Openwall GNU/*/Linux - a small security-enhanced Linux distro for servers
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Fri, 15 Mar 2013 06:08:04 +0400
From: "Dmitry V. Levin" <ldv@...linux.org>
To: owl-dev@...ts.openwall.com
Subject: Re: strace

On Fri, Mar 15, 2013 at 02:17:26AM +0100, Pavel Kankovsky wrote:
> On Fri, 15 Mar 2013, Dmitry V. Levin wrote:
> 
> >The change of orig_eax offset means that there was a change in the ptrace
> >ABI between 2.6.18 and 2.6.32, and all its users (e.g. strace and gdb)
> >should be rebuilt.
> 
> Things appear to be a little more complicated.
> 
> As far as I can tell, PTRACE_GETREGS returns data in struct pt_regs 
> layout on 2.6.18 and in struct user_regs_struct layout on 2.6.32.
> Those two structs are compatible on 2.6.32 but they are different on 
> 2.6.18 (i386 arch; x86-64 is probably unaffected).
> 
> Afaict they changed it in 2.6.25 when i386 code implementing ptrace
> was merged with x86-64 code.
> 
> The old interface (returning struct pt_regs) should probably be
> considered broken because it exposes internal kernel data structures but 
> it appears PTRACE_GETREGS as a whole is going to be deprecated:
> <http://sourceware.org/ml/archer/2010-q3/msg00193.html>

Next strace release will use PTRACE_GETREGSET on most of supported
architectures.  Unfortunately, it requires a good runtime check, not the
simple kernel version check we have implemented at this moment.

> >Recently (commit v4.7-82-g2550d48) strace was changed on x86* to stop
> >including asm/ptrace.h and use "struct user_regs_struct" instead.
> 
> I was not aware it was a recent change (I should have checked.)
> 
> This means up-to-date strace is unable to work on old kernels: it expects 
> struct user_regs_struct but it gets incompatible struct pt_regs. It does 
> not matter what kernel headers are used to compile it because struct 
> user_regs_struct is the same in both versions.
> 
> strace should probably refuse to use PTRACE_GETREGS (and fall back to
> PTRACE_PEEKUSER?) when it runs on an old kernel.

Is there any relatively cheap runtime method to find out what kind of regs
struct is returned by PTRACE_GETREGS?  Could the kernel version be used to
choose the right regs struct?


-- 
ldv

[ CONTENT OF TYPE application/pgp-signature SKIPPED ]

Powered by blists - more mailing lists

Your e-mail address:

Powered by Openwall GNU/*/Linux - Powered by OpenVZ