diff -Naurp insight-8.1.50.20180216.orig/gdb/config.in insight-8.1.50.20180216.new/gdb/config.in
--- insight-8.1.50.20180216.orig/gdb/config.in 2018-02-18 00:23:36.501301300 +0100
+++ insight-8.1.50.20180216.new/gdb/config.in 2018-02-18 00:24:24.300777804 +0100
@@ -276,6 +276,9 @@
/* Define if librpm library is being used. */
#undef HAVE_LIBRPM
+/* Define to 1 if you have the `selinux' library (-lselinux). */
+#undef HAVE_LIBSELINUX
+
/* Define to 1 if you have the <libunwind-ia64.h> header file. */
#undef HAVE_LIBUNWIND_IA64_H
@@ -399,6 +402,9 @@
/* Define to 1 if you have the `scm_new_smob' function. */
#undef HAVE_SCM_NEW_SMOB
+/* Define to 1 if you have the <selinux/selinux.h> header file. */
+#undef HAVE_SELINUX_SELINUX_H
+
/* Define to 1 if you have the `setlocale' function. */
#undef HAVE_SETLOCALE
diff -Naurp insight-8.1.50.20180216.orig/gdb/configure insight-8.1.50.20180216.new/gdb/configure
--- insight-8.1.50.20180216.orig/gdb/configure 2018-02-18 00:23:36.502301310 +0100
+++ insight-8.1.50.20180216.new/gdb/configure 2018-02-18 00:24:24.301777814 +0100
@@ -15839,6 +15839,64 @@ cat >>confdefs.h <<_ACEOF
_ACEOF
+for ac_header in selinux/selinux.h
+do :
+ ac_fn_c_check_header_mongrel "$LINENO" "selinux/selinux.h" "ac_cv_header_selinux_selinux_h" "$ac_includes_default"
+if test "x$ac_cv_header_selinux_selinux_h" = x""yes; then :
+ cat >>confdefs.h <<_ACEOF
+#define HAVE_SELINUX_SELINUX_H 1
+_ACEOF
+
+fi
+
+done
+
+{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for security_get_boolean_active in -lselinux" >&5
+$as_echo_n "checking for security_get_boolean_active in -lselinux... " >&6; }
+if test "${ac_cv_lib_selinux_security_get_boolean_active+set}" = set; then :
+ $as_echo_n "(cached) " >&6
+else
+ ac_check_lib_save_LIBS=$LIBS
+LIBS="-lselinux $LIBS"
+cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+/* end confdefs.h. */
+
+/* Override any GCC internal prototype to avoid an error.
+ Use char because int might match the return type of a GCC
+ builtin and then its argument prototype would still apply. */
+#ifdef __cplusplus
+extern "C"
+#endif
+char security_get_boolean_active ();
+int
+main ()
+{
+return security_get_boolean_active ();
+ ;
+ return 0;
+}
+_ACEOF
+if ac_fn_c_try_link "$LINENO"; then :
+ ac_cv_lib_selinux_security_get_boolean_active=yes
+else
+ ac_cv_lib_selinux_security_get_boolean_active=no
+fi
+rm -f core conftest.err conftest.$ac_objext \
+ conftest$ac_exeext conftest.$ac_ext
+LIBS=$ac_check_lib_save_LIBS
+fi
+{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_lib_selinux_security_get_boolean_active" >&5
+$as_echo "$ac_cv_lib_selinux_security_get_boolean_active" >&6; }
+if test "x$ac_cv_lib_selinux_security_get_boolean_active" = x""yes; then :
+ cat >>confdefs.h <<_ACEOF
+#define HAVE_LIBSELINUX 1
+_ACEOF
+
+ LIBS="-lselinux $LIBS"
+
+fi
+
+
# Support for --with-sysroot is a copy of GDB_AC_WITH_DIR,
# except that the argument to --with-sysroot is optional.
diff -Naurp insight-8.1.50.20180216.orig/gdb/configure.ac insight-8.1.50.20180216.new/gdb/configure.ac
--- insight-8.1.50.20180216.orig/gdb/configure.ac 2018-02-18 00:23:36.503301320 +0100
+++ insight-8.1.50.20180216.new/gdb/configure.ac 2018-02-18 00:24:24.301777814 +0100
@@ -2051,6 +2051,10 @@ case $host_os in
esac
AC_DEFINE_UNQUOTED(GDBINIT,"$gdbinit",[The .gdbinit filename.])
+dnl Check security_get_boolean_active availability.
+AC_CHECK_HEADERS(selinux/selinux.h)
+AC_CHECK_LIB(selinux, security_get_boolean_active)
+
dnl Handle optional features that can be enabled.
# Support for --with-sysroot is a copy of GDB_AC_WITH_DIR,
diff -Naurp insight-8.1.50.20180216.orig/gdb/gdbserver/config.in insight-8.1.50.20180216.new/gdb/gdbserver/config.in
--- insight-8.1.50.20180216.orig/gdb/gdbserver/config.in 2017-12-01 03:42:32.000000000 +0100
+++ insight-8.1.50.20180216.new/gdb/gdbserver/config.in 2018-02-18 00:24:24.301777814 +0100
@@ -126,6 +126,9 @@
/* Define to 1 if you have the `mcheck' library (-lmcheck). */
#undef HAVE_LIBMCHECK
+/* Define to 1 if you have the `selinux' library (-lselinux). */
+#undef HAVE_LIBSELINUX
+
/* Define if the target supports branch tracing. */
#undef HAVE_LINUX_BTRACE
@@ -202,6 +205,9 @@
/* Define to 1 if you have the `pwrite' function. */
#undef HAVE_PWRITE
+/* Define to 1 if you have the <selinux/selinux.h> header file. */
+#undef HAVE_SELINUX_SELINUX_H
+
/* Define to 1 if you have the `setns' function. */
#undef HAVE_SETNS
diff -Naurp insight-8.1.50.20180216.orig/gdb/gdbserver/configure insight-8.1.50.20180216.new/gdb/gdbserver/configure
--- insight-8.1.50.20180216.orig/gdb/gdbserver/configure 2018-01-18 19:51:21.000000000 +0100
+++ insight-8.1.50.20180216.new/gdb/gdbserver/configure 2018-02-18 00:24:24.302777824 +0100
@@ -8455,6 +8455,64 @@ if $want_ipa ; then
fi
fi
+for ac_header in selinux/selinux.h
+do :
+ ac_fn_c_check_header_mongrel "$LINENO" "selinux/selinux.h" "ac_cv_header_selinux_selinux_h" "$ac_includes_default"
+if test "x$ac_cv_header_selinux_selinux_h" = x""yes; then :
+ cat >>confdefs.h <<_ACEOF
+#define HAVE_SELINUX_SELINUX_H 1
+_ACEOF
+
+fi
+
+done
+
+{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for security_get_boolean_active in -lselinux" >&5
+$as_echo_n "checking for security_get_boolean_active in -lselinux... " >&6; }
+if test "${ac_cv_lib_selinux_security_get_boolean_active+set}" = set; then :
+ $as_echo_n "(cached) " >&6
+else
+ ac_check_lib_save_LIBS=$LIBS
+LIBS="-lselinux $LIBS"
+cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+/* end confdefs.h. */
+
+/* Override any GCC internal prototype to avoid an error.
+ Use char because int might match the return type of a GCC
+ builtin and then its argument prototype would still apply. */
+#ifdef __cplusplus
+extern "C"
+#endif
+char security_get_boolean_active ();
+int
+main ()
+{
+return security_get_boolean_active ();
+ ;
+ return 0;
+}
+_ACEOF
+if ac_fn_c_try_link "$LINENO"; then :
+ ac_cv_lib_selinux_security_get_boolean_active=yes
+else
+ ac_cv_lib_selinux_security_get_boolean_active=no
+fi
+rm -f core conftest.err conftest.$ac_objext \
+ conftest$ac_exeext conftest.$ac_ext
+LIBS=$ac_check_lib_save_LIBS
+fi
+{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_lib_selinux_security_get_boolean_active" >&5
+$as_echo "$ac_cv_lib_selinux_security_get_boolean_active" >&6; }
+if test "x$ac_cv_lib_selinux_security_get_boolean_active" = x""yes; then :
+ cat >>confdefs.h <<_ACEOF
+#define HAVE_LIBSELINUX 1
+_ACEOF
+
+ LIBS="-lselinux $LIBS"
+
+fi
+
+
diff -Naurp insight-8.1.50.20180216.orig/gdb/gdbserver/configure.ac insight-8.1.50.20180216.new/gdb/gdbserver/configure.ac
--- insight-8.1.50.20180216.orig/gdb/gdbserver/configure.ac 2018-01-18 19:51:21.000000000 +0100
+++ insight-8.1.50.20180216.new/gdb/gdbserver/configure.ac 2018-02-18 00:24:24.302777824 +0100
@@ -488,6 +488,10 @@ if $want_ipa ; then
fi
fi
+dnl Check security_get_boolean_active availability.
+AC_CHECK_HEADERS(selinux/selinux.h)
+AC_CHECK_LIB(selinux, security_get_boolean_active)
+
AC_SUBST(GDBSERVER_DEPFILES)
AC_SUBST(GDBSERVER_LIBS)
AC_SUBST(srv_xmlbuiltin)
diff -Naurp insight-8.1.50.20180216.orig/gdb/gdbserver/linux-low.c insight-8.1.50.20180216.new/gdb/gdbserver/linux-low.c
--- insight-8.1.50.20180216.orig/gdb/gdbserver/linux-low.c 2018-02-09 15:06:40.000000000 +0100
+++ insight-8.1.50.20180216.new/gdb/gdbserver/linux-low.c 2018-02-18 00:48:47.812203733 +0100
@@ -966,7 +966,16 @@ linux_ptrace_fun ()
{
if (ptrace (PTRACE_TRACEME, 0, (PTRACE_TYPE_ARG3) 0,
(PTRACE_TYPE_ARG4) 0) < 0)
- trace_start_error_with_name ("ptrace");
+ {
+ int save_errno = errno;
+ std::string msg;
+
+ linux_ptrace_create_warnings (msg);
+ string_appendf (msg, _("Cannot trace created process"));
+
+ errno = save_errno;
+ trace_start_error_with_name (msg.c_str ());
+ }
if (setpgid (0, 0) < 0)
trace_start_error_with_name ("setpgid");
diff -Naurp insight-8.1.50.20180216.orig/gdb/linux-nat.c insight-8.1.50.20180216.new/gdb/linux-nat.c
--- insight-8.1.50.20180216.orig/gdb/linux-nat.c 2018-02-16 15:40:15.000000000 +0100
+++ insight-8.1.50.20180216.new/gdb/linux-nat.c 2018-02-18 00:44:21.230638846 +0100
@@ -1127,7 +1127,24 @@ linux_nat_create_inferior (struct target
/* Make sure we report all signals during startup. */
linux_nat_pass_signals (ops, 0, NULL);
- linux_ops->to_create_inferior (ops, exec_file, allargs, env, from_tty);
+ volatile struct gdb_exception ex;
+ TRY
+ {
+ linux_ops->to_create_inferior (ops, exec_file, allargs, env, from_tty);
+ }
+ CATCH (ex, RETURN_MASK_ERROR)
+ {
+ std::string buffer;
+ char *message;
+
+ message = xstrdup (ex.message);
+ make_cleanup (xfree, message);
+
+ linux_ptrace_create_warnings (buffer);
+
+ throw_error (ex.error, "%s%s", buffer.c_str (), message);
+ }
+ END_CATCH
}
/* Callback for linux_proc_attach_tgid_threads. Attach to PTID if not
diff -Naurp insight-8.1.50.20180216.orig/gdb/nat/linux-ptrace.c insight-8.1.50.20180216.new/gdb/nat/linux-ptrace.c
--- insight-8.1.50.20180216.orig/gdb/nat/linux-ptrace.c 2018-01-26 13:46:47.000000000 +0100
+++ insight-8.1.50.20180216.new/gdb/nat/linux-ptrace.c 2018-02-18 00:53:26.676891379 +0100
@@ -25,6 +25,10 @@
#include <sys/procfs.h>
#endif
+#ifdef HAVE_SELINUX_SELINUX_H
+# include <selinux/selinux.h>
+#endif /* HAVE_SELINUX_SELINUX_H */
+
/* Stores the ptrace options supported by the running kernel.
A value of -1 means we did not check for features yet. A value
of 0 means there are no supported features. */
@@ -50,6 +54,8 @@ linux_ptrace_attach_fail_reason (pid_t p
"terminated"),
(int) pid);
+ linux_ptrace_create_warnings (result);
+
return result;
}
@@ -583,6 +589,22 @@ linux_ptrace_init_warnings (void)
linux_ptrace_test_ret_to_nx ();
}
+/* Print all possible reasons we could fail to create a traced process. */
+
+void
+linux_ptrace_create_warnings (std::string& buffer)
+{
+#ifdef HAVE_LIBSELINUX
+ /* -1 is returned for errors, 0 if it has no effect, 1 if PTRACE_ATTACH is
+ forbidden. */
+ if (security_get_boolean_active ("deny_ptrace") == 1)
+ string_appendf (buffer,
+ _("the SELinux boolean 'deny_ptrace' is enabled, "
+ "you can disable this process attach protection by: "
+ "(gdb) shell sudo setsebool deny_ptrace=0"));
+#endif /* HAVE_LIBSELINUX */
+}
+
/* Extract extended ptrace event from wait status. */
int
diff -Naurp insight-8.1.50.20180216.orig/gdb/nat/linux-ptrace.h insight-8.1.50.20180216.new/gdb/nat/linux-ptrace.h
--- insight-8.1.50.20180216.orig/gdb/nat/linux-ptrace.h 2018-01-26 13:46:47.000000000 +0100
+++ insight-8.1.50.20180216.new/gdb/nat/linux-ptrace.h 2018-02-18 00:39:10.140655746 +0100
@@ -189,6 +189,7 @@ extern std::string linux_ptrace_attach_f
extern std::string linux_ptrace_attach_fail_reason_string (ptid_t ptid, int err);
extern void linux_ptrace_init_warnings (void);
+extern void linux_ptrace_create_warnings (std::string& buffer);
extern void linux_check_ptrace_features (void);
extern void linux_enable_event_reporting (pid_t pid, int attached);
extern void linux_disable_event_reporting (pid_t pid);