Blame SOURCES/gdb-attach-fail-reasons-5of5.patch

e1d87d
http://sourceware.org/ml/gdb-patches/2012-03/msg00171.html
e1d87d
Subject: [patch 3/3] attach-fail-reasons: SELinux deny_ptrace
e1d87d
e1d87d
Hi,
e1d87d
e1d87d
and here is the last bit for new SELinux 'deny_ptrace':
e1d87d
	https://bugzilla.redhat.com/show_bug.cgi?id=786878
e1d87d
e1d87d
As even PTRACE_TRACEME fails in such case it needs to install hook for even
e1d87d
that event.
e1d87d
e1d87d
e1d87d
Thanks,
e1d87d
Jan
e1d87d
e1d87d
e1d87d
gdb/
e1d87d
2012-03-06  Jan Kratochvil  <jan.kratochvil@redhat.com>
e1d87d
e1d87d
	* common/linux-ptrace.c [HAVE_SELINUX_SELINUX_H]: include
e1d87d
	selinux/selinux.h.
e1d87d
	(linux_ptrace_attach_warnings): Call linux_ptrace_create_warnings.
e1d87d
	(linux_ptrace_create_warnings): New.
e1d87d
	* common/linux-ptrace.h (linux_ptrace_create_warnings): New declaration.
e1d87d
	* config.in: Regenerate.
e1d87d
	* configure: Regenerate.
e1d87d
	* configure.ac: Check selinux/selinux.h and the selinux library.
e1d87d
	* inf-ptrace.c (inf_ptrace_me): Check the ptrace result.
e1d87d
	* linux-nat.c (linux_nat_create_inferior): New variable ex.  Wrap
e1d87d
	to_create_inferior into TRY_CATCH, call linux_ptrace_create_warnings.
e1d87d
e1d87d
gdb/gdbserver/
e1d87d
	* config.in: Regenerate.
e1d87d
	* configure: Regenerate.
e1d87d
	* configure.ac: Check selinux/selinux.h and the selinux library.
e1d87d
	* linux-low.c (linux_traceme): New function.
e1d87d
	(linux_create_inferior, linux_tracefork_child): Call it instead of
e1d87d
	direct ptrace.
e1d87d
e1d87d
Index: gdb-7.12.50.20170226/gdb/nat/linux-ptrace.c
e1d87d
===================================================================
e1d87d
--- gdb-7.12.50.20170226.orig/gdb/nat/linux-ptrace.c	2017-02-26 21:27:14.780009449 +0100
e1d87d
+++ gdb-7.12.50.20170226/gdb/nat/linux-ptrace.c	2017-02-26 21:27:18.838038193 +0100
e1d87d
@@ -27,6 +27,10 @@
e1d87d
 #include <sys/procfs.h>
e1d87d
 #endif
e1d87d
 
e1d87d
+#ifdef HAVE_SELINUX_SELINUX_H
e1d87d
+# include <selinux/selinux.h>
e1d87d
+#endif /* HAVE_SELINUX_SELINUX_H */
e1d87d
+
e1d87d
 /* Stores the ptrace options supported by the running kernel.
e1d87d
    A value of -1 means we did not check for features yet.  A value
e1d87d
    of 0 means there are no supported features.  */
e1d87d
@@ -51,6 +55,8 @@
e1d87d
     buffer_xml_printf (buffer, _("process %d is a zombie "
e1d87d
 				 "- the process has already terminated"),
e1d87d
 		       (int) pid);
e1d87d
+
e1d87d
+  linux_ptrace_create_warnings (buffer);
e1d87d
 }
e1d87d
 
e1d87d
 /* See linux-ptrace.h.  */
e1d87d
@@ -594,6 +600,22 @@
e1d87d
   linux_ptrace_test_ret_to_nx ();
e1d87d
 }
e1d87d
 
e1d87d
+/* Print all possible reasons we could fail to create a traced process.  */
e1d87d
+
e1d87d
+void
e1d87d
+linux_ptrace_create_warnings (struct buffer *buffer)
e1d87d
+{
e1d87d
+#ifdef HAVE_LIBSELINUX
e1d87d
+  /* -1 is returned for errors, 0 if it has no effect, 1 if PTRACE_ATTACH is
e1d87d
+     forbidden.  */
e1d87d
+  if (security_get_boolean_active ("deny_ptrace") == 1)
e1d87d
+    buffer_xml_printf (buffer,
e1d87d
+		       _("the SELinux boolean 'deny_ptrace' is enabled, "
e1d87d
+			 "you can disable this process attach protection by: "
e1d87d
+			 "(gdb) shell sudo setsebool deny_ptrace=0"));
e1d87d
+#endif /* HAVE_LIBSELINUX */
e1d87d
+}
e1d87d
+
e1d87d
 /* Extract extended ptrace event from wait status.  */
e1d87d
 
e1d87d
 int
e1d87d
Index: gdb-7.12.50.20170226/gdb/nat/linux-ptrace.h
e1d87d
===================================================================
e1d87d
--- gdb-7.12.50.20170226.orig/gdb/nat/linux-ptrace.h	2017-02-26 21:27:14.780009449 +0100
e1d87d
+++ gdb-7.12.50.20170226/gdb/nat/linux-ptrace.h	2017-02-26 21:27:18.838038193 +0100
e1d87d
@@ -185,6 +185,7 @@
e1d87d
 extern char *linux_ptrace_attach_fail_reason_string (ptid_t ptid, int err);
e1d87d
 
e1d87d
 extern void linux_ptrace_init_warnings (void);
e1d87d
+extern void linux_ptrace_create_warnings (struct buffer *buffer);
e1d87d
 extern void linux_check_ptrace_features (void);
e1d87d
 extern void linux_enable_event_reporting (pid_t pid, int attached);
e1d87d
 extern void linux_disable_event_reporting (pid_t pid);
e1d87d
Index: gdb-7.12.50.20170226/gdb/configure.ac
e1d87d
===================================================================
e1d87d
--- gdb-7.12.50.20170226.orig/gdb/configure.ac	2017-02-26 21:27:14.781009456 +0100
e1d87d
+++ gdb-7.12.50.20170226/gdb/configure.ac	2017-02-26 21:27:18.839038200 +0100
e1d87d
@@ -2092,6 +2092,10 @@
e1d87d
 esac
e1d87d
 AC_DEFINE_UNQUOTED(GDBINIT,"$gdbinit",[The .gdbinit filename.])
e1d87d
 
e1d87d
+dnl Check security_get_boolean_active availability.
e1d87d
+AC_CHECK_HEADERS(selinux/selinux.h)
e1d87d
+AC_CHECK_LIB(selinux, security_get_boolean_active)
e1d87d
+
e1d87d
 dnl Handle optional features that can be enabled.
e1d87d
 
e1d87d
 # Support for --with-sysroot is a copy of GDB_AC_WITH_DIR,
e1d87d
Index: gdb-7.12.50.20170226/gdb/gdbserver/configure.ac
e1d87d
===================================================================
e1d87d
--- gdb-7.12.50.20170226.orig/gdb/gdbserver/configure.ac	2017-02-26 21:27:14.781009456 +0100
e1d87d
+++ gdb-7.12.50.20170226/gdb/gdbserver/configure.ac	2017-02-26 21:27:18.839038200 +0100
e1d87d
@@ -469,6 +469,10 @@
e1d87d
    fi
e1d87d
 fi
e1d87d
 
e1d87d
+dnl Check security_get_boolean_active availability.
e1d87d
+AC_CHECK_HEADERS(selinux/selinux.h)
e1d87d
+AC_CHECK_LIB(selinux, security_get_boolean_active)
e1d87d
+
e1d87d
 AC_SUBST(GDBSERVER_DEPFILES)
e1d87d
 AC_SUBST(GDBSERVER_LIBS)
e1d87d
 AC_SUBST(srv_xmlbuiltin)
e1d87d
Index: gdb-7.12.50.20170226/gdb/gdbserver/linux-low.c
e1d87d
===================================================================
e1d87d
--- gdb-7.12.50.20170226.orig/gdb/gdbserver/linux-low.c	2017-02-26 21:27:14.783009470 +0100
e1d87d
+++ gdb-7.12.50.20170226/gdb/gdbserver/linux-low.c	2017-02-26 21:27:18.841038214 +0100
e1d87d
@@ -946,6 +946,29 @@
e1d87d
   return lwp;
e1d87d
 }
e1d87d
 
e1d87d
+/* Execute PTRACE_TRACEME with error checking.  */
e1d87d
+
e1d87d
+static void
e1d87d
+linux_traceme (const char *program)
e1d87d
+{
e1d87d
+  int save_errno;
e1d87d
+  struct buffer buffer;
e1d87d
+
e1d87d
+  errno = 0;
e1d87d
+  if (ptrace (PTRACE_TRACEME, 0,
e1d87d
+	      (PTRACE_TYPE_ARG3) 0, (PTRACE_TYPE_ARG4) 0) == 0)
e1d87d
+    return;
e1d87d
+
e1d87d
+  save_errno = errno;
e1d87d
+  buffer_init (&buffer);
e1d87d
+  linux_ptrace_create_warnings (&buffer);
e1d87d
+  buffer_grow_str0 (&buffer, "");
e1d87d
+  fprintf (stderr, _("%sCannot trace created process %s: %s.\n"),
e1d87d
+	   buffer_finish (&buffer), program, strerror (save_errno));
e1d87d
+  fflush (stderr);
e1d87d
+  _exit (0177);
e1d87d
+}
e1d87d
+
e1d87d
 /* Start an inferior process and returns its pid.
e1d87d
    ALLARGS is a vector of program-name and args. */
e1d87d
 
e1d87d
@@ -969,7 +992,7 @@
e1d87d
   if (pid == 0)
e1d87d
     {
e1d87d
       close_most_fds ();
e1d87d
-      ptrace (PTRACE_TRACEME, 0, (PTRACE_TYPE_ARG3) 0, (PTRACE_TYPE_ARG4) 0);
e1d87d
+      linux_traceme (program);
e1d87d
 
e1d87d
       setpgid (0, 0);
e1d87d
 
e1d87d
Index: gdb-7.12.50.20170226/gdb/linux-nat.c
e1d87d
===================================================================
e1d87d
--- gdb-7.12.50.20170226.orig/gdb/linux-nat.c	2017-02-26 21:27:14.785009484 +0100
e1d87d
+++ gdb-7.12.50.20170226/gdb/linux-nat.c	2017-02-26 21:27:18.842038221 +0100
e1d87d
@@ -1110,6 +1110,7 @@
e1d87d
 {
e1d87d
   struct cleanup *restore_personality
e1d87d
     = maybe_disable_address_space_randomization (disable_randomization);
e1d87d
+  volatile struct gdb_exception ex;
e1d87d
 
e1d87d
   /* The fork_child mechanism is synchronous and calls target_wait, so
e1d87d
      we have to mask the async mode.  */
e1d87d
@@ -1117,7 +1118,28 @@
e1d87d
   /* Make sure we report all signals during startup.  */
e1d87d
   linux_nat_pass_signals (ops, 0, NULL);
e1d87d
 
e1d87d
-  linux_ops->to_create_inferior (ops, exec_file, allargs, env, from_tty);
e1d87d
+  TRY
e1d87d
+    {
e1d87d
+      linux_ops->to_create_inferior (ops, exec_file, allargs, env, from_tty);
e1d87d
+    }
e1d87d
+  CATCH (ex, RETURN_MASK_ERROR)
e1d87d
+    {
e1d87d
+      struct buffer buffer;
e1d87d
+      char *message, *buffer_s;
e1d87d
+
e1d87d
+      message = xstrdup (ex.message);
e1d87d
+      make_cleanup (xfree, message);
e1d87d
+
e1d87d
+      buffer_init (&buffer);
e1d87d
+      linux_ptrace_create_warnings (&buffer);
e1d87d
+
e1d87d
+      buffer_grow_str0 (&buffer, "");
e1d87d
+      buffer_s = buffer_finish (&buffer);
e1d87d
+      make_cleanup (xfree, buffer_s);
e1d87d
+
e1d87d
+      throw_error (ex.error, "%s%s", buffer_s, message);
e1d87d
+    }
e1d87d
+  END_CATCH
e1d87d
 
e1d87d
   do_cleanups (restore_personality);
e1d87d
 }
e1d87d
Index: gdb-7.12.50.20170226/gdb/config.in
e1d87d
===================================================================
e1d87d
--- gdb-7.12.50.20170226.orig/gdb/config.in	2017-02-26 21:27:14.786009491 +0100
e1d87d
+++ gdb-7.12.50.20170226/gdb/config.in	2017-02-26 21:27:18.842038221 +0100
e1d87d
@@ -270,6 +270,9 @@
e1d87d
 /* Define if librpm library is being used. */
e1d87d
 #undef HAVE_LIBRPM
e1d87d
 
e1d87d
+/* Define to 1 if you have the `selinux' library (-lselinux). */
e1d87d
+#undef HAVE_LIBSELINUX
e1d87d
+
e1d87d
 /* Define to 1 if you have the <libunwind-ia64.h> header file. */
e1d87d
 #undef HAVE_LIBUNWIND_IA64_H
e1d87d
 
e1d87d
@@ -402,6 +405,9 @@
e1d87d
 /* Define to 1 if you have the `scm_new_smob' function. */
e1d87d
 #undef HAVE_SCM_NEW_SMOB
e1d87d
 
e1d87d
+/* Define to 1 if you have the <selinux/selinux.h> header file. */
e1d87d
+#undef HAVE_SELINUX_SELINUX_H
e1d87d
+
e1d87d
 /* Define to 1 if you have the `setlocale' function. */
e1d87d
 #undef HAVE_SETLOCALE
e1d87d
 
e1d87d
Index: gdb-7.12.50.20170226/gdb/configure
e1d87d
===================================================================
e1d87d
--- gdb-7.12.50.20170226.orig/gdb/configure	2017-02-26 21:27:14.790009519 +0100
e1d87d
+++ gdb-7.12.50.20170226/gdb/configure	2017-02-26 21:27:18.846038249 +0100
e1d87d
@@ -15492,6 +15492,64 @@
e1d87d
 _ACEOF
e1d87d
 
e1d87d
 
e1d87d
+for ac_header in selinux/selinux.h
e1d87d
+do :
e1d87d
+  ac_fn_c_check_header_mongrel "$LINENO" "selinux/selinux.h" "ac_cv_header_selinux_selinux_h" "$ac_includes_default"
e1d87d
+if test "x$ac_cv_header_selinux_selinux_h" = x""yes; then :
e1d87d
+  cat >>confdefs.h <<_ACEOF
e1d87d
+#define HAVE_SELINUX_SELINUX_H 1
e1d87d
+_ACEOF
e1d87d
+
e1d87d
+fi
e1d87d
+
e1d87d
+done
e1d87d
+
e1d87d
+{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for security_get_boolean_active in -lselinux" >&5
e1d87d
+$as_echo_n "checking for security_get_boolean_active in -lselinux... " >&6; }
e1d87d
+if test "${ac_cv_lib_selinux_security_get_boolean_active+set}" = set; then :
e1d87d
+  $as_echo_n "(cached) " >&6
e1d87d
+else
e1d87d
+  ac_check_lib_save_LIBS=$LIBS
e1d87d
+LIBS="-lselinux  $LIBS"
e1d87d
+cat confdefs.h - <<_ACEOF >conftest.$ac_ext
e1d87d
+/* end confdefs.h.  */
e1d87d
+
e1d87d
+/* Override any GCC internal prototype to avoid an error.
e1d87d
+   Use char because int might match the return type of a GCC
e1d87d
+   builtin and then its argument prototype would still apply.  */
e1d87d
+#ifdef __cplusplus
e1d87d
+extern "C"
e1d87d
+#endif
e1d87d
+char security_get_boolean_active ();
e1d87d
+int
e1d87d
+main ()
e1d87d
+{
e1d87d
+return security_get_boolean_active ();
e1d87d
+  ;
e1d87d
+  return 0;
e1d87d
+}
e1d87d
+_ACEOF
e1d87d
+if ac_fn_c_try_link "$LINENO"; then :
e1d87d
+  ac_cv_lib_selinux_security_get_boolean_active=yes
e1d87d
+else
e1d87d
+  ac_cv_lib_selinux_security_get_boolean_active=no
e1d87d
+fi
e1d87d
+rm -f core conftest.err conftest.$ac_objext \
e1d87d
+    conftest$ac_exeext conftest.$ac_ext
e1d87d
+LIBS=$ac_check_lib_save_LIBS
e1d87d
+fi
e1d87d
+{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_lib_selinux_security_get_boolean_active" >&5
e1d87d
+$as_echo "$ac_cv_lib_selinux_security_get_boolean_active" >&6; }
e1d87d
+if test "x$ac_cv_lib_selinux_security_get_boolean_active" = x""yes; then :
e1d87d
+  cat >>confdefs.h <<_ACEOF
e1d87d
+#define HAVE_LIBSELINUX 1
e1d87d
+_ACEOF
e1d87d
+
e1d87d
+  LIBS="-lselinux $LIBS"
e1d87d
+
e1d87d
+fi
e1d87d
+
e1d87d
+
e1d87d
 
e1d87d
 # Support for --with-sysroot is a copy of GDB_AC_WITH_DIR,
e1d87d
 # except that the argument to --with-sysroot is optional.
e1d87d
Index: gdb-7.12.50.20170226/gdb/gdbserver/config.in
e1d87d
===================================================================
e1d87d
--- gdb-7.12.50.20170226.orig/gdb/gdbserver/config.in	2017-02-26 21:27:14.791009527 +0100
e1d87d
+++ gdb-7.12.50.20170226/gdb/gdbserver/config.in	2017-02-26 21:27:18.846038249 +0100
e1d87d
@@ -123,6 +123,9 @@
e1d87d
 /* Define to 1 if you have the `mcheck' library (-lmcheck). */
e1d87d
 #undef HAVE_LIBMCHECK
e1d87d
 
e1d87d
+/* Define to 1 if you have the `selinux' library (-lselinux). */
e1d87d
+#undef HAVE_LIBSELINUX
e1d87d
+
e1d87d
 /* Define if the target supports branch tracing. */
e1d87d
 #undef HAVE_LINUX_BTRACE
e1d87d
 
e1d87d
@@ -199,6 +202,9 @@
e1d87d
 /* Define to 1 if you have the `pwrite' function. */
e1d87d
 #undef HAVE_PWRITE
e1d87d
 
e1d87d
+/* Define to 1 if you have the <selinux/selinux.h> header file. */
e1d87d
+#undef HAVE_SELINUX_SELINUX_H
e1d87d
+
e1d87d
 /* Define to 1 if you have the `setns' function. */
e1d87d
 #undef HAVE_SETNS
e1d87d
 
e1d87d
Index: gdb-7.12.50.20170226/gdb/gdbserver/configure
e1d87d
===================================================================
e1d87d
--- gdb-7.12.50.20170226.orig/gdb/gdbserver/configure	2017-02-26 21:27:14.793009541 +0100
e1d87d
+++ gdb-7.12.50.20170226/gdb/gdbserver/configure	2017-02-26 21:27:18.848038263 +0100
e1d87d
@@ -8429,6 +8429,64 @@
e1d87d
    fi
e1d87d
 fi
e1d87d
 
e1d87d
+for ac_header in selinux/selinux.h
e1d87d
+do :
e1d87d
+  ac_fn_c_check_header_mongrel "$LINENO" "selinux/selinux.h" "ac_cv_header_selinux_selinux_h" "$ac_includes_default"
e1d87d
+if test "x$ac_cv_header_selinux_selinux_h" = x""yes; then :
e1d87d
+  cat >>confdefs.h <<_ACEOF
e1d87d
+#define HAVE_SELINUX_SELINUX_H 1
e1d87d
+_ACEOF
e1d87d
+
e1d87d
+fi
e1d87d
+
e1d87d
+done
e1d87d
+
e1d87d
+{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for security_get_boolean_active in -lselinux" >&5
e1d87d
+$as_echo_n "checking for security_get_boolean_active in -lselinux... " >&6; }
e1d87d
+if test "${ac_cv_lib_selinux_security_get_boolean_active+set}" = set; then :
e1d87d
+  $as_echo_n "(cached) " >&6
e1d87d
+else
e1d87d
+  ac_check_lib_save_LIBS=$LIBS
e1d87d
+LIBS="-lselinux  $LIBS"
e1d87d
+cat confdefs.h - <<_ACEOF >conftest.$ac_ext
e1d87d
+/* end confdefs.h.  */
e1d87d
+
e1d87d
+/* Override any GCC internal prototype to avoid an error.
e1d87d
+   Use char because int might match the return type of a GCC
e1d87d
+   builtin and then its argument prototype would still apply.  */
e1d87d
+#ifdef __cplusplus
e1d87d
+extern "C"
e1d87d
+#endif
e1d87d
+char security_get_boolean_active ();
e1d87d
+int
e1d87d
+main ()
e1d87d
+{
e1d87d
+return security_get_boolean_active ();
e1d87d
+  ;
e1d87d
+  return 0;
e1d87d
+}
e1d87d
+_ACEOF
e1d87d
+if ac_fn_c_try_link "$LINENO"; then :
e1d87d
+  ac_cv_lib_selinux_security_get_boolean_active=yes
e1d87d
+else
e1d87d
+  ac_cv_lib_selinux_security_get_boolean_active=no
e1d87d
+fi
e1d87d
+rm -f core conftest.err conftest.$ac_objext \
e1d87d
+    conftest$ac_exeext conftest.$ac_ext
e1d87d
+LIBS=$ac_check_lib_save_LIBS
e1d87d
+fi
e1d87d
+{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_lib_selinux_security_get_boolean_active" >&5
e1d87d
+$as_echo "$ac_cv_lib_selinux_security_get_boolean_active" >&6; }
e1d87d
+if test "x$ac_cv_lib_selinux_security_get_boolean_active" = x""yes; then :
e1d87d
+  cat >>confdefs.h <<_ACEOF
e1d87d
+#define HAVE_LIBSELINUX 1
e1d87d
+_ACEOF
e1d87d
+
e1d87d
+  LIBS="-lselinux $LIBS"
e1d87d
+
e1d87d
+fi
e1d87d
+
e1d87d
+
e1d87d
 
e1d87d
 
e1d87d