helpers/local/security.PtraceThread.thread-prctl.c

/*
 * Copyright (c) 2012 The Chromium OS Authors.
 *
 * Based on:
 * http://bazaar.launchpad.net/~ubuntu-bugcontrol/qa-regression-testing/master/view/head:/scripts/kernel-security/ptrace/thread-prctl.c
 * Copyright 2011 Canonical, Ltd
 * License: GPLv3
 * Author: Kees Cook <kees.cook@canonical.com>
 *
 * Based on reproducer written by Philippe Waroquiers in:
 * https://launchpad.net/bugs/729839
 */
#include <unistd.h>
#include <stdio.h>
#include <stdlib.h>
#include <sys/types.h>
#include <sys/wait.h>
#include <signal.h>
#include <string.h>
#include <pthread.h>
#include <sys/ptrace.h>
#include <sys/prctl.h>
#ifndef PR_SET_PTRACER
#define PR_SET_PTRACER 0x59616d61
#endif

int tracee_method = 0;
#define TRACEE_FORKS_FROM_TRACER 0
#define TRACEE_CALLS_PRCTL_FROM_MAIN 1
#define TRACEE_CALLS_PRCTL_FROM_THREAD 2

/* Define some distinct exit values to aid failure debugging. */
#define EXIT_FORK_TRACEE 1
#define EXIT_FORK_TRACER 2
#define EXIT_PIPE_COMMUNICATION 3
#define EXIT_PIPE_NOTIFICATION 4
#define EXIT_TRACEE_PIPE_READ 5
#define EXIT_TRACEE_UNREACHABLE 6
#define EXIT_TRACER_PIPE_READ 7
#define EXIT_TRACER_PTRACE_ATTACH 8
#define EXIT_TRACER_PTRACE_CONTINUE 9
#define EXIT_TRACER_UNREACHABLE 10
#define EXIT_TRACEE_PIPE_WRITE 11
#define EXIT_TRACER_PIPE_WRITE 12

int main_does_ptrace = 0;

int ret;
int pipes[2];
int notification[2];
pid_t tracer, tracee;

static void* thr_fn(void* v) {
  printf("tracee thread started\n");
  if (tracee_method == TRACEE_CALLS_PRCTL_FROM_THREAD) {
    ret = prctl(PR_SET_PTRACER, tracer, 0, 0, 0);
    printf("tracee thread prtctl result: %d\n", ret);
  }
  printf("tracee thread finishing\n");
  return NULL;
}

void start_tracee(void);

void* tracer_main(void* data) {
  long ptrace_result;
  char buf[8];
  int saw;

  tracer = getpid();
  printf("tracer %d waiting\n", tracer);

  if (tracee_method == TRACEE_FORKS_FROM_TRACER) {
    printf("forking tracee from tracer\n");
    start_tracee();
  }

  close(pipes[1]);
  close(notification[0]);
  close(notification[1]);

  saw = read(pipes[0], buf, 3);
  if (saw < 3) {
    perror("tracer pipe read");
    exit(EXIT_TRACER_PIPE_READ);
  }

  printf("tracer to PTRACE_ATTACH my tracee %d\n", tracee);
  ptrace_result = ptrace(PTRACE_ATTACH, tracee, NULL, NULL);
  if (ptrace_result != 0) {
    fflush(NULL);
    perror("tracer ptrace attach has failed");
    exit(EXIT_TRACER_PTRACE_ATTACH);
  }
  printf("tracer ptrace attach successful\n");

  /* Wait for signal. */
  printf("tracer waiting for tracee to SIGSTOP\n");
  waitpid(tracee, NULL, 0);

  printf("tracer to PTRACE_CONT tracee\n");
  ptrace_result = ptrace(PTRACE_CONT, tracee, NULL, NULL);
  if (ptrace_result != 0) {
    fflush(NULL);
    perror("tracer ptrace continue has failed");
    exit(EXIT_TRACER_PTRACE_CONTINUE);
  }
  printf("tracer ptrace continue successful\n");

  printf("tracer returning 0\n");
  fflush(NULL);
  exit(EXIT_SUCCESS);

  return NULL;
}

/* Tracee knows nothing, needs tracee and tracer pid. */
void tracee_main(void) {
  char buf[1024];
  int saw;
  pthread_t thr;
  int num_written;

  tracee = getpid();
  close(pipes[0]);

  printf("tracee %d reading tracer pid\n", tracee);
  close(notification[1]);
  saw = read(notification[0], buf, 1024);
  if (saw < 1) {
    perror("pipe read");
    exit(EXIT_TRACEE_PIPE_READ);
  }
  buf[saw] = '\0';
  tracer = atoi(buf);

  printf("tracee %d started (expecting %d as tracer)\n", tracee, tracer);

  /* Handle setting PR_SET_PTRACER. */
  switch (tracee_method) {
    case TRACEE_CALLS_PRCTL_FROM_MAIN:
      ret = prctl(PR_SET_PTRACER, tracer, 0, 0, 0);
      printf("tracee main prtctl result: %d \n", ret);
      break;
    case TRACEE_CALLS_PRCTL_FROM_THREAD:
      printf("tracee thread starting\n");
      pthread_create(&thr, NULL, thr_fn, NULL);
      pthread_join(thr, NULL);
      printf("tracee thread finished\n");
      break;
    default:
      break;
  }

  /* Wait for Oedipal action. */
  printf("tracee triggering tracer\n");
  fflush(NULL);
  num_written = write(pipes[1], "ok\n", 3);
  if (num_written != 3) {
    perror("tracee write to trigger tracer failed");
    exit(EXIT_TRACEE_PIPE_WRITE);
  }

  printf("tracee waiting for primary\n");
  saw = read(notification[0], buf, 1024);
  buf[saw] = '\0';

  printf("tracee finished (%s)\n", buf);
  exit(EXIT_SUCCESS);
}

void start_tracee(void) {
  fflush(NULL);
  tracee = fork();
  if (tracee < 0) {
    perror("fork tracee");
    exit(EXIT_FORK_TRACEE);
  }
  if (tracee == 0) {
    tracee_main();
    exit(EXIT_TRACEE_UNREACHABLE);
  }
}

/* Tracer knows tracee, needs tracer pid. */
int main(int argc, char* argv[]) {
  int status;
  char buf[1024];
  int num_written;

  if (argc > 1) {
    /* Operational states:
     * 0: tracer forks tracee.
     * 1: tracee calls prctl from main process.
     * 2: tracee calls prctl from non-leader thread.
     */
    tracee_method = atoi(argv[1]);
  }
  if (argc > 2) {
    /* Operational states:
     * 0: ptrace happens from non-leader thread.
     * 1: ptrace happens from main process.
     */
    main_does_ptrace = atoi(argv[2]) != 0;
  }

  if (tracee_method != TRACEE_FORKS_FROM_TRACER) {
    printf("will issue prctl from %s\n",
           tracee_method == TRACEE_CALLS_PRCTL_FROM_MAIN ? "main" : "thread");
  } else {
    printf("will fork tracee from tracer\n");
  }
  printf("will issue ptrace from tracer %s\n",
         main_does_ptrace ? "main" : "thread");

  printf("primary is %d\n", getpid());

  if (pipe(notification) < 0) {
    perror("pipe");
    exit(EXIT_PIPE_NOTIFICATION);
  }
  if (pipe(pipes) < 0) {
    perror("pipe");
    exit(EXIT_PIPE_COMMUNICATION);
  }

  if (tracee_method != TRACEE_FORKS_FROM_TRACER) {
    printf("forking tracee from primary\n");
    start_tracee();
  }

  fflush(NULL);
  tracer = fork();
  if (tracer < 0) {
    perror("fork tracer");
    exit(EXIT_FORK_TRACER);
  }
  if (tracer == 0) {
    printf("tracer is %d\n", getpid());
    if (main_does_ptrace) {
      tracer_main(NULL);
    } else {
      pthread_t thread;
      pthread_create(&thread, NULL, tracer_main, NULL);
      pthread_join(thread, NULL);
    }
    exit(EXIT_TRACER_UNREACHABLE);
  }

  /* Leave the pipes for the tracee and tracer. */
  close(pipes[0]);
  close(pipes[1]);

  /* Close our end of pid notification. */
  close(notification[0]);
  sprintf(buf, "%d", tracer);
  num_written = write(notification[1], buf, strlen(buf));
  if (num_written != strlen(buf)) {
    perror("tracer write to close pid notification failed");
    exit(EXIT_TRACER_PIPE_WRITE);
  }

  printf("primary waiting for tracer to finish\n");
  fflush(NULL);
  waitpid(tracer, &status, 0);

  printf("primary waiting for tracee to finish\n");
  fflush(NULL);
  num_written = write(notification[1], "stop", 4);
  if (num_written != 4) {
    perror("tracer write to stop tracee failed");
    exit(EXIT_TRACER_PIPE_WRITE);
  }
  kill(tracee, SIGCONT);  // Just in case.
  waitpid(tracee, NULL, 0);

  status = WEXITSTATUS(status);
  printf("primary saw rc %d from tracer\n", status);
  return status;
}