c64e732
http://sourceware.org/ml/gdb-patches/2012-03/msg00171.html
c64e732
Subject: [patch 3/3] attach-fail-reasons: SELinux deny_ptrace
c64e732
c64e732
Hi,
c64e732
c64e732
and here is the last bit for new SELinux 'deny_ptrace':
c64e732
	https://bugzilla.redhat.com/show_bug.cgi?id=786878
c64e732
c64e732
As even PTRACE_TRACEME fails in such case it needs to install hook for even
c64e732
that event.
c64e732
c64e732
c64e732
Thanks,
c64e732
Jan
c64e732
c64e732
c64e732
gdb/
c64e732
2012-03-06  Jan Kratochvil  <jan.kratochvil@redhat.com>
c64e732
c64e732
	* common/linux-ptrace.c [HAVE_SELINUX_SELINUX_H]: include
c64e732
	selinux/selinux.h.
c64e732
	(linux_ptrace_attach_warnings): Call linux_ptrace_create_warnings.
c64e732
	(linux_ptrace_create_warnings): New.
c64e732
	* common/linux-ptrace.h (linux_ptrace_create_warnings): New declaration.
c64e732
	* config.in: Regenerate.
c64e732
	* configure: Regenerate.
c64e732
	* configure.ac: Check selinux/selinux.h and the selinux library.
c64e732
	* inf-ptrace.c (inf_ptrace_me): Check the ptrace result.
c64e732
	* linux-nat.c (linux_nat_create_inferior): New variable ex.  Wrap
c64e732
	to_create_inferior into TRY_CATCH, call linux_ptrace_create_warnings.
c64e732
c64e732
gdb/gdbserver/
c64e732
	* config.in: Regenerate.
c64e732
	* configure: Regenerate.
c64e732
	* configure.ac: Check selinux/selinux.h and the selinux library.
c64e732
	* linux-low.c (linux_traceme): New function.
c64e732
	(linux_create_inferior, linux_tracefork_child): Call it instead of
c64e732
	direct ptrace.
c64e732
2116e53
Index: gdb-7.10.50.20160106/gdb/nat/linux-ptrace.c
f8eee05
===================================================================
2116e53
--- gdb-7.10.50.20160106.orig/gdb/nat/linux-ptrace.c	2016-01-08 19:15:57.580707944 +0100
2116e53
+++ gdb-7.10.50.20160106/gdb/nat/linux-ptrace.c	2016-01-08 19:16:02.654736246 +0100
23f398e
@@ -24,6 +24,10 @@
ae96b4a
 #include "gdb_wait.h"
23f398e
 #include "gdb_ptrace.h"
c64e732
 
c64e732
+#ifdef HAVE_SELINUX_SELINUX_H
c64e732
+# include <selinux/selinux.h>
c64e732
+#endif /* HAVE_SELINUX_SELINUX_H */
c64e732
+
32f92b2
 /* Stores the ptrace options supported by the running kernel.
32f92b2
    A value of -1 means we did not check for features yet.  A value
32f92b2
    of 0 means there are no supported features.  */
2116e53
@@ -48,6 +52,8 @@
eb6cb2d
     buffer_xml_printf (buffer, _("process %d is a zombie "
eb6cb2d
 				 "- the process has already terminated"),
f8eee05
 		       (int) pid);
c64e732
+
f8eee05
+  linux_ptrace_create_warnings (buffer);
8aabf36
 }
8aabf36
 
0728371
 /* See linux-ptrace.h.  */
2116e53
@@ -594,6 +600,22 @@
8aabf36
   linux_ptrace_test_ret_to_nx ();
8aabf36
 }
2f7f533
 
c64e732
+/* Print all possible reasons we could fail to create a traced process.  */
c64e732
+
c64e732
+void
f8eee05
+linux_ptrace_create_warnings (struct buffer *buffer)
c64e732
+{
c64e732
+#ifdef HAVE_LIBSELINUX
c64e732
+  /* -1 is returned for errors, 0 if it has no effect, 1 if PTRACE_ATTACH is
c64e732
+     forbidden.  */
c64e732
+  if (security_get_boolean_active ("deny_ptrace") == 1)
f8eee05
+    buffer_xml_printf (buffer,
f8eee05
+		       _("the SELinux boolean 'deny_ptrace' is enabled, "
f8eee05
+			 "you can disable this process attach protection by: "
f8eee05
+			 "(gdb) shell sudo setsebool deny_ptrace=0"));
c64e732
+#endif /* HAVE_LIBSELINUX */
8aabf36
+}
2f7f533
+
32f92b2
 /* Extract extended ptrace event from wait status.  */
32f92b2
 
32f92b2
 int
2116e53
Index: gdb-7.10.50.20160106/gdb/nat/linux-ptrace.h
f8eee05
===================================================================
2116e53
--- gdb-7.10.50.20160106.orig/gdb/nat/linux-ptrace.h	2016-01-08 19:15:57.581707950 +0100
2116e53
+++ gdb-7.10.50.20160106/gdb/nat/linux-ptrace.h	2016-01-08 19:16:02.655736251 +0100
2116e53
@@ -164,6 +164,7 @@
0728371
 extern char *linux_ptrace_attach_fail_reason_string (ptid_t ptid, int err);
c64e732
 
8aabf36
 extern void linux_ptrace_init_warnings (void);
f8eee05
+extern void linux_ptrace_create_warnings (struct buffer *buffer);
32f92b2
 extern void linux_check_ptrace_features (void);
2f7f533
 extern void linux_enable_event_reporting (pid_t pid, int attached);
eb6cb2d
 extern void linux_disable_event_reporting (pid_t pid);
2116e53
Index: gdb-7.10.50.20160106/gdb/configure.ac
f8eee05
===================================================================
2116e53
--- gdb-7.10.50.20160106.orig/gdb/configure.ac	2016-01-08 19:15:57.582707955 +0100
2116e53
+++ gdb-7.10.50.20160106/gdb/configure.ac	2016-01-08 19:16:02.656736257 +0100
2116e53
@@ -2077,6 +2077,10 @@
872aab0
 esac
872aab0
 AC_DEFINE_UNQUOTED(GDBINIT,"$gdbinit",[The .gdbinit filename.])
c64e732
 
c64e732
+dnl Check security_get_boolean_active availability.
c64e732
+AC_CHECK_HEADERS(selinux/selinux.h)
c64e732
+AC_CHECK_LIB(selinux, security_get_boolean_active)
c64e732
+
c64e732
 dnl Handle optional features that can be enabled.
c64e732
 
c64e732
 # Support for --with-sysroot is a copy of GDB_AC_WITH_DIR,
2116e53
Index: gdb-7.10.50.20160106/gdb/gdbserver/configure.ac
f8eee05
===================================================================
2116e53
--- gdb-7.10.50.20160106.orig/gdb/gdbserver/configure.ac	2016-01-08 19:15:57.582707955 +0100
2116e53
+++ gdb-7.10.50.20160106/gdb/gdbserver/configure.ac	2016-01-08 19:16:02.656736257 +0100
2116e53
@@ -524,6 +524,10 @@
c64e732
    fi
c64e732
 fi
c64e732
 
c64e732
+dnl Check security_get_boolean_active availability.
c64e732
+AC_CHECK_HEADERS(selinux/selinux.h)
c64e732
+AC_CHECK_LIB(selinux, security_get_boolean_active)
c64e732
+
c64e732
 AC_SUBST(GDBSERVER_DEPFILES)
c64e732
 AC_SUBST(GDBSERVER_LIBS)
872aab0
 AC_SUBST(srv_xmlbuiltin)
2116e53
Index: gdb-7.10.50.20160106/gdb/gdbserver/linux-low.c
f8eee05
===================================================================
2116e53
--- gdb-7.10.50.20160106.orig/gdb/gdbserver/linux-low.c	2016-01-08 19:15:57.585707972 +0100
2116e53
+++ gdb-7.10.50.20160106/gdb/gdbserver/linux-low.c	2016-01-08 19:16:02.658736268 +0100
2116e53
@@ -853,6 +853,29 @@
c64e732
   return lwp;
c64e732
 }
c64e732
 
c64e732
+/* Execute PTRACE_TRACEME with error checking.  */
c64e732
+
c64e732
+static void
c64e732
+linux_traceme (const char *program)
c64e732
+{
c64e732
+  int save_errno;
f8eee05
+  struct buffer buffer;
c64e732
+
c64e732
+  errno = 0;
ab333d9
+  if (ptrace (PTRACE_TRACEME, 0,
2c55a54
+	      (PTRACE_TYPE_ARG3) 0, (PTRACE_TYPE_ARG4) 0) == 0)
c64e732
+    return;
c64e732
+
c64e732
+  save_errno = errno;
f8eee05
+  buffer_init (&buffer);
f8eee05
+  linux_ptrace_create_warnings (&buffer);
f8eee05
+  buffer_grow_str0 (&buffer, "");
f8eee05
+  fprintf (stderr, _("%sCannot trace created process %s: %s.\n"),
f8eee05
+	   buffer_finish (&buffer), program, strerror (save_errno));
c64e732
+  fflush (stderr);
c64e732
+  _exit (0177);
c64e732
+}
c64e732
+
c64e732
 /* Start an inferior process and returns its pid.
c64e732
    ALLARGS is a vector of program-name and args. */
c64e732
 
2116e53
@@ -876,7 +899,7 @@
c64e732
   if (pid == 0)
c64e732
     {
2c55a54
       close_most_fds ();
2c55a54
-      ptrace (PTRACE_TRACEME, 0, (PTRACE_TYPE_ARG3) 0, (PTRACE_TYPE_ARG4) 0);
c64e732
+      linux_traceme (program);
c64e732
 
2116e53
       setpgid (0, 0);
2116e53
 
2116e53
Index: gdb-7.10.50.20160106/gdb/inf-ptrace.c
f8eee05
===================================================================
2116e53
--- gdb-7.10.50.20160106.orig/gdb/inf-ptrace.c	2016-01-08 19:15:57.586707977 +0100
2116e53
+++ gdb-7.10.50.20160106/gdb/inf-ptrace.c	2016-01-08 19:16:02.659736274 +0100
2116e53
@@ -79,7 +79,15 @@
c64e732
 inf_ptrace_me (void)
c64e732
 {
c64e732
   /* "Trace me, Dr. Memory!"  */
c64e732
+  errno = 0;
c64e732
   ptrace (PT_TRACE_ME, 0, (PTRACE_TYPE_ARG3)0, 0);
c64e732
+  if (errno != 0)
c64e732
+    {
c64e732
+      fprintf_unfiltered (gdb_stderr, _("Cannot create process: %s\n"),
c64e732
+			  safe_strerror (errno));
c64e732
+      gdb_flush (gdb_stderr);
c64e732
+      _exit (0177);
c64e732
+    }
c64e732
 }
c64e732
 
c64e732
 /* Start a new inferior Unix child process.  EXEC_FILE is the file to
2116e53
Index: gdb-7.10.50.20160106/gdb/linux-nat.c
f8eee05
===================================================================
2116e53
--- gdb-7.10.50.20160106.orig/gdb/linux-nat.c	2016-01-08 19:15:57.587707983 +0100
2116e53
+++ gdb-7.10.50.20160106/gdb/linux-nat.c	2016-01-08 19:16:02.660736279 +0100
2116e53
@@ -1016,6 +1016,7 @@
32f92b2
 {
32f92b2
   struct cleanup *restore_personality
32f92b2
     = maybe_disable_address_space_randomization (disable_randomization);
c64e732
+  volatile struct gdb_exception ex;
c64e732
 
c64e732
   /* The fork_child mechanism is synchronous and calls target_wait, so
c64e732
      we have to mask the async mode.  */
2116e53
@@ -1023,7 +1024,28 @@
c64e732
   /* Make sure we report all signals during startup.  */
eb6cb2d
   linux_nat_pass_signals (ops, 0, NULL);
c64e732
 
c64e732
-  linux_ops->to_create_inferior (ops, exec_file, allargs, env, from_tty);
32f92b2
+  TRY
c64e732
+    {
c64e732
+      linux_ops->to_create_inferior (ops, exec_file, allargs, env, from_tty);
c64e732
+    }
32f92b2
+  CATCH (ex, RETURN_MASK_ERROR)
c64e732
+    {
f8eee05
+      struct buffer buffer;
f8eee05
+      char *message, *buffer_s;
f8eee05
+
f8eee05
+      message = xstrdup (ex.message);
f8eee05
+      make_cleanup (xfree, message);
f8eee05
+
f8eee05
+      buffer_init (&buffer);
f8eee05
+      linux_ptrace_create_warnings (&buffer);
f8eee05
+
f8eee05
+      buffer_grow_str0 (&buffer, "");
f8eee05
+      buffer_s = buffer_finish (&buffer);
f8eee05
+      make_cleanup (xfree, buffer_s);
f8eee05
+
f8eee05
+      throw_error (ex.error, "%s%s", buffer_s, message);
c64e732
+    }
32f92b2
+  END_CATCH
c64e732
 
32f92b2
   do_cleanups (restore_personality);
32f92b2
 }
2116e53
Index: gdb-7.10.50.20160106/gdb/config.in
872aab0
===================================================================
2116e53
--- gdb-7.10.50.20160106.orig/gdb/config.in	2016-01-08 19:15:57.588707989 +0100
2116e53
+++ gdb-7.10.50.20160106/gdb/config.in	2016-01-08 19:16:02.660736279 +0100
ae96b4a
@@ -264,6 +264,9 @@
872aab0
 /* Define if librpm library is being used. */
872aab0
 #undef HAVE_LIBRPM
872aab0
 
872aab0
+/* Define to 1 if you have the `selinux' library (-lselinux). */
872aab0
+#undef HAVE_LIBSELINUX
872aab0
+
872aab0
 /* Define to 1 if you have the <libunwind-ia64.h> header file. */
872aab0
 #undef HAVE_LIBUNWIND_IA64_H
872aab0
 
ae96b4a
@@ -396,6 +399,9 @@
eb6cb2d
 /* Define to 1 if you have the `scm_new_smob' function. */
eb6cb2d
 #undef HAVE_SCM_NEW_SMOB
872aab0
 
872aab0
+/* Define to 1 if you have the <selinux/selinux.h> header file. */
872aab0
+#undef HAVE_SELINUX_SELINUX_H
872aab0
+
43b0bce
 /* Define to 1 if you have the `setlocale' function. */
43b0bce
 #undef HAVE_SETLOCALE
872aab0
 
2116e53
Index: gdb-7.10.50.20160106/gdb/configure
872aab0
===================================================================
2116e53
--- gdb-7.10.50.20160106.orig/gdb/configure	2016-01-08 19:15:57.593708017 +0100
2116e53
+++ gdb-7.10.50.20160106/gdb/configure	2016-01-08 19:16:02.665736307 +0100
2116e53
@@ -14653,6 +14653,64 @@
872aab0
 _ACEOF
872aab0
 
872aab0
 
872aab0
+for ac_header in selinux/selinux.h
872aab0
+do :
872aab0
+  ac_fn_c_check_header_mongrel "$LINENO" "selinux/selinux.h" "ac_cv_header_selinux_selinux_h" "$ac_includes_default"
872aab0
+if test "x$ac_cv_header_selinux_selinux_h" = x""yes; then :
872aab0
+  cat >>confdefs.h <<_ACEOF
872aab0
+#define HAVE_SELINUX_SELINUX_H 1
872aab0
+_ACEOF
872aab0
+
872aab0
+fi
872aab0
+
872aab0
+done
872aab0
+
872aab0
+{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for security_get_boolean_active in -lselinux" >&5
872aab0
+$as_echo_n "checking for security_get_boolean_active in -lselinux... " >&6; }
872aab0
+if test "${ac_cv_lib_selinux_security_get_boolean_active+set}" = set; then :
872aab0
+  $as_echo_n "(cached) " >&6
872aab0
+else
872aab0
+  ac_check_lib_save_LIBS=$LIBS
872aab0
+LIBS="-lselinux  $LIBS"
872aab0
+cat confdefs.h - <<_ACEOF >conftest.$ac_ext
872aab0
+/* end confdefs.h.  */
872aab0
+
872aab0
+/* Override any GCC internal prototype to avoid an error.
872aab0
+   Use char because int might match the return type of a GCC
872aab0
+   builtin and then its argument prototype would still apply.  */
872aab0
+#ifdef __cplusplus
872aab0
+extern "C"
872aab0
+#endif
872aab0
+char security_get_boolean_active ();
872aab0
+int
872aab0
+main ()
872aab0
+{
872aab0
+return security_get_boolean_active ();
872aab0
+  ;
872aab0
+  return 0;
872aab0
+}
872aab0
+_ACEOF
872aab0
+if ac_fn_c_try_link "$LINENO"; then :
872aab0
+  ac_cv_lib_selinux_security_get_boolean_active=yes
872aab0
+else
872aab0
+  ac_cv_lib_selinux_security_get_boolean_active=no
872aab0
+fi
872aab0
+rm -f core conftest.err conftest.$ac_objext \
872aab0
+    conftest$ac_exeext conftest.$ac_ext
872aab0
+LIBS=$ac_check_lib_save_LIBS
872aab0
+fi
872aab0
+{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_lib_selinux_security_get_boolean_active" >&5
872aab0
+$as_echo "$ac_cv_lib_selinux_security_get_boolean_active" >&6; }
872aab0
+if test "x$ac_cv_lib_selinux_security_get_boolean_active" = x""yes; then :
872aab0
+  cat >>confdefs.h <<_ACEOF
872aab0
+#define HAVE_LIBSELINUX 1
872aab0
+_ACEOF
872aab0
+
872aab0
+  LIBS="-lselinux $LIBS"
872aab0
+
872aab0
+fi
872aab0
+
872aab0
+
872aab0
 
872aab0
 # Support for --with-sysroot is a copy of GDB_AC_WITH_DIR,
872aab0
 # except that the argument to --with-sysroot is optional.
2116e53
Index: gdb-7.10.50.20160106/gdb/gdbserver/config.in
872aab0
===================================================================
2116e53
--- gdb-7.10.50.20160106.orig/gdb/gdbserver/config.in	2016-01-08 19:15:57.595708028 +0100
2116e53
+++ gdb-7.10.50.20160106/gdb/gdbserver/config.in	2016-01-08 19:16:02.665736307 +0100
23f398e
@@ -117,6 +117,9 @@
2c55a54
 /* Define to 1 if you have the `mcheck' library (-lmcheck). */
2c55a54
 #undef HAVE_LIBMCHECK
872aab0
 
872aab0
+/* Define to 1 if you have the `selinux' library (-lselinux). */
872aab0
+#undef HAVE_LIBSELINUX
872aab0
+
872aab0
 /* Define if the target supports branch tracing. */
872aab0
 #undef HAVE_LINUX_BTRACE
872aab0
 
c296a6a
@@ -193,6 +196,9 @@
c296a6a
 /* Define to 1 if you have the `pwrite' function. */
c296a6a
 #undef HAVE_PWRITE
872aab0
 
872aab0
+/* Define to 1 if you have the <selinux/selinux.h> header file. */
872aab0
+#undef HAVE_SELINUX_SELINUX_H
872aab0
+
c296a6a
 /* Define to 1 if you have the `setns' function. */
c296a6a
 #undef HAVE_SETNS
872aab0
 
2116e53
Index: gdb-7.10.50.20160106/gdb/gdbserver/configure
872aab0
===================================================================
2116e53
--- gdb-7.10.50.20160106.orig/gdb/gdbserver/configure	2016-01-08 19:15:57.597708039 +0100
2116e53
+++ gdb-7.10.50.20160106/gdb/gdbserver/configure	2016-01-08 19:16:02.667736318 +0100
2116e53
@@ -7311,6 +7311,64 @@
872aab0
    fi
872aab0
 fi
872aab0
 
872aab0
+for ac_header in selinux/selinux.h
872aab0
+do :
872aab0
+  ac_fn_c_check_header_mongrel "$LINENO" "selinux/selinux.h" "ac_cv_header_selinux_selinux_h" "$ac_includes_default"
872aab0
+if test "x$ac_cv_header_selinux_selinux_h" = x""yes; then :
872aab0
+  cat >>confdefs.h <<_ACEOF
872aab0
+#define HAVE_SELINUX_SELINUX_H 1
872aab0
+_ACEOF
872aab0
+
872aab0
+fi
872aab0
+
872aab0
+done
872aab0
+
872aab0
+{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for security_get_boolean_active in -lselinux" >&5
872aab0
+$as_echo_n "checking for security_get_boolean_active in -lselinux... " >&6; }
872aab0
+if test "${ac_cv_lib_selinux_security_get_boolean_active+set}" = set; then :
872aab0
+  $as_echo_n "(cached) " >&6
872aab0
+else
872aab0
+  ac_check_lib_save_LIBS=$LIBS
872aab0
+LIBS="-lselinux  $LIBS"
872aab0
+cat confdefs.h - <<_ACEOF >conftest.$ac_ext
872aab0
+/* end confdefs.h.  */
872aab0
+
872aab0
+/* Override any GCC internal prototype to avoid an error.
872aab0
+   Use char because int might match the return type of a GCC
872aab0
+   builtin and then its argument prototype would still apply.  */
872aab0
+#ifdef __cplusplus
872aab0
+extern "C"
872aab0
+#endif
872aab0
+char security_get_boolean_active ();
872aab0
+int
872aab0
+main ()
872aab0
+{
872aab0
+return security_get_boolean_active ();
872aab0
+  ;
872aab0
+  return 0;
872aab0
+}
872aab0
+_ACEOF
872aab0
+if ac_fn_c_try_link "$LINENO"; then :
872aab0
+  ac_cv_lib_selinux_security_get_boolean_active=yes
872aab0
+else
872aab0
+  ac_cv_lib_selinux_security_get_boolean_active=no
872aab0
+fi
872aab0
+rm -f core conftest.err conftest.$ac_objext \
872aab0
+    conftest$ac_exeext conftest.$ac_ext
872aab0
+LIBS=$ac_check_lib_save_LIBS
872aab0
+fi
872aab0
+{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_lib_selinux_security_get_boolean_active" >&5
872aab0
+$as_echo "$ac_cv_lib_selinux_security_get_boolean_active" >&6; }
872aab0
+if test "x$ac_cv_lib_selinux_security_get_boolean_active" = x""yes; then :
872aab0
+  cat >>confdefs.h <<_ACEOF
872aab0
+#define HAVE_LIBSELINUX 1
872aab0
+_ACEOF
872aab0
+
872aab0
+  LIBS="-lselinux $LIBS"
872aab0
+
872aab0
+fi
872aab0
+
872aab0
+
872aab0
 
872aab0
 
872aab0