• Elvira Khabirova's avatar
    ptrace: add PTRACE_GET_SYSCALL_INFO request · 201766a2
    Elvira Khabirova authored
    PTRACE_GET_SYSCALL_INFO is a generic ptrace API that lets ptracer obtain
    details of the syscall the tracee is blocked in.
    
    There are two reasons for a special syscall-related ptrace request.
    
    Firstly, with the current ptrace API there are cases when ptracer cannot
    retrieve necessary information about syscalls.  Some examples include:
    
     * The notorious int-0x80-from-64-bit-task issue. See [1] for details.
       In short, if a 64-bit task performs a syscall through int 0x80, its
       tracer has no reliable means to find out that the syscall was, in
       fact, a compat syscall, and misidentifies it.
    
     * Syscall-enter-stop and syscall-exit-stop look the same for the
       tracer. Common practice is to keep track of the sequence of
       ptrace-stops in order not to mix the two syscall-stops up. But it is
       not as simple as it looks; for example, strace had a (just recently
       fixed) long-standing bug where attaching strace to a tracee that is
       performing the execve system call led to the tracer identifying the
       following syscall-exit-stop as syscall-enter-stop, which messed up
       all the state tracking.
    
     * Since the introduction of commit 84d77d3f ("ptrace: Don't allow
       accessing an undumpable mm"), both PTRACE_PEEKDATA and
       process_vm_readv become unavailable when the process dumpable flag is
       cleared. On such architectures as ia64 this results in all syscall
       arguments being unavailable for the tracer.
    
    Secondly, ptracers also have to support a lot of arch-specific code for
    obtaining information about the tracee.  For some architectures, this
    requires a ptrace(PTRACE_PEEKUSER, ...) invocation for every syscall
    argument and return value.
    
    ptrace(2) man page:
    
    long ptrace(enum __ptrace_request request, pid_t pid,
                void *addr, void *data);
    ...
    PTRACE_GET_SYSCALL_INFO
           Retrieve information about the syscall that caused the stop.
           The information is placed into the buffer pointed by "data"
           argument, which should be a pointer to a buffer of type
           "struct ptrace_syscall_info".
           The "addr" argument contains the size of the buffer pointed to
           by "data" argument (i.e., sizeof(struct ptrace_syscall_info)).
           The return value contains the number of bytes available
           to be written by the kernel.
           If the size of data to be written by the kernel exceeds the size
           specified by "addr" argument, the output is truncated.
    
    [ldv@altlinux.org: selftests/seccomp/seccomp_bpf: update for PTRACE_GET_SYSCALL_INFO]
      Link: http://lkml.kernel.org/r/20190708182904.GA12332@altlinux.org
    Link: http://lkml.kernel.org/r/20190510152842.GF28558@altlinux.orgSigned-off-by: default avatarElvira Khabirova <lineprinter@altlinux.org>
    Co-developed-by: default avatarDmitry V. Levin <ldv@altlinux.org>
    Signed-off-by: default avatarDmitry V. Levin <ldv@altlinux.org>
    Reviewed-by: default avatarOleg Nesterov <oleg@redhat.com>
    Reviewed-by: default avatarKees Cook <keescook@chromium.org>
    Reviewed-by: default avatarAndy Lutomirski <luto@kernel.org>
    Cc: Eugene Syromyatnikov <esyr@redhat.com>
    Cc: Benjamin Herrenschmidt <benh@kernel.crashing.org>
    Cc: Greentime Hu <greentime@andestech.com>
    Cc: Helge Deller <deller@gmx.de>	[parisc]
    Cc: James E.J. Bottomley <jejb@parisc-linux.org>
    Cc: James Hogan <jhogan@kernel.org>
    Cc: kbuild test robot <lkp@intel.com>
    Cc: Michael Ellerman <mpe@ellerman.id.au>
    Cc: Paul Burton <paul.burton@mips.com>
    Cc: Paul Mackerras <paulus@samba.org>
    Cc: Ralf Baechle <ralf@linux-mips.org>
    Cc: Richard Kuo <rkuo@codeaurora.org>
    Cc: Shuah Khan <shuah@kernel.org>
    Cc: Vincent Chen <deanbo422@gmail.com>
    Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
    Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
    201766a2
tracehook.h 7.25 KB