1 /* Linux-specific ptrace manipulation routines.
2 Copyright (C) 2012-2019 Free Software Foundation, Inc.
4 This file is part of GDB.
6 This program is free software; you can redistribute it and/or modify
7 it under the terms of the GNU General Public License as published by
8 the Free Software Foundation; either version 3 of the License, or
9 (at your option) any later version.
11 This program is distributed in the hope that it will be useful,
12 but WITHOUT ANY WARRANTY; without even the implied warranty of
13 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
14 GNU General Public License for more details.
16 You should have received a copy of the GNU General Public License
17 along with this program. If not, see <http://www.gnu.org/licenses/>. */
19 #include "gdbsupport/common-defs.h"
20 #include "linux-ptrace.h"
21 #include "linux-procfs.h"
22 #include "linux-waitpid.h"
23 #include "gdbsupport/buffer.h"
24 #include "gdbsupport/gdb-dlfcn.h"
25 #include "nat/fork-inferior.h"
26 #include "gdbsupport/filestuff.h"
27 #ifdef HAVE_SYS_PROCFS_H
28 #include <sys/procfs.h>
31 /* Stores the ptrace options supported by the running kernel.
32 A value of -1 means we did not check for features yet. A value
33 of 0 means there are no supported features. */
34 static int supported_ptrace_options
= -1;
36 typedef int (*selinux_ftype
) (const char *);
38 /* Helper function which checks if ptrace is probably restricted
39 (i.e., if ERR is either EACCES or EPERM), and returns a string with
40 possible workarounds. */
43 linux_ptrace_restricted_fail_reason (int err
)
45 if (err
!= EACCES
&& err
!= EPERM
)
47 /* It just makes sense to perform the checks below if errno was
48 either EACCES or EPERM. */
53 gdb_dlhandle_up handle
;
57 handle
= gdb_dlopen ("libselinux.so.1");
59 catch (const gdb_exception_error
&e
)
61 handle
.reset (nullptr);
64 if (handle
!= nullptr)
66 selinux_ftype selinux_get_bool
67 = (selinux_ftype
) gdb_dlsym (handle
, "security_get_boolean_active");
69 if (selinux_get_bool
!= NULL
70 && (*selinux_get_bool
) ("deny_ptrace") == 1)
73 The SELinux 'deny_ptrace' option is enabled and preventing GDB\n\
74 from using 'ptrace'. You can disable it by executing (as root):\n\
76 setsebool deny_ptrace off\n"));
79 gdb_file_up yama_ptrace_scope
80 = gdb_fopen_cloexec ("/proc/sys/kernel/yama/ptrace_scope", "r");
82 if (yama_ptrace_scope
!= nullptr)
84 char yama_scope
= fgetc (yama_ptrace_scope
.get ());
86 if (yama_scope
!= '0')
89 The Linux kernel's Yama ptrace scope is in effect, which can prevent\n\
90 GDB from using 'ptrace'. You can disable it by executing (as root):\n\
92 echo 0 > /proc/sys/kernel/yama/ptrace_scope\n"));
97 /* It wasn't possible to determine the exact reason for the
98 ptrace error. Let's just emit a generic error message
99 pointing the user to our documentation, where she can find
100 instructions on how to try to diagnose the problem. */
102 There might be restrictions preventing ptrace from working. Please see\n\
103 the appendix \"Linux kernel ptrace restrictions\" in the GDB documentation\n\
107 /* The user may be debugging remotely, so we have to warn that
108 the instructions above should be performed in the target. */
111 If you are debugging the inferior remotely, the ptrace restriction(s) must\n\
112 be disabled in the target system (e.g., where GDBserver is running)."));
117 /* Find all possible reasons we could fail to attach PID and return
118 these as a string. An empty string is returned if we didn't find
119 any reason. Helper for linux_ptrace_attach_fail_reason and
120 linux_ptrace_attach_fail_reason_lwp. */
123 linux_ptrace_attach_fail_reason_1 (pid_t pid
)
125 pid_t tracerpid
= linux_proc_get_tracerpid_nowarn (pid
);
129 string_appendf (result
,
130 _("process %d is already traced by process %d"),
131 (int) pid
, (int) tracerpid
);
133 if (linux_proc_pid_is_zombie_nowarn (pid
))
134 string_appendf (result
,
135 _("process %d is a zombie - the process has already "
142 /* See linux-ptrace.h. */
145 linux_ptrace_attach_fail_reason (pid_t pid
, int err
)
147 std::string result
= linux_ptrace_attach_fail_reason_1 (pid
);
148 std::string ptrace_restrict
= linux_ptrace_restricted_fail_reason (err
);
150 if (!ptrace_restrict
.empty ())
151 result
+= "\n" + ptrace_restrict
;
156 /* See linux-ptrace.h. */
159 linux_ptrace_attach_fail_reason_lwp (ptid_t ptid
, int err
)
161 long lwpid
= ptid
.lwp ();
162 std::string reason
= linux_ptrace_attach_fail_reason_1 (lwpid
);
164 if (!reason
.empty ())
165 return string_printf ("%s (%d), %s", safe_strerror (err
), err
,
168 return string_printf ("%s (%d)", safe_strerror (err
), err
);
171 /* See linux-ptrace.h. */
174 linux_ptrace_me_fail_reason (int err
)
176 return linux_ptrace_restricted_fail_reason (err
);
179 #if defined __i386__ || defined __x86_64__
181 /* Address of the 'ret' instruction in asm code block below. */
182 EXTERN_C
void linux_ptrace_test_ret_to_nx_instr (void);
185 #include <sys/mman.h>
188 #endif /* defined __i386__ || defined __x86_64__ */
190 /* Kill CHILD. WHO is used to report warnings. */
193 kill_child (pid_t child
, const char *who
)
198 if (kill (child
, SIGKILL
) != 0)
200 warning (_("%s: failed to kill child pid %ld %s"),
201 who
, (long) child
, safe_strerror (errno
));
206 got_pid
= my_waitpid (child
, &kill_status
, 0);
207 if (got_pid
!= child
)
210 "kill waitpid returned %ld: %s"),
211 who
, (long) got_pid
, safe_strerror (errno
));
214 if (!WIFSIGNALED (kill_status
))
217 "kill status %d is not WIFSIGNALED!"),
223 /* Test broken off-trunk Linux kernel patchset for NX support on i386. It was
224 removed in Fedora kernel 88fa1f0332d188795ed73d7ac2b1564e11a0b4cd.
226 Test also x86_64 arch for PaX support. */
229 linux_ptrace_test_ret_to_nx (void)
231 #if defined __i386__ || defined __x86_64__
232 pid_t child
, got_pid
;
233 gdb_byte
*return_address
, *pc
;
239 = (gdb_byte
*) mmap (NULL
, 2, PROT_READ
| PROT_WRITE
,
240 MAP_PRIVATE
| MAP_ANONYMOUS
, -1, 0);
241 if (return_address
== MAP_FAILED
)
243 warning (_("linux_ptrace_test_ret_to_nx: Cannot mmap: %s"),
244 safe_strerror (errno
));
248 /* Put there 'int3'. */
249 *return_address
= 0xcc;
255 warning (_("linux_ptrace_test_ret_to_nx: Cannot fork: %s"),
256 safe_strerror (errno
));
260 l
= ptrace (PTRACE_TRACEME
, 0, (PTRACE_TYPE_ARG3
) NULL
,
261 (PTRACE_TYPE_ARG4
) NULL
);
263 warning (_("linux_ptrace_test_ret_to_nx: Cannot PTRACE_TRACEME: %s"),
264 safe_strerror (errno
));
268 asm volatile ("pushl %0;"
269 ".globl linux_ptrace_test_ret_to_nx_instr;"
270 "linux_ptrace_test_ret_to_nx_instr:"
272 : : "r" (return_address
) : "memory");
273 #elif defined __x86_64__
274 asm volatile ("pushq %0;"
275 ".globl linux_ptrace_test_ret_to_nx_instr;"
276 "linux_ptrace_test_ret_to_nx_instr:"
278 : : "r" ((uint64_t) (uintptr_t) return_address
)
281 # error "!__i386__ && !__x86_64__"
283 gdb_assert_not_reached ("asm block did not terminate");
290 got_pid
= waitpid (child
, &status
, 0);
291 if (got_pid
!= child
)
293 warning (_("linux_ptrace_test_ret_to_nx: waitpid returned %ld: %s"),
294 (long) got_pid
, safe_strerror (errno
));
298 if (WIFSIGNALED (status
))
300 if (WTERMSIG (status
) != SIGKILL
)
301 warning (_("linux_ptrace_test_ret_to_nx: WTERMSIG %d is not SIGKILL!"),
302 (int) WTERMSIG (status
));
304 warning (_("Cannot call inferior functions, Linux kernel PaX "
305 "protection forbids return to non-executable pages!"));
309 if (!WIFSTOPPED (status
))
311 warning (_("linux_ptrace_test_ret_to_nx: status %d is not WIFSTOPPED!"),
313 kill_child (child
, "linux_ptrace_test_ret_to_nx");
317 /* We may get SIGSEGV due to missing PROT_EXEC of the return_address. */
318 if (WSTOPSIG (status
) != SIGTRAP
&& WSTOPSIG (status
) != SIGSEGV
)
320 warning (_("linux_ptrace_test_ret_to_nx: "
321 "WSTOPSIG %d is neither SIGTRAP nor SIGSEGV!"),
322 (int) WSTOPSIG (status
));
323 kill_child (child
, "linux_ptrace_test_ret_to_nx");
327 if (ptrace (PTRACE_GETREGS
, child
, (PTRACE_TYPE_ARG3
) 0,
328 (PTRACE_TYPE_ARG4
) ®s
) < 0)
330 warning (_("linux_ptrace_test_ret_to_nx: Cannot PTRACE_GETREGS: %s"),
331 safe_strerror (errno
));
334 pc
= (gdb_byte
*) (uintptr_t) regs
[EIP
];
335 #elif defined __x86_64__
336 pc
= (gdb_byte
*) (uintptr_t) regs
[RIP
];
338 # error "!__i386__ && !__x86_64__"
341 kill_child (child
, "linux_ptrace_test_ret_to_nx");
343 /* + 1 is there as x86* stops after the 'int3' instruction. */
344 if (WSTOPSIG (status
) == SIGTRAP
&& pc
== return_address
+ 1)
350 /* We may get SIGSEGV due to missing PROT_EXEC of the RETURN_ADDRESS page. */
351 if (WSTOPSIG (status
) == SIGSEGV
&& pc
== return_address
)
357 if ((void (*) (void)) pc
!= &linux_ptrace_test_ret_to_nx_instr
)
358 warning (_("linux_ptrace_test_ret_to_nx: PC %p is neither near return "
359 "address %p nor is the return instruction %p!"),
360 pc
, return_address
, &linux_ptrace_test_ret_to_nx_instr
);
362 warning (_("Cannot call inferior functions on this system - "
363 "Linux kernel with broken i386 NX (non-executable pages) "
364 "support detected!"));
365 #endif /* defined __i386__ || defined __x86_64__ */
368 /* If the PTRACE_TRACEME call on linux_child_function errors, we need
369 to be able to send ERRNO back to the parent so that it can check
370 whether there are restrictions in place preventing ptrace from
371 working. We do that with a pipe. */
372 static int errno_pipe
[2];
374 /* Helper function to fork a process and make the child process call
375 the function FUNCTION, passing CHILD_STACK as parameter.
377 For MMU-less targets, clone is used instead of fork, and
378 CHILD_STACK is used as stack space for the cloned child. If NULL,
379 stack space is allocated via malloc (and subsequently passed to
380 FUNCTION). For MMU targets, CHILD_STACK is ignored. */
383 linux_fork_to_function (gdb_byte
*child_stack
, int (*function
) (void *))
387 /* Sanity check the function pointer. */
388 gdb_assert (function
!= NULL
);
390 /* Create the pipe that will be used by the child to pass ERRNO
391 after the PTRACE_TRACEME call. */
392 if (pipe (errno_pipe
) != 0)
393 trace_start_error_with_name ("pipe");
395 #if defined(__UCLIBC__) && defined(HAS_NOMMU)
396 #define STACK_SIZE 4096
398 if (child_stack
== NULL
)
399 child_stack
= (gdb_byte
*) xmalloc (STACK_SIZE
* 4);
401 /* Use CLONE_VM instead of fork, to support uClinux (no MMU). */
403 child_pid
= __clone2 (function
, child_stack
, STACK_SIZE
,
404 CLONE_VM
| SIGCHLD
, child_stack
+ STACK_SIZE
* 2);
405 #else /* !__ia64__ */
406 child_pid
= clone (function
, child_stack
+ STACK_SIZE
,
407 CLONE_VM
| SIGCHLD
, child_stack
+ STACK_SIZE
* 2);
408 #endif /* !__ia64__ */
409 #else /* !defined(__UCLIBC) && defined(HAS_NOMMU) */
414 #endif /* defined(__UCLIBC) && defined(HAS_NOMMU) */
417 perror_with_name (("fork"));
422 /* A helper function for linux_check_ptrace_features, called after
423 the child forks a grandchild. */
426 linux_grandchild_function (void *child_stack
)
428 /* Free any allocated stack. */
431 /* This code is only reacheable by the grandchild (child's child)
436 /* A helper function for linux_check_ptrace_features, called after
437 the parent process forks a child. The child allows itself to
438 be traced by its parent. */
441 linux_child_function (void *child_stack
)
443 /* Close read end. */
444 close (errno_pipe
[0]);
446 int ret
= ptrace (PTRACE_TRACEME
, 0, (PTRACE_TYPE_ARG3
) 0,
447 (PTRACE_TYPE_ARG4
) 0);
448 int ptrace_errno
= errno
;
450 /* Write ERRNO to the pipe, even if it's zero, and close the writing
452 write (errno_pipe
[1], &ptrace_errno
, sizeof (ptrace_errno
));
453 close (errno_pipe
[1]);
458 kill (getpid (), SIGSTOP
);
460 /* Fork a grandchild. */
461 linux_fork_to_function ((gdb_byte
*) child_stack
, linux_grandchild_function
);
463 /* This code is only reacheable by the child (grandchild's parent)
468 static void linux_test_for_tracesysgood (int child_pid
);
469 static void linux_test_for_tracefork (int child_pid
);
470 static void linux_test_for_exitkill (int child_pid
);
472 /* Helper function to wait for the child to send us the ptrace ERRNO,
473 and check if it's OK. */
476 linux_check_child_ptrace_errno ()
480 struct timeval timeout
;
482 /* Close the writing end of the pipe. */
483 close (errno_pipe
[1]);
486 FD_SET (errno_pipe
[0], &rset
);
488 /* One second should be plenty of time to wait for the child's
493 int ret
= select (errno_pipe
[0] + 1, &rset
, NULL
, NULL
, &timeout
);
496 trace_start_error_with_name ("select");
498 error (_("Timeout while waiting for child's ptrace errno"));
500 read (errno_pipe
[0], &child_errno
, sizeof (child_errno
));
502 if (child_errno
!= 0)
504 /* The child can't use PTRACE_TRACEME. We just bail out. */
505 std::string reason
= linux_ptrace_restricted_fail_reason (child_errno
);
508 trace_start_error_with_name ("ptrace", reason
.c_str ());
511 close (errno_pipe
[0]);
514 /* Determine ptrace features available on this target. */
517 linux_check_ptrace_features (void)
519 int child_pid
, ret
, status
;
521 /* Initialize the options. */
522 supported_ptrace_options
= 0;
524 /* Fork a child so we can do some testing. The child will call
525 linux_child_function and will get traced. The child will
526 eventually fork a grandchild so we can test fork event
528 child_pid
= linux_fork_to_function (NULL
, linux_child_function
);
530 /* Check if the child can successfully use ptrace. */
531 linux_check_child_ptrace_errno ();
533 ret
= my_waitpid (child_pid
, &status
, 0);
535 perror_with_name (("waitpid"));
536 else if (ret
!= child_pid
)
537 error (_("linux_check_ptrace_features: waitpid: unexpected result %d."),
539 if (! WIFSTOPPED (status
))
540 error (_("linux_check_ptrace_features: waitpid: unexpected status %d."),
543 linux_test_for_tracesysgood (child_pid
);
545 linux_test_for_tracefork (child_pid
);
547 linux_test_for_exitkill (child_pid
);
549 /* Kill child_pid. */
550 kill_child (child_pid
, "linux_check_ptrace_features");
553 /* Determine if PTRACE_O_TRACESYSGOOD can be used to catch
557 linux_test_for_tracesysgood (int child_pid
)
561 ret
= ptrace (PTRACE_SETOPTIONS
, child_pid
, (PTRACE_TYPE_ARG3
) 0,
562 (PTRACE_TYPE_ARG4
) PTRACE_O_TRACESYSGOOD
);
565 supported_ptrace_options
|= PTRACE_O_TRACESYSGOOD
;
568 /* Determine if PTRACE_O_TRACEFORK can be used to follow fork
572 linux_test_for_tracefork (int child_pid
)
577 /* First, set the PTRACE_O_TRACEFORK option. If this fails, we
578 know for sure that it is not supported. */
579 ret
= ptrace (PTRACE_SETOPTIONS
, child_pid
, (PTRACE_TYPE_ARG3
) 0,
580 (PTRACE_TYPE_ARG4
) PTRACE_O_TRACEFORK
);
585 /* Check if the target supports PTRACE_O_TRACEVFORKDONE. */
586 ret
= ptrace (PTRACE_SETOPTIONS
, child_pid
, (PTRACE_TYPE_ARG3
) 0,
587 (PTRACE_TYPE_ARG4
) (PTRACE_O_TRACEFORK
588 | PTRACE_O_TRACEVFORKDONE
));
590 supported_ptrace_options
|= PTRACE_O_TRACEVFORKDONE
;
592 /* Setting PTRACE_O_TRACEFORK did not cause an error, however we
593 don't know for sure that the feature is available; old
594 versions of PTRACE_SETOPTIONS ignored unknown options.
595 Therefore, we attach to the child process, use PTRACE_SETOPTIONS
596 to enable fork tracing, and let it fork. If the process exits,
597 we assume that we can't use PTRACE_O_TRACEFORK; if we get the
598 fork notification, and we can extract the new child's PID, then
599 we assume that we can.
601 We do not explicitly check for vfork tracing here. It is
602 assumed that vfork tracing is available whenever fork tracing
604 ret
= ptrace (PTRACE_CONT
, child_pid
, (PTRACE_TYPE_ARG3
) 0,
605 (PTRACE_TYPE_ARG4
) 0);
607 warning (_("linux_test_for_tracefork: failed to resume child"));
609 ret
= my_waitpid (child_pid
, &status
, 0);
611 /* Check if we received a fork event notification. */
612 if (ret
== child_pid
&& WIFSTOPPED (status
)
613 && linux_ptrace_get_extended_event (status
) == PTRACE_EVENT_FORK
)
615 /* We did receive a fork event notification. Make sure its PID
618 ret
= ptrace (PTRACE_GETEVENTMSG
, child_pid
, (PTRACE_TYPE_ARG3
) 0,
619 (PTRACE_TYPE_ARG4
) &second_pid
);
620 if (ret
== 0 && second_pid
!= 0)
624 /* We got the PID from the grandchild, which means fork
625 tracing is supported. */
626 supported_ptrace_options
|= PTRACE_O_TRACECLONE
;
627 supported_ptrace_options
|= (PTRACE_O_TRACEFORK
628 | PTRACE_O_TRACEVFORK
629 | PTRACE_O_TRACEEXEC
);
631 /* Do some cleanup and kill the grandchild. */
632 my_waitpid (second_pid
, &second_status
, 0);
633 kill_child (second_pid
, "linux_test_for_tracefork");
637 warning (_("linux_test_for_tracefork: unexpected result from waitpid "
638 "(%d, status 0x%x)"), ret
, status
);
641 /* Determine if PTRACE_O_EXITKILL can be used. */
644 linux_test_for_exitkill (int child_pid
)
648 ret
= ptrace (PTRACE_SETOPTIONS
, child_pid
, (PTRACE_TYPE_ARG3
) 0,
649 (PTRACE_TYPE_ARG4
) PTRACE_O_EXITKILL
);
652 supported_ptrace_options
|= PTRACE_O_EXITKILL
;
655 /* Enable reporting of all currently supported ptrace events.
656 OPTIONS is a bit mask of extended features we want enabled,
657 if supported by the kernel. PTRACE_O_TRACECLONE is always
658 enabled, if supported. */
661 linux_enable_event_reporting (pid_t pid
, int options
)
663 /* Check if we have initialized the ptrace features for this
664 target. If not, do it now. */
665 if (supported_ptrace_options
== -1)
666 linux_check_ptrace_features ();
668 /* We always want clone events. */
669 options
|= PTRACE_O_TRACECLONE
;
671 /* Filter out unsupported options. */
672 options
&= supported_ptrace_options
;
674 /* Set the options. */
675 ptrace (PTRACE_SETOPTIONS
, pid
, (PTRACE_TYPE_ARG3
) 0,
676 (PTRACE_TYPE_ARG4
) (uintptr_t) options
);
679 /* Disable reporting of all currently supported ptrace events. */
682 linux_disable_event_reporting (pid_t pid
)
684 /* Set the options. */
685 ptrace (PTRACE_SETOPTIONS
, pid
, (PTRACE_TYPE_ARG3
) 0, 0);
688 /* Returns non-zero if PTRACE_OPTIONS is contained within
689 SUPPORTED_PTRACE_OPTIONS, therefore supported. Returns 0
693 ptrace_supports_feature (int ptrace_options
)
695 if (supported_ptrace_options
== -1)
696 linux_check_ptrace_features ();
698 return ((supported_ptrace_options
& ptrace_options
) == ptrace_options
);
701 /* Returns non-zero if PTRACE_EVENT_FORK is supported by ptrace,
702 0 otherwise. Note that if PTRACE_EVENT_FORK is supported so is
703 PTRACE_EVENT_CLONE, PTRACE_EVENT_EXEC and PTRACE_EVENT_VFORK,
704 since they were all added to the kernel at the same time. */
707 linux_supports_tracefork (void)
709 return ptrace_supports_feature (PTRACE_O_TRACEFORK
);
712 /* Returns non-zero if PTRACE_EVENT_EXEC is supported by ptrace,
713 0 otherwise. Note that if PTRACE_EVENT_FORK is supported so is
714 PTRACE_EVENT_CLONE, PTRACE_EVENT_FORK and PTRACE_EVENT_VFORK,
715 since they were all added to the kernel at the same time. */
718 linux_supports_traceexec (void)
720 return ptrace_supports_feature (PTRACE_O_TRACEEXEC
);
723 /* Returns non-zero if PTRACE_EVENT_CLONE is supported by ptrace,
724 0 otherwise. Note that if PTRACE_EVENT_CLONE is supported so is
725 PTRACE_EVENT_FORK, PTRACE_EVENT_EXEC and PTRACE_EVENT_VFORK,
726 since they were all added to the kernel at the same time. */
729 linux_supports_traceclone (void)
731 return ptrace_supports_feature (PTRACE_O_TRACECLONE
);
734 /* Returns non-zero if PTRACE_O_TRACEVFORKDONE is supported by
735 ptrace, 0 otherwise. */
738 linux_supports_tracevforkdone (void)
740 return ptrace_supports_feature (PTRACE_O_TRACEVFORKDONE
);
743 /* Returns non-zero if PTRACE_O_TRACESYSGOOD is supported by ptrace,
747 linux_supports_tracesysgood (void)
749 return ptrace_supports_feature (PTRACE_O_TRACESYSGOOD
);
752 /* Display possible problems on this system. Display them only once per GDB
756 linux_ptrace_init_warnings (void)
758 static int warned
= 0;
764 linux_ptrace_test_ret_to_nx ();
767 /* Extract extended ptrace event from wait status. */
770 linux_ptrace_get_extended_event (int wstat
)
772 return (wstat
>> 16);
775 /* Determine whether wait status denotes an extended event. */
778 linux_is_extended_waitstatus (int wstat
)
780 return (linux_ptrace_get_extended_event (wstat
) != 0);
783 /* Return true if the event in LP may be caused by breakpoint. */
786 linux_wstatus_maybe_breakpoint (int wstat
)
788 return (WIFSTOPPED (wstat
)
789 && (WSTOPSIG (wstat
) == SIGTRAP
790 /* SIGILL and SIGSEGV are also treated as traps in case a
791 breakpoint is inserted at the current PC. */
792 || WSTOPSIG (wstat
) == SIGILL
793 || WSTOPSIG (wstat
) == SIGSEGV
));