xref: /openbsd-src/sys/kern/sys_process.c (revision 33b4f39fbeffad07bc3206f173cff9f3c9901cd1)
1 /*	$OpenBSD: sys_process.c,v 1.27 2004/02/08 00:04:21 deraadt Exp $	*/
2 /*	$NetBSD: sys_process.c,v 1.55 1996/05/15 06:17:47 tls Exp $	*/
3 
4 /*-
5  * Copyright (c) 1994 Christopher G. Demetriou.  All rights reserved.
6  * Copyright (c) 1982, 1986, 1989, 1993
7  *	The Regents of the University of California.  All rights reserved.
8  * (c) UNIX System Laboratories, Inc.
9  * All or some portions of this file are derived from material licensed
10  * to the University of California by American Telephone and Telegraph
11  * Co. or Unix System Laboratories, Inc. and are reproduced herein with
12  * the permission of UNIX System Laboratories, Inc.
13  *
14  * Redistribution and use in source and binary forms, with or without
15  * modification, are permitted provided that the following conditions
16  * are met:
17  * 1. Redistributions of source code must retain the above copyright
18  *    notice, this list of conditions and the following disclaimer.
19  * 2. Redistributions in binary form must reproduce the above copyright
20  *    notice, this list of conditions and the following disclaimer in the
21  *    documentation and/or other materials provided with the distribution.
22  * 3. Neither the name of the University nor the names of its contributors
23  *    may be used to endorse or promote products derived from this software
24  *    without specific prior written permission.
25  *
26  * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
27  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
28  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
29  * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
30  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
31  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
32  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
33  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
34  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
35  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
36  * SUCH DAMAGE.
37  *
38  *	from: @(#)sys_process.c	8.1 (Berkeley) 6/10/93
39  */
40 
41 /*
42  * References:
43  *	(1) Bach's "The Design of the UNIX Operating System",
44  *	(2) sys/miscfs/procfs from UCB's 4.4BSD-Lite distribution,
45  *	(3) the "4.4BSD Programmer's Reference Manual" published
46  *		by USENIX and O'Reilly & Associates.
47  * The 4.4BSD PRM does a reasonably good job of documenting what the various
48  * ptrace() requests should actually do, and its text is quoted several times
49  * in this file.
50  */
51 
52 #include <sys/param.h>
53 #include <sys/systm.h>
54 #include <sys/proc.h>
55 #include <sys/signalvar.h>
56 #include <sys/errno.h>
57 #include <sys/ptrace.h>
58 #include <sys/uio.h>
59 #include <sys/user.h>
60 
61 #include <sys/mount.h>
62 #include <sys/syscallargs.h>
63 
64 #include <uvm/uvm_extern.h>
65 
66 #include <machine/reg.h>
67 
68 #include <miscfs/procfs/procfs.h>
69 
70 /*
71  * Process debugging system call.
72  */
73 int
74 sys_ptrace(p, v, retval)
75 	struct proc *p;
76 	void *v;
77 	register_t *retval;
78 {
79 	struct sys_ptrace_args /* {
80 		syscallarg(int) req;
81 		syscallarg(pid_t) pid;
82 		syscallarg(caddr_t) addr;
83 		syscallarg(int) data;
84 	} */ *uap = v;
85 	struct proc *t;				/* target process */
86 	struct uio uio;
87 	struct iovec iov;
88 	struct ptrace_io_desc piod;
89 #ifdef PT_WCOOKIE
90 	register_t wcookie;
91 #endif
92 	int error, write;
93 	int temp;
94 
95 	/* "A foolish consistency..." XXX */
96 	if (SCARG(uap, req) == PT_TRACE_ME)
97 		t = p;
98 	else {
99 
100 		/* Find the process we're supposed to be operating on. */
101 		if ((t = pfind(SCARG(uap, pid))) == NULL)
102 			return (ESRCH);
103 	}
104 
105 	if ((t->p_flag & P_INEXEC) != 0)
106 		return (EAGAIN);
107 
108 	/* Make sure we can operate on it. */
109 	switch (SCARG(uap, req)) {
110 	case  PT_TRACE_ME:
111 		/* Saying that you're being traced is always legal. */
112 		break;
113 
114 	case  PT_ATTACH:
115 		/*
116 		 * You can't attach to a process if:
117 		 *	(1) it's the process that's doing the attaching,
118 		 */
119 		if (t->p_pid == p->p_pid)
120 			return (EINVAL);
121 
122 		/*
123 		 *	(2) it's a system process
124 		 */
125 		if (ISSET(t->p_flag, P_SYSTEM))
126 			return (EPERM);
127 
128 		/*
129 		 *	(3) it's already being traced, or
130 		 */
131 		if (ISSET(t->p_flag, P_TRACED))
132 			return (EBUSY);
133 
134 		/*
135 		 *	(4) it's not owned by you, or the last exec
136 		 *	    gave us setuid/setgid privs (unless
137 		 *	    you're root), or...
138 		 *
139 		 *      [Note: once P_SUGID or P_SUGIDEXEC gets set in
140 		 *	execve(), they stay set until the process does
141 		 *	another execve().  Hence this prevents a setuid
142 		 *	process which revokes it's special privileges using
143 		 *	setuid() from being traced.  This is good security.]
144 		 */
145 		if ((t->p_cred->p_ruid != p->p_cred->p_ruid ||
146 		    ISSET(t->p_flag, P_SUGIDEXEC) ||
147 		    ISSET(t->p_flag, P_SUGID)) &&
148 		    (error = suser(p, 0)) != 0)
149 			return (error);
150 
151 		/*
152 		 *	(5) ...it's init, which controls the security level
153 		 *	    of the entire system, and the system was not
154 		 *          compiled with permanently insecure mode turned
155 		 *	    on.
156 		 */
157 		if ((t->p_pid == 1) && (securelevel > -1))
158 			return (EPERM);
159 		break;
160 
161 	case  PT_READ_I:
162 	case  PT_READ_D:
163 	case  PT_WRITE_I:
164 	case  PT_WRITE_D:
165 	case  PT_IO:
166 	case  PT_CONTINUE:
167 	case  PT_KILL:
168 	case  PT_DETACH:
169 #ifdef PT_STEP
170 	case  PT_STEP:
171 #endif
172 	case  PT_GETREGS:
173 	case  PT_SETREGS:
174 #ifdef PT_GETFPREGS
175 	case  PT_GETFPREGS:
176 #endif
177 #ifdef PT_SETFPREGS
178 	case  PT_SETFPREGS:
179 #endif
180 #ifdef PT_WCOOKIE
181 	case  PT_WCOOKIE:
182 #endif
183 		/*
184 		 * You can't do what you want to the process if:
185 		 *	(1) It's not being traced at all,
186 		 */
187 		if (!ISSET(t->p_flag, P_TRACED))
188 			return (EPERM);
189 
190 		/*
191 		 *	(2) it's not being traced by _you_, or
192 		 */
193 		if (t->p_pptr != p)
194 			return (EBUSY);
195 
196 		/*
197 		 *	(3) it's not currently stopped.
198 		 */
199 		if (t->p_stat != SSTOP || !ISSET(t->p_flag, P_WAITED))
200 			return (EBUSY);
201 		break;
202 
203 	default:			/* It was not a legal request. */
204 		return (EINVAL);
205 	}
206 
207 	/* Do single-step fixup if needed. */
208 	FIX_SSTEP(t);
209 
210 	/* Now do the operation. */
211 	write = 0;
212 	*retval = 0;
213 
214 	switch (SCARG(uap, req)) {
215 	case  PT_TRACE_ME:
216 		/* Just set the trace flag. */
217 		SET(t->p_flag, P_TRACED);
218 		t->p_oppid = t->p_pptr->p_pid;
219 		return (0);
220 
221 	case  PT_WRITE_I:		/* XXX no separate I and D spaces */
222 	case  PT_WRITE_D:
223 		write = 1;
224 		temp = SCARG(uap, data);
225 	case  PT_READ_I:		/* XXX no separate I and D spaces */
226 	case  PT_READ_D:
227 		/* write = 0 done above. */
228 		iov.iov_base = (caddr_t)&temp;
229 		iov.iov_len = sizeof(int);
230 		uio.uio_iov = &iov;
231 		uio.uio_iovcnt = 1;
232 		uio.uio_offset = (off_t)(long)SCARG(uap, addr);
233 		uio.uio_resid = sizeof(int);
234 		uio.uio_segflg = UIO_SYSSPACE;
235 		uio.uio_rw = write ? UIO_WRITE : UIO_READ;
236 		uio.uio_procp = p;
237 		error = procfs_domem(p, t, NULL, &uio);
238 		if (write == 0)
239 			*retval = temp;
240 		return (error);
241 	case  PT_IO:
242 		error = copyin(SCARG(uap, addr), &piod, sizeof(piod));
243 		if (error)
244 			return (error);
245 		iov.iov_base = piod.piod_addr;
246 		iov.iov_len = piod.piod_len;
247 		uio.uio_iov = &iov;
248 		uio.uio_iovcnt = 1;
249 		uio.uio_offset = (off_t)(long)piod.piod_offs;
250 		uio.uio_resid = piod.piod_len;
251 		uio.uio_segflg = UIO_USERSPACE;
252 		uio.uio_procp = p;
253 		switch (piod.piod_op) {
254 		case PIOD_READ_D:
255 		case PIOD_READ_I:
256 			uio.uio_rw = UIO_READ;
257 			break;
258 		case PIOD_WRITE_D:
259 		case PIOD_WRITE_I:
260 			uio.uio_rw = UIO_WRITE;
261 			break;
262 		default:
263 			return (EINVAL);
264 		}
265 		error = procfs_domem(p, t, NULL, &uio);
266 		piod.piod_len -= uio.uio_resid;
267 		(void) copyout(&piod, SCARG(uap, addr), sizeof(piod));
268 		return (error);
269 #ifdef PT_STEP
270 	case  PT_STEP:
271 		/*
272 		 * From the 4.4BSD PRM:
273 		 * "Execution continues as in request PT_CONTINUE; however
274 		 * as soon as possible after execution of at least one
275 		 * instruction, execution stops again. [ ... ]"
276 		 */
277 #endif
278 	case  PT_CONTINUE:
279 		/*
280 		 * From the 4.4BSD PRM:
281 		 * "The data argument is taken as a signal number and the
282 		 * child's execution continues at location addr as if it
283 		 * incurred that signal.  Normally the signal number will
284 		 * be either 0 to indicate that the signal that caused the
285 		 * stop should be ignored, or that value fetched out of
286 		 * the process's image indicating which signal caused
287 		 * the stop.  If addr is (int *)1 then execution continues
288 		 * from where it stopped."
289 		 */
290 
291 		/* Check that the data is a valid signal number or zero. */
292 		if (SCARG(uap, data) < 0 || SCARG(uap, data) >= NSIG)
293 			return (EINVAL);
294 
295 		PHOLD(t);
296 		/* If the address paramter is not (int *)1, set the pc. */
297 		if ((int *)SCARG(uap, addr) != (int *)1)
298 			if ((error = process_set_pc(t, SCARG(uap, addr))) != 0)
299 				goto relebad;
300 
301 #ifdef PT_STEP
302 		/*
303 		 * Arrange for a single-step, if that's requested and possible.
304 		 */
305 		error = process_sstep(t, SCARG(uap, req) == PT_STEP);
306 		if (error)
307 			goto relebad;
308 #endif
309 		PRELE(t);
310 		goto sendsig;
311 
312 	case  PT_DETACH:
313 		/*
314 		 * From the 4.4BSD PRM:
315 		 * "The data argument is taken as a signal number and the
316 		 * child's execution continues at location addr as if it
317 		 * incurred that signal.  Normally the signal number will
318 		 * be either 0 to indicate that the signal that caused the
319 		 * stop should be ignored, or that value fetched out of
320 		 * the process's image indicating which signal caused
321 		 * the stop.  If addr is (int *)1 then execution continues
322 		 * from where it stopped."
323 		 */
324 
325 		/* Check that the data is a valid signal number or zero. */
326 		if (SCARG(uap, data) < 0 || SCARG(uap, data) >= NSIG)
327 			return (EINVAL);
328 
329 		PHOLD(t);
330 #ifdef PT_STEP
331 		/*
332 		 * Arrange for a single-step, if that's requested and possible.
333 		 */
334 		error = process_sstep(t, SCARG(uap, req) == PT_STEP);
335 		if (error)
336 			goto relebad;
337 #endif
338 		PRELE(t);
339 
340 		/* give process back to original parent or init */
341 		if (t->p_oppid != t->p_pptr->p_pid) {
342 			struct proc *pp;
343 
344 			pp = pfind(t->p_oppid);
345 			proc_reparent(t, pp ? pp : initproc);
346 		}
347 
348 		/* not being traced any more */
349 		t->p_oppid = 0;
350 		CLR(t->p_flag, P_TRACED|P_WAITED);
351 
352 	sendsig:
353 		/* Finally, deliver the requested signal (or none). */
354 		if (t->p_stat == SSTOP) {
355 			t->p_xstat = SCARG(uap, data);
356 			setrunnable(t);
357 		} else {
358 			if (SCARG(uap, data) != 0)
359 				psignal(t, SCARG(uap, data));
360 		}
361 		return (0);
362 
363 	relebad:
364 		PRELE(t);
365 		return (error);
366 
367 	case  PT_KILL:
368 		/* just send the process a KILL signal. */
369 		SCARG(uap, data) = SIGKILL;
370 		goto sendsig;	/* in PT_CONTINUE, above. */
371 
372 	case  PT_ATTACH:
373 		/*
374 		 * As done in procfs:
375 		 * Go ahead and set the trace flag.
376 		 * Save the old parent (it's reset in
377 		 *   _DETACH, and also in kern_exit.c:wait4()
378 		 * Reparent the process so that the tracing
379 		 *   proc gets to see all the action.
380 		 * Stop the target.
381 		 */
382 		SET(t->p_flag, P_TRACED);
383 		t->p_oppid = t->p_pptr->p_pid;
384 		if (t->p_pptr != p)
385 			proc_reparent(t, p);
386 		SCARG(uap, data) = SIGSTOP;
387 		goto sendsig;
388 
389 	case  PT_SETREGS:
390 		write = 1;
391 	case  PT_GETREGS:
392 		/* write = 0 done above. */
393 		if (!procfs_validregs(t, NULL))
394 			return (EINVAL);
395 		else {
396 			iov.iov_base = SCARG(uap, addr);
397 			iov.iov_len = sizeof(struct reg);
398 			uio.uio_iov = &iov;
399 			uio.uio_iovcnt = 1;
400 			uio.uio_offset = 0;
401 			uio.uio_resid = sizeof(struct reg);
402 			uio.uio_segflg = UIO_USERSPACE;
403 			uio.uio_rw = write ? UIO_WRITE : UIO_READ;
404 			uio.uio_procp = p;
405 			return (procfs_doregs(p, t, NULL, &uio));
406 		}
407 #ifdef PT_SETFPREGS
408 	case  PT_SETFPREGS:
409 		write = 1;
410 #endif
411 #ifdef PT_GETFPREGS
412 	case  PT_GETFPREGS:
413 		/* write = 0 done above. */
414 #endif
415 #if defined(PT_SETFPREGS) || defined(PT_GETFPREGS)
416 		if (!procfs_validfpregs(t, NULL))
417 			return (EINVAL);
418 		else {
419 			iov.iov_base = SCARG(uap, addr);
420 			iov.iov_len = sizeof(struct fpreg);
421 			uio.uio_iov = &iov;
422 			uio.uio_iovcnt = 1;
423 			uio.uio_offset = 0;
424 			uio.uio_resid = sizeof(struct fpreg);
425 			uio.uio_segflg = UIO_USERSPACE;
426 			uio.uio_rw = write ? UIO_WRITE : UIO_READ;
427 			uio.uio_procp = p;
428 			return (procfs_dofpregs(p, t, NULL, &uio));
429 		}
430 #endif
431 #ifdef PT_WCOOKIE
432 	case  PT_WCOOKIE:
433 		wcookie = process_get_wcookie (t);
434 		return (copyout(&wcookie, SCARG(uap, addr),
435 		    sizeof (register_t)));
436 #endif
437 	}
438 
439 #ifdef DIAGNOSTIC
440 	panic("ptrace: impossible");
441 #endif
442 	return 0;
443 }
444