Openwall GNU/*/Linux - a small security-enhanced Linux distro for servers
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Fri, 15 Mar 2013 02:17:26 +0100 (CET)
From: Pavel Kankovsky <peak@...o.troja.mff.cuni.cz>
To: owl-dev@...ts.openwall.com
Subject: Re: strace

On Fri, 15 Mar 2013, Dmitry V. Levin wrote:

> The change of orig_eax offset means that there was a change in the ptrace
> ABI between 2.6.18 and 2.6.32, and all its users (e.g. strace and gdb)
> should be rebuilt.

Things appear to be a little more complicated.

As far as I can tell, PTRACE_GETREGS returns data in struct pt_regs 
layout on 2.6.18 and in struct user_regs_struct layout on 2.6.32.
Those two structs are compatible on 2.6.32 but they are different on 
2.6.18 (i386 arch; x86-64 is probably unaffected).

Afaict they changed it in 2.6.25 when i386 code implementing ptrace
was merged with x86-64 code.

The old interface (returning struct pt_regs) should probably be
considered broken because it exposes internal kernel data structures but 
it appears PTRACE_GETREGS as a whole is going to be deprecated:
<http://sourceware.org/ml/archer/2010-q3/msg00193.html>

> Recently (commit v4.7-82-g2550d48) strace was changed on x86* to stop
> including asm/ptrace.h and use "struct user_regs_struct" instead.

I was not aware it was a recent change (I should have checked.)

This means up-to-date strace is unable to work on old kernels: it expects 
struct user_regs_struct but it gets incompatible struct pt_regs. It does 
not matter what kernel headers are used to compile it because struct 
user_regs_struct is the same in both versions.

strace should probably refuse to use PTRACE_GETREGS (and fall back to 
PTRACE_PEEKUSER?) when it runs on an old kernel.

-- 
Pavel Kankovsky aka Peak                          / Jeremiah 9:21        \
"For death is come up into our MS Windows(tm)..." \ 21st century edition /

Powered by blists - more mailing lists

Your e-mail address:

Powered by Openwall GNU/*/Linux - Powered by OpenVZ