_error (const char *fmt, ...) ATTRIBUTE_NORETURN ATTRIBUTE_PRINTF (1, 2); /* Like "trace_start_error", but the error message is constructed by - combining STRING with the system error message for errno. This - function does not return. */ -extern void trace_start_error_with_name (const char *string) + combining STRING with the system error message for errno, and + (optionally) with APPEND. This function does not return. */ +extern void trace_start_error_with_name (const char *string, + const char *append = "") ATTRIBUTE_NORETURN; #endif /* NAT_FORK_INFERIOR_H */ diff --git a/gdb/nat/linux-ptrace.c b/gdb/nat/linux-ptrace.c index c1ebc0a..8a048d2 100644 --- a/gdb/nat/linux-ptrace.c +++ b/gdb/nat/linux-ptrace.c @@ -21,6 +21,9 @@ #include "linux-procfs.h" #include "linux-waitpid.h" #include "gdbsupport/buffer.h" +#include "gdbsupport/gdb-dlfcn.h" +#include "nat/fork-inferior.h" +#include "gdbsupport/filestuff.h" #ifdef HAVE_SYS_PROCFS_H #include <sys/procfs.h> #endif @@ -30,11 +33,94 @@ of 0 means there are no supported features. */ static int supported_ptrace_options = -1; -/* Find all possible reasons we could fail to attach PID and return these - as a string. An empty string is returned if we didn't find any reason. */ +typedef int (*selinux_ftype) (const char *); -std::string -linux_ptrace_attach_fail_reason (pid_t pid) +/* Helper function which checks if ptrace is probably restricted + (i.e., if ERR is either EACCES or EPERM), and returns a string with + possible workarounds. */ + +static std::string +linux_ptrace_restricted_fail_reason (int err) +{ + if (err != EACCES && err != EPERM) + { + /* It just makes sense to perform the checks below if errno was + either EACCES or EPERM. */ + return {}; + } + + std::string ret; + gdb_dlhandle_up handle; + + try + { + handle = gdb_dlopen ("libselinux.so.1"); + } + catch (const gdb_exception_error &e) + { + handle.reset (nullptr); + } + + if (handle != nullptr) + { + selinux_ftype selinux_get_bool + = (selinux_ftype) gdb_dlsym (handle, "security_get_boolean_active"); + + if (selinux_get_bool != NULL + && (*selinux_get_bool) ("deny_ptrace") == 1) + string_appendf (ret, + _("\n\ +The SELinux 'deny_ptrace' option is enabled and preventing GDB\n\ +from using 'ptrace'. You can disable it by executing (as root):\n\ +\n\ + setsebool deny_ptrace off\n")); + } + + gdb_file_up yama_ptrace_scope + = gdb_fopen_cloexec ("/proc/sys/kernel/yama/ptrace_scope", "r"); + + if (yama_ptrace_scope != nullptr) + { + char yama_scope = fgetc (yama_ptrace_scope.get ()); + + if (yama_scope != '0') + string_appendf (ret, + _("\n\ +The Linux kernel's Yama ptrace scope is in effect, which can prevent\n\ +GDB from using 'ptrace'. You can disable it by executing (as root):\n\ +\n\ + echo 0 > /proc/sys/kernel/yama/ptrace_scope\n")); + } + + if (ret.empty ()) + { + /* It wasn't possible to determine the exact reason for the + ptrace error. Let's just emit a generic error message + pointing the user to our documentation, where she can find + instructions on how to try to diagnose the problem. */ + ret = _("\n\ +There might be restrictions preventing ptrace from working. Please see\n\ +the appendix \"Linux kernel ptrace restrictions\" in the GDB documentation\n\ +for more details."); + } + + /* The user may be debugging remotely, so we have to warn that + the instructions above should be performed in the target. */ + string_appendf (ret, + _("\n\ +If you are debugging the inferior remotely, the ptrace restriction(s) must\n\ +be disabled in the target system (e.g., where GDBserver is running).")); + + return ret; +} + +/* Find all possible reasons we could fail to attach PID and return + these as a string. An empty string is returned if we didn't find + any reason. Helper for linux_ptrace_attach_fail_reason and + linux_ptrace_attach_fail_reason_lwp. */ + +static std::string +linux_ptrace_attach_fail_reason_1 (pid_t pid) { pid_t tracerpid = linux_proc_get_tracerpid_nowarn (pid); std::string result; @@ -56,10 +142,24 @@ linux_ptrace_attach_fail_reason (pid_t pid) /* See linux-ptrace.h. */ std::string -linux_ptrace_attach_fail_reason_string (ptid_t ptid, int err) +linux_ptrace_attach_fail_reason (pid_t pid, int err) +{ + std::string result = linux_ptrace_attach_fail_reason_1 (pid); + std::string ptrace_restrict = linux_ptrace_restricted_fail_reason (err); + + if (!ptrace_restrict.empty ()) + result += "\n" + ptrace_restrict; + + return result; +} + +/* See linux-ptrace.h. */ + +std::string +linux_ptrace_attach_fail_reason_lwp (ptid_t ptid, int err) { long lwpid = ptid.lwp (); - std::string reason = linux_ptrace_attach_fail_reason (lwpid); + std::string reason = linux_ptrace_attach_fail_reason_1 (lwpid); if (!reason.empty ()) return string_printf ("%s (%d), %s", safe_strerror (err), err, @@ -68,6 +168,14 @@ linux_ptrace_attach_fail_reason_string (ptid_t ptid, int err) return string_printf ("%s (%d)", safe_strerror (err), err); } +/* See linux-ptrace.h. */ + +std::string +linux_ptrace_me_fail_reason (int err) +{ + return linux_ptrace_restricted_fail_reason (err); +} + #if defined __i386__ || defined __x86_64__ /* Address of the 'ret' instruction in asm code block below. */ @@ -257,6 +365,12 @@ linux_ptrace_test_ret_to_nx (void) #endif /* defined __i386__ || defined __x86_64__ */ } +/* If the PTRACE_TRACEME call on linux_child_function errors, we need + to be able to send ERRNO back to the parent so that it can check + whether there are restrictions in place preventing ptrace from + working. We do that with a pipe. */ +static int errno_pipe[2]; + /* Helper function to fork a process and make the child process call the function FUNCTION, passing CHILD_STACK as parameter. @@ -273,6 +387,11 @@ linux_fork_to_function (gdb_byte *child_stack, int (*function) (void *)) /* Sanity check the function pointer. */ gdb_assert (function != NULL); + /* Create the pipe that will be used by the child to pass ERRNO + after the PTRACE_TRACEME call. */ + if (pipe (errno_pipe) != 0) + trace_start_error_with_name ("pipe"); + #if defined(__UCLIBC__) && defined(HAS_NOMMU) #define STACK_SIZE 4096 @@ -321,7 +440,21 @@ linux_grandchild_function (void *child_stack) static int linux_child_function (void *child_stack) { - ptrace (PTRACE_TRACEME, 0, (PTRACE_TYPE_ARG3) 0, (PTRACE_TYPE_ARG4) 0); + /* Close read end. */ + close (errno_pipe[0]); + + int ret = ptrace (PTRACE_TRACEME, 0, (PTRACE_TYPE_ARG3) 0, + (PTRACE_TYPE_ARG4) 0); + int ptrace_errno = errno; + + /* Write ERRNO to the pipe, even if it's zero, and close the writing + end of the pipe. */ + write (errno_pipe[1], &ptrace_errno, sizeof (ptrace_errno)); + close (errno_pipe[1]); + + if (ret != 0) + _exit (0); + kill (getpid (), SIGSTOP); /* Fork a grandchild. */ @@ -336,6 +469,48 @@ static void linux_test_for_tracesysgood (int child_pid); static void linux_test_for_tracefork (int child_pid); static void linux_test_for_exitkill (int child_pid); +/* Helper function to wait for the child to send us the ptrace ERRNO, + and check if it's OK. */ + +static void +linux_check_child_ptrace_errno () +{ + int child_errno; + fd_set rset; + struct timeval timeout; + + /* Close the writing end of the pipe. */ + close (errno_pipe[1]); + + FD_ZERO (&rset); + FD_SET (errno_pipe[0], &rset); + + /* One second should be plenty of time to wait for the child's + reply. */ + timeout.tv_sec = 1; + timeout.tv_usec = 0; + + int ret = select (errno_pipe[0] + 1, &rset, NULL, NULL, &timeout); + + if (ret < 0) + trace_start_error_with_name ("select"); + else if (ret == 0) + error (_("Timeout while waiting for child's ptrace errno")); + else + read (errno_pipe[0], &child_errno, sizeof (child_errno)); + + if (child_errno != 0) + { + /* The child can't use PTRACE_TRACEME. We just bail out. */ + std::string reason = linux_ptrace_restricted_fail_reason (child_errno); + + errno = child_errno; + trace_start_error_with_name ("ptrace", reason.c_str ()); + } + + close (errno_pipe[0]); +} + /* Determine ptrace features available on this target. */ void @@ -352,6 +527,9 @@ linux_check_ptrace_features (void) reporting. */ child_pid = linux_fork_to_function (NULL, linux_child_function); + /* Check if the child can successfully use ptrace. */ + linux_check_child_ptrace_errno (); + ret = my_waitpid (child_pid, &status, 0); if (ret == -1) perror_with_name (("waitpid")); diff --git a/gdb/nat/linux-ptrace.h b/gdb/nat/linux-ptrace.h index fd2f12a..90afb60 100644 --- a/gdb/nat/linux-ptrace.h +++ b/gdb/nat/linux-ptrace.h @@ -176,12 +176,27 @@ struct buffer; # define TRAP_HWBKPT 4 #endif -extern std::string linux_ptrace_attach_fail_reason (pid_t pid); - -/* Find all possible reasons we could have failed to attach to PTID - and return them as a string. ERR is the error PTRACE_ATTACH failed - with (an errno). */ -extern std::string linux_ptrace_attach_fail_reason_string (ptid_t ptid, int err); +/* Find all possible reasons we could fail to attach PID and return + these as a string. An empty string is returned if we didn't find + any reason. If ERR is EACCES or EPERM, we also add a warning about + possible restrictions to use ptrace. */ +extern std::string linux_ptrace_attach_fail_reason (pid_t pid, int err); + +/* Find all possible reasons we could have failed to attach to PID's + LWPID and return them as a string. ERR is the error PTRACE_ATTACH + failed with (an errno). Unlike linux_ptrace_attach_fail_reason, + this function should be used when attaching to an LWP other than + the leader; it does not warn about ptrace restrictions. */ +extern std::string linux_ptrace_attach_fail_reason_lwp (ptid_t pid, int err); + +/* When the call to 'ptrace (PTRACE_TRACEME...' fails, and we have + already forked, this function can be called in order to try to + obtain the reason why ptrace failed. ERR should be the ERRNO value + returned by ptrace. + + This function will return a 'std::string' containing the fail + reason, or an empty string otherwise. */ +extern std::string linux_ptrace_me_fail_reason (int err); extern void linux_ptrace_init_warnings (void); extern void linux_check_ptrace_features (void); |