xref: /openbsd-src/sys/kern/sys_process.c (revision 0eea0d082377cb9c3ec583313dc4d52b7b6a4d6d)
1 /*	$OpenBSD: sys_process.c,v 1.28 2004/06/13 21:49:26 niklas Exp $	*/
2 /*	$NetBSD: sys_process.c,v 1.55 1996/05/15 06:17:47 tls Exp $	*/
3 
4 /*-
5  * Copyright (c) 1994 Christopher G. Demetriou.  All rights reserved.
6  * Copyright (c) 1982, 1986, 1989, 1993
7  *	The Regents of the University of California.  All rights reserved.
8  * (c) UNIX System Laboratories, Inc.
9  * All or some portions of this file are derived from material licensed
10  * to the University of California by American Telephone and Telegraph
11  * Co. or Unix System Laboratories, Inc. and are reproduced herein with
12  * the permission of UNIX System Laboratories, Inc.
13  *
14  * Redistribution and use in source and binary forms, with or without
15  * modification, are permitted provided that the following conditions
16  * are met:
17  * 1. Redistributions of source code must retain the above copyright
18  *    notice, this list of conditions and the following disclaimer.
19  * 2. Redistributions in binary form must reproduce the above copyright
20  *    notice, this list of conditions and the following disclaimer in the
21  *    documentation and/or other materials provided with the distribution.
22  * 3. Neither the name of the University nor the names of its contributors
23  *    may be used to endorse or promote products derived from this software
24  *    without specific prior written permission.
25  *
26  * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
27  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
28  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
29  * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
30  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
31  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
32  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
33  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
34  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
35  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
36  * SUCH DAMAGE.
37  *
38  *	from: @(#)sys_process.c	8.1 (Berkeley) 6/10/93
39  */
40 
41 /*
42  * References:
43  *	(1) Bach's "The Design of the UNIX Operating System",
44  *	(2) sys/miscfs/procfs from UCB's 4.4BSD-Lite distribution,
45  *	(3) the "4.4BSD Programmer's Reference Manual" published
46  *		by USENIX and O'Reilly & Associates.
47  * The 4.4BSD PRM does a reasonably good job of documenting what the various
48  * ptrace() requests should actually do, and its text is quoted several times
49  * in this file.
50  */
51 
52 #include <sys/param.h>
53 #include <sys/systm.h>
54 #include <sys/proc.h>
55 #include <sys/signalvar.h>
56 #include <sys/errno.h>
57 #include <sys/ptrace.h>
58 #include <sys/uio.h>
59 #include <sys/user.h>
60 #include <sys/sched.h>
61 
62 #include <sys/mount.h>
63 #include <sys/syscallargs.h>
64 
65 #include <uvm/uvm_extern.h>
66 
67 #include <machine/reg.h>
68 
69 #include <miscfs/procfs/procfs.h>
70 
71 /*
72  * Process debugging system call.
73  */
74 int
75 sys_ptrace(p, v, retval)
76 	struct proc *p;
77 	void *v;
78 	register_t *retval;
79 {
80 	struct sys_ptrace_args /* {
81 		syscallarg(int) req;
82 		syscallarg(pid_t) pid;
83 		syscallarg(caddr_t) addr;
84 		syscallarg(int) data;
85 	} */ *uap = v;
86 	struct proc *t;				/* target process */
87 	struct uio uio;
88 	struct iovec iov;
89 	struct ptrace_io_desc piod;
90 #ifdef PT_WCOOKIE
91 	register_t wcookie;
92 #endif
93 	int error, write;
94 	int temp;
95 	int s;
96 
97 	/* "A foolish consistency..." XXX */
98 	if (SCARG(uap, req) == PT_TRACE_ME)
99 		t = p;
100 	else {
101 
102 		/* Find the process we're supposed to be operating on. */
103 		if ((t = pfind(SCARG(uap, pid))) == NULL)
104 			return (ESRCH);
105 	}
106 
107 	if ((t->p_flag & P_INEXEC) != 0)
108 		return (EAGAIN);
109 
110 	/* Make sure we can operate on it. */
111 	switch (SCARG(uap, req)) {
112 	case  PT_TRACE_ME:
113 		/* Saying that you're being traced is always legal. */
114 		break;
115 
116 	case  PT_ATTACH:
117 		/*
118 		 * You can't attach to a process if:
119 		 *	(1) it's the process that's doing the attaching,
120 		 */
121 		if (t->p_pid == p->p_pid)
122 			return (EINVAL);
123 
124 		/*
125 		 *	(2) it's a system process
126 		 */
127 		if (ISSET(t->p_flag, P_SYSTEM))
128 			return (EPERM);
129 
130 		/*
131 		 *	(3) it's already being traced, or
132 		 */
133 		if (ISSET(t->p_flag, P_TRACED))
134 			return (EBUSY);
135 
136 		/*
137 		 *	(4) it's not owned by you, or the last exec
138 		 *	    gave us setuid/setgid privs (unless
139 		 *	    you're root), or...
140 		 *
141 		 *      [Note: once P_SUGID or P_SUGIDEXEC gets set in
142 		 *	execve(), they stay set until the process does
143 		 *	another execve().  Hence this prevents a setuid
144 		 *	process which revokes it's special privileges using
145 		 *	setuid() from being traced.  This is good security.]
146 		 */
147 		if ((t->p_cred->p_ruid != p->p_cred->p_ruid ||
148 		    ISSET(t->p_flag, P_SUGIDEXEC) ||
149 		    ISSET(t->p_flag, P_SUGID)) &&
150 		    (error = suser(p, 0)) != 0)
151 			return (error);
152 
153 		/*
154 		 *	(5) ...it's init, which controls the security level
155 		 *	    of the entire system, and the system was not
156 		 *          compiled with permanently insecure mode turned
157 		 *	    on.
158 		 */
159 		if ((t->p_pid == 1) && (securelevel > -1))
160 			return (EPERM);
161 		break;
162 
163 	case  PT_READ_I:
164 	case  PT_READ_D:
165 	case  PT_WRITE_I:
166 	case  PT_WRITE_D:
167 	case  PT_IO:
168 	case  PT_CONTINUE:
169 	case  PT_KILL:
170 	case  PT_DETACH:
171 #ifdef PT_STEP
172 	case  PT_STEP:
173 #endif
174 	case  PT_GETREGS:
175 	case  PT_SETREGS:
176 #ifdef PT_GETFPREGS
177 	case  PT_GETFPREGS:
178 #endif
179 #ifdef PT_SETFPREGS
180 	case  PT_SETFPREGS:
181 #endif
182 #ifdef PT_WCOOKIE
183 	case  PT_WCOOKIE:
184 #endif
185 		/*
186 		 * You can't do what you want to the process if:
187 		 *	(1) It's not being traced at all,
188 		 */
189 		if (!ISSET(t->p_flag, P_TRACED))
190 			return (EPERM);
191 
192 		/*
193 		 *	(2) it's not being traced by _you_, or
194 		 */
195 		if (t->p_pptr != p)
196 			return (EBUSY);
197 
198 		/*
199 		 *	(3) it's not currently stopped.
200 		 */
201 		if (t->p_stat != SSTOP || !ISSET(t->p_flag, P_WAITED))
202 			return (EBUSY);
203 		break;
204 
205 	default:			/* It was not a legal request. */
206 		return (EINVAL);
207 	}
208 
209 	/* Do single-step fixup if needed. */
210 	FIX_SSTEP(t);
211 
212 	/* Now do the operation. */
213 	write = 0;
214 	*retval = 0;
215 
216 	switch (SCARG(uap, req)) {
217 	case  PT_TRACE_ME:
218 		/* Just set the trace flag. */
219 		SET(t->p_flag, P_TRACED);
220 		t->p_oppid = t->p_pptr->p_pid;
221 		return (0);
222 
223 	case  PT_WRITE_I:		/* XXX no separate I and D spaces */
224 	case  PT_WRITE_D:
225 		write = 1;
226 		temp = SCARG(uap, data);
227 	case  PT_READ_I:		/* XXX no separate I and D spaces */
228 	case  PT_READ_D:
229 		/* write = 0 done above. */
230 		iov.iov_base = (caddr_t)&temp;
231 		iov.iov_len = sizeof(int);
232 		uio.uio_iov = &iov;
233 		uio.uio_iovcnt = 1;
234 		uio.uio_offset = (off_t)(long)SCARG(uap, addr);
235 		uio.uio_resid = sizeof(int);
236 		uio.uio_segflg = UIO_SYSSPACE;
237 		uio.uio_rw = write ? UIO_WRITE : UIO_READ;
238 		uio.uio_procp = p;
239 		error = procfs_domem(p, t, NULL, &uio);
240 		if (write == 0)
241 			*retval = temp;
242 		return (error);
243 	case  PT_IO:
244 		error = copyin(SCARG(uap, addr), &piod, sizeof(piod));
245 		if (error)
246 			return (error);
247 		iov.iov_base = piod.piod_addr;
248 		iov.iov_len = piod.piod_len;
249 		uio.uio_iov = &iov;
250 		uio.uio_iovcnt = 1;
251 		uio.uio_offset = (off_t)(long)piod.piod_offs;
252 		uio.uio_resid = piod.piod_len;
253 		uio.uio_segflg = UIO_USERSPACE;
254 		uio.uio_procp = p;
255 		switch (piod.piod_op) {
256 		case PIOD_READ_D:
257 		case PIOD_READ_I:
258 			uio.uio_rw = UIO_READ;
259 			break;
260 		case PIOD_WRITE_D:
261 		case PIOD_WRITE_I:
262 			uio.uio_rw = UIO_WRITE;
263 			break;
264 		default:
265 			return (EINVAL);
266 		}
267 		error = procfs_domem(p, t, NULL, &uio);
268 		piod.piod_len -= uio.uio_resid;
269 		(void) copyout(&piod, SCARG(uap, addr), sizeof(piod));
270 		return (error);
271 #ifdef PT_STEP
272 	case  PT_STEP:
273 		/*
274 		 * From the 4.4BSD PRM:
275 		 * "Execution continues as in request PT_CONTINUE; however
276 		 * as soon as possible after execution of at least one
277 		 * instruction, execution stops again. [ ... ]"
278 		 */
279 #endif
280 	case  PT_CONTINUE:
281 		/*
282 		 * From the 4.4BSD PRM:
283 		 * "The data argument is taken as a signal number and the
284 		 * child's execution continues at location addr as if it
285 		 * incurred that signal.  Normally the signal number will
286 		 * be either 0 to indicate that the signal that caused the
287 		 * stop should be ignored, or that value fetched out of
288 		 * the process's image indicating which signal caused
289 		 * the stop.  If addr is (int *)1 then execution continues
290 		 * from where it stopped."
291 		 */
292 
293 		/* Check that the data is a valid signal number or zero. */
294 		if (SCARG(uap, data) < 0 || SCARG(uap, data) >= NSIG)
295 			return (EINVAL);
296 
297 		PHOLD(t);
298 		/* If the address paramter is not (int *)1, set the pc. */
299 		if ((int *)SCARG(uap, addr) != (int *)1)
300 			if ((error = process_set_pc(t, SCARG(uap, addr))) != 0)
301 				goto relebad;
302 
303 #ifdef PT_STEP
304 		/*
305 		 * Arrange for a single-step, if that's requested and possible.
306 		 */
307 		error = process_sstep(t, SCARG(uap, req) == PT_STEP);
308 		if (error)
309 			goto relebad;
310 #endif
311 		PRELE(t);
312 		goto sendsig;
313 
314 	case  PT_DETACH:
315 		/*
316 		 * From the 4.4BSD PRM:
317 		 * "The data argument is taken as a signal number and the
318 		 * child's execution continues at location addr as if it
319 		 * incurred that signal.  Normally the signal number will
320 		 * be either 0 to indicate that the signal that caused the
321 		 * stop should be ignored, or that value fetched out of
322 		 * the process's image indicating which signal caused
323 		 * the stop.  If addr is (int *)1 then execution continues
324 		 * from where it stopped."
325 		 */
326 
327 		/* Check that the data is a valid signal number or zero. */
328 		if (SCARG(uap, data) < 0 || SCARG(uap, data) >= NSIG)
329 			return (EINVAL);
330 
331 		PHOLD(t);
332 #ifdef PT_STEP
333 		/*
334 		 * Arrange for a single-step, if that's requested and possible.
335 		 */
336 		error = process_sstep(t, SCARG(uap, req) == PT_STEP);
337 		if (error)
338 			goto relebad;
339 #endif
340 		PRELE(t);
341 
342 		/* give process back to original parent or init */
343 		if (t->p_oppid != t->p_pptr->p_pid) {
344 			struct proc *pp;
345 
346 			pp = pfind(t->p_oppid);
347 			proc_reparent(t, pp ? pp : initproc);
348 		}
349 
350 		/* not being traced any more */
351 		t->p_oppid = 0;
352 		CLR(t->p_flag, P_TRACED|P_WAITED);
353 
354 	sendsig:
355 		/* Finally, deliver the requested signal (or none). */
356 		if (t->p_stat == SSTOP) {
357 			t->p_xstat = SCARG(uap, data);
358 			SCHED_LOCK(s);
359 			setrunnable(t);
360 			SCHED_UNLOCK(s);
361 		} else {
362 			if (SCARG(uap, data) != 0)
363 				psignal(t, SCARG(uap, data));
364 		}
365 		return (0);
366 
367 	relebad:
368 		PRELE(t);
369 		return (error);
370 
371 	case  PT_KILL:
372 		/* just send the process a KILL signal. */
373 		SCARG(uap, data) = SIGKILL;
374 		goto sendsig;	/* in PT_CONTINUE, above. */
375 
376 	case  PT_ATTACH:
377 		/*
378 		 * As done in procfs:
379 		 * Go ahead and set the trace flag.
380 		 * Save the old parent (it's reset in
381 		 *   _DETACH, and also in kern_exit.c:wait4()
382 		 * Reparent the process so that the tracing
383 		 *   proc gets to see all the action.
384 		 * Stop the target.
385 		 */
386 		SET(t->p_flag, P_TRACED);
387 		t->p_oppid = t->p_pptr->p_pid;
388 		if (t->p_pptr != p)
389 			proc_reparent(t, p);
390 		SCARG(uap, data) = SIGSTOP;
391 		goto sendsig;
392 
393 	case  PT_SETREGS:
394 		write = 1;
395 	case  PT_GETREGS:
396 		/* write = 0 done above. */
397 		if (!procfs_validregs(t, NULL))
398 			return (EINVAL);
399 		else {
400 			iov.iov_base = SCARG(uap, addr);
401 			iov.iov_len = sizeof(struct reg);
402 			uio.uio_iov = &iov;
403 			uio.uio_iovcnt = 1;
404 			uio.uio_offset = 0;
405 			uio.uio_resid = sizeof(struct reg);
406 			uio.uio_segflg = UIO_USERSPACE;
407 			uio.uio_rw = write ? UIO_WRITE : UIO_READ;
408 			uio.uio_procp = p;
409 			return (procfs_doregs(p, t, NULL, &uio));
410 		}
411 #ifdef PT_SETFPREGS
412 	case  PT_SETFPREGS:
413 		write = 1;
414 #endif
415 #ifdef PT_GETFPREGS
416 	case  PT_GETFPREGS:
417 		/* write = 0 done above. */
418 #endif
419 #if defined(PT_SETFPREGS) || defined(PT_GETFPREGS)
420 		if (!procfs_validfpregs(t, NULL))
421 			return (EINVAL);
422 		else {
423 			iov.iov_base = SCARG(uap, addr);
424 			iov.iov_len = sizeof(struct fpreg);
425 			uio.uio_iov = &iov;
426 			uio.uio_iovcnt = 1;
427 			uio.uio_offset = 0;
428 			uio.uio_resid = sizeof(struct fpreg);
429 			uio.uio_segflg = UIO_USERSPACE;
430 			uio.uio_rw = write ? UIO_WRITE : UIO_READ;
431 			uio.uio_procp = p;
432 			return (procfs_dofpregs(p, t, NULL, &uio));
433 		}
434 #endif
435 #ifdef PT_WCOOKIE
436 	case  PT_WCOOKIE:
437 		wcookie = process_get_wcookie (t);
438 		return (copyout(&wcookie, SCARG(uap, addr),
439 		    sizeof (register_t)));
440 #endif
441 	}
442 
443 #ifdef DIAGNOSTIC
444 	panic("ptrace: impossible");
445 #endif
446 	return 0;
447 }
448