![]() |
|
|||
0001 /* SPDX-License-Identifier: GPL-2.0 */ 0002 #ifndef _LINUX_PTRACE_H 0003 #define _LINUX_PTRACE_H 0004 0005 #include <linux/compiler.h> /* For unlikely. */ 0006 #include <linux/sched.h> /* For struct task_struct. */ 0007 #include <linux/sched/signal.h> /* For send_sig(), same_thread_group(), etc. */ 0008 #include <linux/err.h> /* for IS_ERR_VALUE */ 0009 #include <linux/bug.h> /* For BUG_ON. */ 0010 #include <linux/pid_namespace.h> /* For task_active_pid_ns. */ 0011 #include <uapi/linux/ptrace.h> 0012 #include <linux/seccomp.h> 0013 0014 /* Add sp to seccomp_data, as seccomp is user API, we don't want to modify it */ 0015 struct syscall_info { 0016 __u64 sp; 0017 struct seccomp_data data; 0018 }; 0019 0020 extern int ptrace_access_vm(struct task_struct *tsk, unsigned long addr, 0021 void *buf, int len, unsigned int gup_flags); 0022 0023 /* 0024 * Ptrace flags 0025 * 0026 * The owner ship rules for task->ptrace which holds the ptrace 0027 * flags is simple. When a task is running it owns it's task->ptrace 0028 * flags. When the a task is stopped the ptracer owns task->ptrace. 0029 */ 0030 0031 #define PT_SEIZED 0x00010000 /* SEIZE used, enable new behavior */ 0032 #define PT_PTRACED 0x00000001 0033 0034 #define PT_OPT_FLAG_SHIFT 3 0035 /* PT_TRACE_* event enable flags */ 0036 #define PT_EVENT_FLAG(event) (1 << (PT_OPT_FLAG_SHIFT + (event))) 0037 #define PT_TRACESYSGOOD PT_EVENT_FLAG(0) 0038 #define PT_TRACE_FORK PT_EVENT_FLAG(PTRACE_EVENT_FORK) 0039 #define PT_TRACE_VFORK PT_EVENT_FLAG(PTRACE_EVENT_VFORK) 0040 #define PT_TRACE_CLONE PT_EVENT_FLAG(PTRACE_EVENT_CLONE) 0041 #define PT_TRACE_EXEC PT_EVENT_FLAG(PTRACE_EVENT_EXEC) 0042 #define PT_TRACE_VFORK_DONE PT_EVENT_FLAG(PTRACE_EVENT_VFORK_DONE) 0043 #define PT_TRACE_EXIT PT_EVENT_FLAG(PTRACE_EVENT_EXIT) 0044 #define PT_TRACE_SECCOMP PT_EVENT_FLAG(PTRACE_EVENT_SECCOMP) 0045 0046 #define PT_EXITKILL (PTRACE_O_EXITKILL << PT_OPT_FLAG_SHIFT) 0047 #define PT_SUSPEND_SECCOMP (PTRACE_O_SUSPEND_SECCOMP << PT_OPT_FLAG_SHIFT) 0048 0049 extern long arch_ptrace(struct task_struct *child, long request, 0050 unsigned long addr, unsigned long data); 0051 extern int ptrace_readdata(struct task_struct *tsk, unsigned long src, char __user *dst, int len); 0052 extern int ptrace_writedata(struct task_struct *tsk, char __user *src, unsigned long dst, int len); 0053 extern void ptrace_disable(struct task_struct *); 0054 extern int ptrace_request(struct task_struct *child, long request, 0055 unsigned long addr, unsigned long data); 0056 extern int ptrace_notify(int exit_code, unsigned long message); 0057 extern void __ptrace_link(struct task_struct *child, 0058 struct task_struct *new_parent, 0059 const struct cred *ptracer_cred); 0060 extern void __ptrace_unlink(struct task_struct *child); 0061 extern void exit_ptrace(struct task_struct *tracer, struct list_head *dead); 0062 #define PTRACE_MODE_READ 0x01 0063 #define PTRACE_MODE_ATTACH 0x02 0064 #define PTRACE_MODE_NOAUDIT 0x04 0065 #define PTRACE_MODE_FSCREDS 0x08 0066 #define PTRACE_MODE_REALCREDS 0x10 0067 0068 /* shorthands for READ/ATTACH and FSCREDS/REALCREDS combinations */ 0069 #define PTRACE_MODE_READ_FSCREDS (PTRACE_MODE_READ | PTRACE_MODE_FSCREDS) 0070 #define PTRACE_MODE_READ_REALCREDS (PTRACE_MODE_READ | PTRACE_MODE_REALCREDS) 0071 #define PTRACE_MODE_ATTACH_FSCREDS (PTRACE_MODE_ATTACH | PTRACE_MODE_FSCREDS) 0072 #define PTRACE_MODE_ATTACH_REALCREDS (PTRACE_MODE_ATTACH | PTRACE_MODE_REALCREDS) 0073 0074 /** 0075 * ptrace_may_access - check whether the caller is permitted to access 0076 * a target task. 0077 * @task: target task 0078 * @mode: selects type of access and caller credentials 0079 * 0080 * Returns true on success, false on denial. 0081 * 0082 * One of the flags PTRACE_MODE_FSCREDS and PTRACE_MODE_REALCREDS must 0083 * be set in @mode to specify whether the access was requested through 0084 * a filesystem syscall (should use effective capabilities and fsuid 0085 * of the caller) or through an explicit syscall such as 0086 * process_vm_writev or ptrace (and should use the real credentials). 0087 */ 0088 extern bool ptrace_may_access(struct task_struct *task, unsigned int mode); 0089 0090 static inline int ptrace_reparented(struct task_struct *child) 0091 { 0092 return !same_thread_group(child->real_parent, child->parent); 0093 } 0094 0095 static inline void ptrace_unlink(struct task_struct *child) 0096 { 0097 if (unlikely(child->ptrace)) 0098 __ptrace_unlink(child); 0099 } 0100 0101 int generic_ptrace_peekdata(struct task_struct *tsk, unsigned long addr, 0102 unsigned long data); 0103 int generic_ptrace_pokedata(struct task_struct *tsk, unsigned long addr, 0104 unsigned long data); 0105 0106 /** 0107 * ptrace_parent - return the task that is tracing the given task 0108 * @task: task to consider 0109 * 0110 * Returns %NULL if no one is tracing @task, or the &struct task_struct 0111 * pointer to its tracer. 0112 * 0113 * Must called under rcu_read_lock(). The pointer returned might be kept 0114 * live only by RCU. During exec, this may be called with task_lock() held 0115 * on @task, still held from when check_unsafe_exec() was called. 0116 */ 0117 static inline struct task_struct *ptrace_parent(struct task_struct *task) 0118 { 0119 if (unlikely(task->ptrace)) 0120 return rcu_dereference(task->parent); 0121 return NULL; 0122 } 0123 0124 /** 0125 * ptrace_event_enabled - test whether a ptrace event is enabled 0126 * @task: ptracee of interest 0127 * @event: %PTRACE_EVENT_* to test 0128 * 0129 * Test whether @event is enabled for ptracee @task. 0130 * 0131 * Returns %true if @event is enabled, %false otherwise. 0132 */ 0133 static inline bool ptrace_event_enabled(struct task_struct *task, int event) 0134 { 0135 return task->ptrace & PT_EVENT_FLAG(event); 0136 } 0137 0138 /** 0139 * ptrace_event - possibly stop for a ptrace event notification 0140 * @event: %PTRACE_EVENT_* value to report 0141 * @message: value for %PTRACE_GETEVENTMSG to return 0142 * 0143 * Check whether @event is enabled and, if so, report @event and @message 0144 * to the ptrace parent. 0145 * 0146 * Called without locks. 0147 */ 0148 static inline void ptrace_event(int event, unsigned long message) 0149 { 0150 if (unlikely(ptrace_event_enabled(current, event))) { 0151 ptrace_notify((event << 8) | SIGTRAP, message); 0152 } else if (event == PTRACE_EVENT_EXEC) { 0153 /* legacy EXEC report via SIGTRAP */ 0154 if ((current->ptrace & (PT_PTRACED|PT_SEIZED)) == PT_PTRACED) 0155 send_sig(SIGTRAP, current, 0); 0156 } 0157 } 0158 0159 /** 0160 * ptrace_event_pid - possibly stop for a ptrace event notification 0161 * @event: %PTRACE_EVENT_* value to report 0162 * @pid: process identifier for %PTRACE_GETEVENTMSG to return 0163 * 0164 * Check whether @event is enabled and, if so, report @event and @pid 0165 * to the ptrace parent. @pid is reported as the pid_t seen from the 0166 * ptrace parent's pid namespace. 0167 * 0168 * Called without locks. 0169 */ 0170 static inline void ptrace_event_pid(int event, struct pid *pid) 0171 { 0172 /* 0173 * FIXME: There's a potential race if a ptracer in a different pid 0174 * namespace than parent attaches between computing message below and 0175 * when we acquire tasklist_lock in ptrace_stop(). If this happens, 0176 * the ptracer will get a bogus pid from PTRACE_GETEVENTMSG. 0177 */ 0178 unsigned long message = 0; 0179 struct pid_namespace *ns; 0180 0181 rcu_read_lock(); 0182 ns = task_active_pid_ns(rcu_dereference(current->parent)); 0183 if (ns) 0184 message = pid_nr_ns(pid, ns); 0185 rcu_read_unlock(); 0186 0187 ptrace_event(event, message); 0188 } 0189 0190 /** 0191 * ptrace_init_task - initialize ptrace state for a new child 0192 * @child: new child task 0193 * @ptrace: true if child should be ptrace'd by parent's tracer 0194 * 0195 * This is called immediately after adding @child to its parent's children 0196 * list. @ptrace is false in the normal case, and true to ptrace @child. 0197 * 0198 * Called with current's siglock and write_lock_irq(&tasklist_lock) held. 0199 */ 0200 static inline void ptrace_init_task(struct task_struct *child, bool ptrace) 0201 { 0202 INIT_LIST_HEAD(&child->ptrace_entry); 0203 INIT_LIST_HEAD(&child->ptraced); 0204 child->jobctl = 0; 0205 child->ptrace = 0; 0206 child->parent = child->real_parent; 0207 0208 if (unlikely(ptrace) && current->ptrace) { 0209 child->ptrace = current->ptrace; 0210 __ptrace_link(child, current->parent, current->ptracer_cred); 0211 0212 if (child->ptrace & PT_SEIZED) 0213 task_set_jobctl_pending(child, JOBCTL_TRAP_STOP); 0214 else 0215 sigaddset(&child->pending.signal, SIGSTOP); 0216 } 0217 else 0218 child->ptracer_cred = NULL; 0219 } 0220 0221 /** 0222 * ptrace_release_task - final ptrace-related cleanup of a zombie being reaped 0223 * @task: task in %EXIT_DEAD state 0224 * 0225 * Called with write_lock(&tasklist_lock) held. 0226 */ 0227 static inline void ptrace_release_task(struct task_struct *task) 0228 { 0229 BUG_ON(!list_empty(&task->ptraced)); 0230 ptrace_unlink(task); 0231 BUG_ON(!list_empty(&task->ptrace_entry)); 0232 } 0233 0234 #ifndef force_successful_syscall_return 0235 /* 0236 * System call handlers that, upon successful completion, need to return a 0237 * negative value should call force_successful_syscall_return() right before 0238 * returning. On architectures where the syscall convention provides for a 0239 * separate error flag (e.g., alpha, ia64, ppc{,64}, sparc{,64}, possibly 0240 * others), this macro can be used to ensure that the error flag will not get 0241 * set. On architectures which do not support a separate error flag, the macro 0242 * is a no-op and the spurious error condition needs to be filtered out by some 0243 * other means (e.g., in user-level, by passing an extra argument to the 0244 * syscall handler, or something along those lines). 0245 */ 0246 #define force_successful_syscall_return() do { } while (0) 0247 #endif 0248 0249 #ifndef is_syscall_success 0250 /* 0251 * On most systems we can tell if a syscall is a success based on if the retval 0252 * is an error value. On some systems like ia64 and powerpc they have different 0253 * indicators of success/failure and must define their own. 0254 */ 0255 #define is_syscall_success(regs) (!IS_ERR_VALUE((unsigned long)(regs_return_value(regs)))) 0256 #endif 0257 0258 /* 0259 * <asm/ptrace.h> should define the following things inside #ifdef __KERNEL__. 0260 * 0261 * These do-nothing inlines are used when the arch does not 0262 * implement single-step. The kerneldoc comments are here 0263 * to document the interface for all arch definitions. 0264 */ 0265 0266 #ifndef arch_has_single_step 0267 /** 0268 * arch_has_single_step - does this CPU support user-mode single-step? 0269 * 0270 * If this is defined, then there must be function declarations or 0271 * inlines for user_enable_single_step() and user_disable_single_step(). 0272 * arch_has_single_step() should evaluate to nonzero iff the machine 0273 * supports instruction single-step for user mode. 0274 * It can be a constant or it can test a CPU feature bit. 0275 */ 0276 #define arch_has_single_step() (0) 0277 0278 /** 0279 * user_enable_single_step - single-step in user-mode task 0280 * @task: either current or a task stopped in %TASK_TRACED 0281 * 0282 * This can only be called when arch_has_single_step() has returned nonzero. 0283 * Set @task so that when it returns to user mode, it will trap after the 0284 * next single instruction executes. If arch_has_block_step() is defined, 0285 * this must clear the effects of user_enable_block_step() too. 0286 */ 0287 static inline void user_enable_single_step(struct task_struct *task) 0288 { 0289 BUG(); /* This can never be called. */ 0290 } 0291 0292 /** 0293 * user_disable_single_step - cancel user-mode single-step 0294 * @task: either current or a task stopped in %TASK_TRACED 0295 * 0296 * Clear @task of the effects of user_enable_single_step() and 0297 * user_enable_block_step(). This can be called whether or not either 0298 * of those was ever called on @task, and even if arch_has_single_step() 0299 * returned zero. 0300 */ 0301 static inline void user_disable_single_step(struct task_struct *task) 0302 { 0303 } 0304 #else 0305 extern void user_enable_single_step(struct task_struct *); 0306 extern void user_disable_single_step(struct task_struct *); 0307 #endif /* arch_has_single_step */ 0308 0309 #ifndef arch_has_block_step 0310 /** 0311 * arch_has_block_step - does this CPU support user-mode block-step? 0312 * 0313 * If this is defined, then there must be a function declaration or inline 0314 * for user_enable_block_step(), and arch_has_single_step() must be defined 0315 * too. arch_has_block_step() should evaluate to nonzero iff the machine 0316 * supports step-until-branch for user mode. It can be a constant or it 0317 * can test a CPU feature bit. 0318 */ 0319 #define arch_has_block_step() (0) 0320 0321 /** 0322 * user_enable_block_step - step until branch in user-mode task 0323 * @task: either current or a task stopped in %TASK_TRACED 0324 * 0325 * This can only be called when arch_has_block_step() has returned nonzero, 0326 * and will never be called when single-instruction stepping is being used. 0327 * Set @task so that when it returns to user mode, it will trap after the 0328 * next branch or trap taken. 0329 */ 0330 static inline void user_enable_block_step(struct task_struct *task) 0331 { 0332 BUG(); /* This can never be called. */ 0333 } 0334 #else 0335 extern void user_enable_block_step(struct task_struct *); 0336 #endif /* arch_has_block_step */ 0337 0338 #ifdef ARCH_HAS_USER_SINGLE_STEP_REPORT 0339 extern void user_single_step_report(struct pt_regs *regs); 0340 #else 0341 static inline void user_single_step_report(struct pt_regs *regs) 0342 { 0343 kernel_siginfo_t info; 0344 clear_siginfo(&info); 0345 info.si_signo = SIGTRAP; 0346 info.si_errno = 0; 0347 info.si_code = SI_USER; 0348 info.si_pid = 0; 0349 info.si_uid = 0; 0350 force_sig_info(&info); 0351 } 0352 #endif 0353 0354 #ifndef arch_ptrace_stop_needed 0355 /** 0356 * arch_ptrace_stop_needed - Decide whether arch_ptrace_stop() should be called 0357 * 0358 * This is called with the siglock held, to decide whether or not it's 0359 * necessary to release the siglock and call arch_ptrace_stop(). It can be 0360 * defined to a constant if arch_ptrace_stop() is never required, or always 0361 * is. On machines where this makes sense, it should be defined to a quick 0362 * test to optimize out calling arch_ptrace_stop() when it would be 0363 * superfluous. For example, if the thread has not been back to user mode 0364 * since the last stop, the thread state might indicate that nothing needs 0365 * to be done. 0366 * 0367 * This is guaranteed to be invoked once before a task stops for ptrace and 0368 * may include arch-specific operations necessary prior to a ptrace stop. 0369 */ 0370 #define arch_ptrace_stop_needed() (0) 0371 #endif 0372 0373 #ifndef arch_ptrace_stop 0374 /** 0375 * arch_ptrace_stop - Do machine-specific work before stopping for ptrace 0376 * 0377 * This is called with no locks held when arch_ptrace_stop_needed() has 0378 * just returned nonzero. It is allowed to block, e.g. for user memory 0379 * access. The arch can have machine-specific work to be done before 0380 * ptrace stops. On ia64, register backing store gets written back to user 0381 * memory here. Since this can be costly (requires dropping the siglock), 0382 * we only do it when the arch requires it for this particular stop, as 0383 * indicated by arch_ptrace_stop_needed(). 0384 */ 0385 #define arch_ptrace_stop() do { } while (0) 0386 #endif 0387 0388 #ifndef current_pt_regs 0389 #define current_pt_regs() task_pt_regs(current) 0390 #endif 0391 0392 /* 0393 * unlike current_pt_regs(), this one is equal to task_pt_regs(current) 0394 * on *all* architectures; the only reason to have a per-arch definition 0395 * is optimisation. 0396 */ 0397 #ifndef signal_pt_regs 0398 #define signal_pt_regs() task_pt_regs(current) 0399 #endif 0400 0401 #ifndef current_user_stack_pointer 0402 #define current_user_stack_pointer() user_stack_pointer(current_pt_regs()) 0403 #endif 0404 0405 extern int task_current_syscall(struct task_struct *target, struct syscall_info *info); 0406 0407 extern void sigaction_compat_abi(struct k_sigaction *act, struct k_sigaction *oact); 0408 0409 /* 0410 * ptrace report for syscall entry and exit looks identical. 0411 */ 0412 static inline int ptrace_report_syscall(unsigned long message) 0413 { 0414 int ptrace = current->ptrace; 0415 int signr; 0416 0417 if (!(ptrace & PT_PTRACED)) 0418 return 0; 0419 0420 signr = ptrace_notify(SIGTRAP | ((ptrace & PT_TRACESYSGOOD) ? 0x80 : 0), 0421 message); 0422 0423 /* 0424 * this isn't the same as continuing with a signal, but it will do 0425 * for normal use. strace only continues with a signal if the 0426 * stopping signal is not SIGTRAP. -brl 0427 */ 0428 if (signr) 0429 send_sig(signr, current, 1); 0430 0431 return fatal_signal_pending(current); 0432 } 0433 0434 /** 0435 * ptrace_report_syscall_entry - task is about to attempt a system call 0436 * @regs: user register state of current task 0437 * 0438 * This will be called if %SYSCALL_WORK_SYSCALL_TRACE or 0439 * %SYSCALL_WORK_SYSCALL_EMU have been set, when the current task has just 0440 * entered the kernel for a system call. Full user register state is 0441 * available here. Changing the values in @regs can affect the system 0442 * call number and arguments to be tried. It is safe to block here, 0443 * preventing the system call from beginning. 0444 * 0445 * Returns zero normally, or nonzero if the calling arch code should abort 0446 * the system call. That must prevent normal entry so no system call is 0447 * made. If @task ever returns to user mode after this, its register state 0448 * is unspecified, but should be something harmless like an %ENOSYS error 0449 * return. It should preserve enough information so that syscall_rollback() 0450 * can work (see asm-generic/syscall.h). 0451 * 0452 * Called without locks, just after entering kernel mode. 0453 */ 0454 static inline __must_check int ptrace_report_syscall_entry( 0455 struct pt_regs *regs) 0456 { 0457 return ptrace_report_syscall(PTRACE_EVENTMSG_SYSCALL_ENTRY); 0458 } 0459 0460 /** 0461 * ptrace_report_syscall_exit - task has just finished a system call 0462 * @regs: user register state of current task 0463 * @step: nonzero if simulating single-step or block-step 0464 * 0465 * This will be called if %SYSCALL_WORK_SYSCALL_TRACE has been set, when 0466 * the current task has just finished an attempted system call. Full 0467 * user register state is available here. It is safe to block here, 0468 * preventing signals from being processed. 0469 * 0470 * If @step is nonzero, this report is also in lieu of the normal 0471 * trap that would follow the system call instruction because 0472 * user_enable_block_step() or user_enable_single_step() was used. 0473 * In this case, %SYSCALL_WORK_SYSCALL_TRACE might not be set. 0474 * 0475 * Called without locks, just before checking for pending signals. 0476 */ 0477 static inline void ptrace_report_syscall_exit(struct pt_regs *regs, int step) 0478 { 0479 if (step) 0480 user_single_step_report(regs); 0481 else 0482 ptrace_report_syscall(PTRACE_EVENTMSG_SYSCALL_EXIT); 0483 } 0484 #endif
[ Source navigation ] | [ Diff markup ] | [ Identifier search ] | [ general search ] |
This page was automatically generated by the 2.1.0 LXR engine. The LXR team |
![]() ![]() |