1 /* $OpenBSD: t_ptrace.c,v 1.3 2020/02/02 20:18:17 bluhm Exp $ */ 2 /* $NetBSD: t_ptrace.c,v 1.4 2018/05/14 12:44:40 kamil Exp $ */ 3 4 /*- 5 * Copyright (c) 2016 The NetBSD Foundation, Inc. 6 * All rights reserved. 7 * 8 * Redistribution and use in source and binary forms, with or without 9 * modification, are permitted provided that the following conditions 10 * are met: 11 * 1. Redistributions of source code must retain the above copyright 12 * notice, this list of conditions and the following disclaimer. 13 * 2. Redistributions in binary form must reproduce the above copyright 14 * notice, this list of conditions and the following disclaimer in the 15 * documentation and/or other materials provided with the distribution. 16 * 17 * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS 18 * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED 19 * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR 20 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS 21 * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR 22 * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF 23 * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS 24 * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN 25 * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) 26 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE 27 * POSSIBILITY OF SUCH DAMAGE. 28 */ 29 30 #include "macros.h" 31 32 #include <sys/cdefs.h> 33 __RCSID("$NetBSD: t_ptrace.c,v 1.4 2018/05/14 12:44:40 kamil Exp $"); 34 35 #include <sys/param.h> 36 #include <sys/types.h> 37 #include <sys/ptrace.h> 38 #include <sys/stat.h> 39 #include <sys/sysctl.h> 40 #include <err.h> 41 #include <errno.h> 42 #include <unistd.h> 43 44 #include "atf-c.h" 45 46 #include "h_macros.h" 47 48 /* 49 * A child process cannot call atf functions and expect them to magically 50 * work like in the parent. 51 * The printf(3) messaging from a child will not work out of the box as well 52 * without estabilishing a communication protocol with its parent. To not 53 * overcomplicate the tests - do not log from a child and use err(3)/errx(3) 54 * wrapped with FORKEE_ASSERT()/FORKEE_ASSERTX() as that is guaranteed to work. 55 */ 56 #define FORKEE_ASSERTX(x) \ 57 do { \ 58 int ret = (x); \ 59 if (!ret) \ 60 errx(EXIT_FAILURE, "%s:%d %s(): Assertion failed for: %s", \ 61 __FILE__, __LINE__, __func__, #x); \ 62 } while (0) 63 64 #define FORKEE_ASSERT(x) \ 65 do { \ 66 int ret = (x); \ 67 if (!ret) \ 68 err(EXIT_FAILURE, "%s:%d %s(): Assertion failed for: %s", \ 69 __FILE__, __LINE__, __func__, #x); \ 70 } while (0) 71 72 ATF_TC(attach_pid0); 73 ATF_TC_HEAD(attach_pid0, tc) 74 { 75 atf_tc_set_md_var(tc, "descr", 76 "Assert that a debugger cannot attach to PID 0"); 77 } 78 79 ATF_TC_BODY(attach_pid0, tc) 80 { 81 errno = 0; 82 ATF_REQUIRE_ERRNO(EPERM, ptrace(PT_ATTACH, 0, NULL, 0) == -1); 83 } 84 85 ATF_TC(attach_pid1); 86 ATF_TC_HEAD(attach_pid1, tc) 87 { 88 atf_tc_set_md_var(tc, "descr", 89 "Assert that a debugger cannot attach to PID 1 (as non-root)"); 90 91 atf_tc_set_md_var(tc, "require.user", "unprivileged"); 92 } 93 94 ATF_TC_BODY(attach_pid1, tc) 95 { 96 ATF_REQUIRE_ERRNO(EPERM, ptrace(PT_ATTACH, 1, NULL, 0) == -1); 97 } 98 99 ATF_TC(attach_pid1_securelevel); 100 ATF_TC_HEAD(attach_pid1_securelevel, tc) 101 { 102 atf_tc_set_md_var(tc, "descr", 103 "Assert that a debugger cannot attach to PID 1 with " 104 "securelevel >= 0 (as root)"); 105 106 atf_tc_set_md_var(tc, "require.user", "root"); 107 } 108 109 ATF_TC_BODY(attach_pid1_securelevel, tc) 110 { 111 int level; 112 size_t len = sizeof(level); 113 114 ATF_REQUIRE(sysctlbyname("kern.securelevel", &level, &len, NULL, 0) 115 != -1); 116 117 if (level < 0) { 118 atf_tc_skip("Test must be run with securelevel >= 0"); 119 } 120 121 ATF_REQUIRE_ERRNO(EPERM, ptrace(PT_ATTACH, 1, NULL, 0) == -1); 122 } 123 124 ATF_TC(attach_self); 125 ATF_TC_HEAD(attach_self, tc) 126 { 127 atf_tc_set_md_var(tc, "descr", 128 "Assert that a debugger cannot attach to self (as it's nonsense)"); 129 } 130 131 ATF_TC_BODY(attach_self, tc) 132 { 133 ATF_REQUIRE_ERRNO(EINVAL, ptrace(PT_ATTACH, getpid(), NULL, 0) == -1); 134 } 135 136 ATF_TC(attach_chroot); 137 ATF_TC_HEAD(attach_chroot, tc) 138 { 139 atf_tc_set_md_var(tc, "descr", 140 "Assert that a debugger cannot trace another process unless the " 141 "process's root directory is at or below the tracing process's " 142 "root"); 143 144 atf_tc_set_md_var(tc, "require.user", "root"); 145 } 146 147 ATF_TC_BODY(attach_chroot, tc) 148 { 149 char buf[PATH_MAX]; 150 pid_t child; 151 int fds_toparent[2], fds_fromparent[2]; 152 int rv; 153 uint8_t msg = 0xde; /* dummy message for IPC based on pipe(2) */ 154 155 (void)memset(buf, '\0', sizeof(buf)); 156 ATF_REQUIRE(getcwd(buf, sizeof(buf)) != NULL); 157 (void)strlcat(buf, "/dir", sizeof(buf)); 158 159 ATF_REQUIRE(mkdir(buf, 0500) == 0); 160 ATF_REQUIRE(chdir(buf) == 0); 161 162 ATF_REQUIRE(pipe(fds_toparent) == 0); 163 ATF_REQUIRE(pipe(fds_fromparent) == 0); 164 child = atf_utils_fork(); 165 if (child == 0) { 166 FORKEE_ASSERT(close(fds_toparent[0]) == 0); 167 FORKEE_ASSERT(close(fds_fromparent[1]) == 0); 168 169 FORKEE_ASSERT(chroot(buf) == 0); 170 171 rv = write(fds_toparent[1], &msg, sizeof(msg)); 172 FORKEE_ASSERTX(rv == sizeof(msg)); 173 174 ATF_REQUIRE_ERRNO(EINVAL, 175 ptrace(PT_ATTACH, getppid(), NULL, 0) == -1); 176 177 rv = read(fds_fromparent[0], &msg, sizeof(msg)); 178 FORKEE_ASSERTX(rv == sizeof(msg)); 179 180 _exit(0); 181 } 182 ATF_REQUIRE(close(fds_toparent[1]) == 0); 183 ATF_REQUIRE(close(fds_fromparent[0]) == 0); 184 185 printf("Waiting for chrooting of the child PID %d\n", child); 186 rv = read(fds_toparent[0], &msg, sizeof(msg)); 187 ATF_REQUIRE(rv == sizeof(msg)); 188 189 printf("Child is ready, it will try to PT_ATTACH to parent\n"); 190 rv = write(fds_fromparent[1], &msg, sizeof(msg)); 191 ATF_REQUIRE(rv == sizeof(msg)); 192 193 printf("fds_fromparent is no longer needed - close it\n"); 194 ATF_REQUIRE(close(fds_fromparent[1]) == 0); 195 196 printf("fds_toparent is no longer needed - close it\n"); 197 ATF_REQUIRE(close(fds_toparent[0]) == 0); 198 } 199 200 ATF_TC(traceme_twice); 201 ATF_TC_HEAD(traceme_twice, tc) 202 { 203 atf_tc_set_md_var(tc, "descr", 204 "Assert that a process cannot mark its parent a debugger twice"); 205 } 206 207 ATF_TC_BODY(traceme_twice, tc) 208 { 209 210 printf("Mark the parent process (PID %d) a debugger of PID %d\n", 211 getppid(), getpid()); 212 ATF_REQUIRE(ptrace(PT_TRACE_ME, 0, NULL, 0) == 0); 213 214 printf("Mark the parent process (PID %d) a debugger of PID %d again\n", 215 getppid(), getpid()); 216 ATF_REQUIRE_ERRNO(EBUSY, ptrace(PT_TRACE_ME, 0, NULL, 0) == -1); 217 } 218 219 ATF_TP_ADD_TCS(tp) 220 { 221 setvbuf(stdout, NULL, _IONBF, 0); 222 setvbuf(stderr, NULL, _IONBF, 0); 223 ATF_TP_ADD_TC(tp, attach_pid0); 224 ATF_TP_ADD_TC(tp, attach_pid1); 225 ATF_TP_ADD_TC(tp, attach_pid1_securelevel); 226 ATF_TP_ADD_TC(tp, attach_self); 227 ATF_TP_ADD_TC(tp, attach_chroot); 228 ATF_TP_ADD_TC(tp, traceme_twice); 229 230 return atf_no_error(); 231 } 232