1 /* $OpenBSD: sys_process.c,v 1.36 2006/07/19 18:38:42 grunk Exp $ */ 2 /* $NetBSD: sys_process.c,v 1.55 1996/05/15 06:17:47 tls Exp $ */ 3 4 /*- 5 * Copyright (c) 1994 Christopher G. Demetriou. All rights reserved. 6 * Copyright (c) 1982, 1986, 1989, 1993 7 * The Regents of the University of California. All rights reserved. 8 * (c) UNIX System Laboratories, Inc. 9 * All or some portions of this file are derived from material licensed 10 * to the University of California by American Telephone and Telegraph 11 * Co. or Unix System Laboratories, Inc. and are reproduced herein with 12 * the permission of UNIX System Laboratories, Inc. 13 * 14 * Redistribution and use in source and binary forms, with or without 15 * modification, are permitted provided that the following conditions 16 * are met: 17 * 1. Redistributions of source code must retain the above copyright 18 * notice, this list of conditions and the following disclaimer. 19 * 2. Redistributions in binary form must reproduce the above copyright 20 * notice, this list of conditions and the following disclaimer in the 21 * documentation and/or other materials provided with the distribution. 22 * 3. Neither the name of the University nor the names of its contributors 23 * may be used to endorse or promote products derived from this software 24 * without specific prior written permission. 25 * 26 * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND 27 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 28 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 29 * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE 30 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 31 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 32 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 33 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 34 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 35 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 36 * SUCH DAMAGE. 37 * 38 * from: @(#)sys_process.c 8.1 (Berkeley) 6/10/93 39 */ 40 41 /* 42 * References: 43 * (1) Bach's "The Design of the UNIX Operating System", 44 * (2) sys/miscfs/procfs from UCB's 4.4BSD-Lite distribution, 45 * (3) the "4.4BSD Programmer's Reference Manual" published 46 * by USENIX and O'Reilly & Associates. 47 * The 4.4BSD PRM does a reasonably good job of documenting what the various 48 * ptrace() requests should actually do, and its text is quoted several times 49 * in this file. 50 */ 51 52 #include <sys/param.h> 53 #include <sys/systm.h> 54 #include <sys/proc.h> 55 #include <sys/signalvar.h> 56 #include <sys/errno.h> 57 #include <sys/malloc.h> 58 #include <sys/ptrace.h> 59 #include <sys/uio.h> 60 #include <sys/user.h> 61 #include <sys/sched.h> 62 63 #include <sys/mount.h> 64 #include <sys/syscallargs.h> 65 66 #include <uvm/uvm_extern.h> 67 68 #include <machine/reg.h> 69 70 #ifdef PTRACE 71 /* 72 * Process debugging system call. 73 */ 74 int 75 sys_ptrace(struct proc *p, void *v, register_t *retval) 76 { 77 struct sys_ptrace_args /* { 78 syscallarg(int) req; 79 syscallarg(pid_t) pid; 80 syscallarg(caddr_t) addr; 81 syscallarg(int) data; 82 } */ *uap = v; 83 struct proc *t; /* target process */ 84 struct uio uio; 85 struct iovec iov; 86 struct ptrace_io_desc piod; 87 struct ptrace_event pe; 88 struct reg *regs; 89 #if defined (PT_SETFPREGS) || defined (PT_GETFPREGS) 90 struct fpreg *fpregs; 91 #endif 92 #if defined (PT_SETXMMREGS) || defined (PT_GETXMMREGS) 93 struct xmmregs *xmmregs; 94 #endif 95 #ifdef PT_WCOOKIE 96 register_t wcookie; 97 #endif 98 int error, write; 99 int temp; 100 int req; 101 int s; 102 103 /* "A foolish consistency..." XXX */ 104 if (SCARG(uap, req) == PT_TRACE_ME) 105 t = p; 106 else { 107 108 /* Find the process we're supposed to be operating on. */ 109 if ((t = pfind(SCARG(uap, pid))) == NULL) 110 return (ESRCH); 111 } 112 113 if ((t->p_flag & P_INEXEC) != 0) 114 return (EAGAIN); 115 116 /* Make sure we can operate on it. */ 117 switch (SCARG(uap, req)) { 118 case PT_TRACE_ME: 119 /* Saying that you're being traced is always legal. */ 120 break; 121 122 case PT_ATTACH: 123 /* 124 * You can't attach to a process if: 125 * (1) it's the process that's doing the attaching, 126 */ 127 if (t->p_pid == p->p_pid) 128 return (EINVAL); 129 130 /* 131 * (2) it's a system process 132 */ 133 if (ISSET(t->p_flag, P_SYSTEM)) 134 return (EPERM); 135 136 /* 137 * (3) it's already being traced, or 138 */ 139 if (ISSET(t->p_flag, P_TRACED)) 140 return (EBUSY); 141 142 /* 143 * (4) it's not owned by you, or the last exec 144 * gave us setuid/setgid privs (unless 145 * you're root), or... 146 * 147 * [Note: once P_SUGID or P_SUGIDEXEC gets set in 148 * execve(), they stay set until the process does 149 * another execve(). Hence this prevents a setuid 150 * process which revokes it's special privileges using 151 * setuid() from being traced. This is good security.] 152 */ 153 if ((t->p_cred->p_ruid != p->p_cred->p_ruid || 154 ISSET(t->p_flag, P_SUGIDEXEC) || 155 ISSET(t->p_flag, P_SUGID)) && 156 (error = suser(p, 0)) != 0) 157 return (error); 158 159 /* 160 * (5) ...it's init, which controls the security level 161 * of the entire system, and the system was not 162 * compiled with permanently insecure mode turned 163 * on. 164 */ 165 if ((t->p_pid == 1) && (securelevel > -1)) 166 return (EPERM); 167 break; 168 169 case PT_READ_I: 170 case PT_READ_D: 171 case PT_WRITE_I: 172 case PT_WRITE_D: 173 case PT_IO: 174 case PT_CONTINUE: 175 case PT_KILL: 176 case PT_DETACH: 177 #ifdef PT_STEP 178 case PT_STEP: 179 #endif 180 case PT_SET_EVENT_MASK: 181 case PT_GET_EVENT_MASK: 182 case PT_GET_PROCESS_STATE: 183 case PT_GETREGS: 184 case PT_SETREGS: 185 #ifdef PT_GETFPREGS 186 case PT_GETFPREGS: 187 #endif 188 #ifdef PT_SETFPREGS 189 case PT_SETFPREGS: 190 #endif 191 #ifdef PT_GETXMMREGS 192 case PT_GETXMMREGS: 193 #endif 194 #ifdef PT_SETXMMREGS 195 case PT_SETXMMREGS: 196 #endif 197 #ifdef PT_WCOOKIE 198 case PT_WCOOKIE: 199 #endif 200 /* 201 * You can't do what you want to the process if: 202 * (1) It's not being traced at all, 203 */ 204 if (!ISSET(t->p_flag, P_TRACED)) 205 return (EPERM); 206 207 /* 208 * (2) it's not being traced by _you_, or 209 */ 210 if (t->p_pptr != p) 211 return (EBUSY); 212 213 /* 214 * (3) it's not currently stopped. 215 */ 216 if (t->p_stat != SSTOP || !ISSET(t->p_flag, P_WAITED)) 217 return (EBUSY); 218 break; 219 220 default: /* It was not a legal request. */ 221 return (EINVAL); 222 } 223 224 /* Do single-step fixup if needed. */ 225 FIX_SSTEP(t); 226 227 /* Now do the operation. */ 228 write = 0; 229 *retval = 0; 230 231 switch (SCARG(uap, req)) { 232 case PT_TRACE_ME: 233 /* Just set the trace flag. */ 234 SET(t->p_flag, P_TRACED); 235 t->p_oppid = t->p_pptr->p_pid; 236 if (t->p_ptstat == NULL) 237 t->p_ptstat = malloc(sizeof(*t->p_ptstat), 238 M_SUBPROC, M_WAITOK); 239 bzero(t->p_ptstat, sizeof(*t->p_ptstat)); 240 return (0); 241 242 case PT_WRITE_I: /* XXX no separate I and D spaces */ 243 case PT_WRITE_D: 244 write = 1; 245 temp = SCARG(uap, data); 246 case PT_READ_I: /* XXX no separate I and D spaces */ 247 case PT_READ_D: 248 /* write = 0 done above. */ 249 iov.iov_base = (caddr_t)&temp; 250 iov.iov_len = sizeof(int); 251 uio.uio_iov = &iov; 252 uio.uio_iovcnt = 1; 253 uio.uio_offset = (off_t)(long)SCARG(uap, addr); 254 uio.uio_resid = sizeof(int); 255 uio.uio_segflg = UIO_SYSSPACE; 256 uio.uio_rw = write ? UIO_WRITE : UIO_READ; 257 uio.uio_procp = p; 258 error = process_domem(p, t, &uio, write ? PT_WRITE_I : 259 PT_READ_I); 260 if (write == 0) 261 *retval = temp; 262 return (error); 263 case PT_IO: 264 error = copyin(SCARG(uap, addr), &piod, sizeof(piod)); 265 if (error) 266 return (error); 267 iov.iov_base = piod.piod_addr; 268 iov.iov_len = piod.piod_len; 269 uio.uio_iov = &iov; 270 uio.uio_iovcnt = 1; 271 uio.uio_offset = (off_t)(long)piod.piod_offs; 272 uio.uio_resid = piod.piod_len; 273 uio.uio_segflg = UIO_USERSPACE; 274 uio.uio_procp = p; 275 switch (piod.piod_op) { 276 case PIOD_READ_I: 277 req = PT_READ_I; 278 uio.uio_rw = UIO_READ; 279 break; 280 case PIOD_READ_D: 281 req = PT_READ_D; 282 uio.uio_rw = UIO_READ; 283 break; 284 case PIOD_WRITE_I: 285 req = PT_WRITE_I; 286 uio.uio_rw = UIO_WRITE; 287 break; 288 case PIOD_WRITE_D: 289 req = PT_WRITE_D; 290 uio.uio_rw = UIO_WRITE; 291 break; 292 default: 293 return (EINVAL); 294 } 295 error = process_domem(p, t, &uio, req); 296 piod.piod_len -= uio.uio_resid; 297 (void) copyout(&piod, SCARG(uap, addr), sizeof(piod)); 298 return (error); 299 #ifdef PT_STEP 300 case PT_STEP: 301 /* 302 * From the 4.4BSD PRM: 303 * "Execution continues as in request PT_CONTINUE; however 304 * as soon as possible after execution of at least one 305 * instruction, execution stops again. [ ... ]" 306 */ 307 #endif 308 case PT_CONTINUE: 309 /* 310 * From the 4.4BSD PRM: 311 * "The data argument is taken as a signal number and the 312 * child's execution continues at location addr as if it 313 * incurred that signal. Normally the signal number will 314 * be either 0 to indicate that the signal that caused the 315 * stop should be ignored, or that value fetched out of 316 * the process's image indicating which signal caused 317 * the stop. If addr is (int *)1 then execution continues 318 * from where it stopped." 319 */ 320 321 /* Check that the data is a valid signal number or zero. */ 322 if (SCARG(uap, data) < 0 || SCARG(uap, data) >= NSIG) 323 return (EINVAL); 324 325 PHOLD(t); 326 /* If the address parameter is not (int *)1, set the pc. */ 327 if ((int *)SCARG(uap, addr) != (int *)1) 328 if ((error = process_set_pc(t, SCARG(uap, addr))) != 0) 329 goto relebad; 330 331 #ifdef PT_STEP 332 /* 333 * Arrange for a single-step, if that's requested and possible. 334 */ 335 error = process_sstep(t, SCARG(uap, req) == PT_STEP); 336 if (error) 337 goto relebad; 338 #endif 339 PRELE(t); 340 goto sendsig; 341 342 case PT_DETACH: 343 /* 344 * From the 4.4BSD PRM: 345 * "The data argument is taken as a signal number and the 346 * child's execution continues at location addr as if it 347 * incurred that signal. Normally the signal number will 348 * be either 0 to indicate that the signal that caused the 349 * stop should be ignored, or that value fetched out of 350 * the process's image indicating which signal caused 351 * the stop. If addr is (int *)1 then execution continues 352 * from where it stopped." 353 */ 354 355 /* Check that the data is a valid signal number or zero. */ 356 if (SCARG(uap, data) < 0 || SCARG(uap, data) >= NSIG) 357 return (EINVAL); 358 359 PHOLD(t); 360 #ifdef PT_STEP 361 /* 362 * Arrange for a single-step, if that's requested and possible. 363 */ 364 error = process_sstep(t, SCARG(uap, req) == PT_STEP); 365 if (error) 366 goto relebad; 367 #endif 368 PRELE(t); 369 370 /* give process back to original parent or init */ 371 if (t->p_oppid != t->p_pptr->p_pid) { 372 struct proc *pp; 373 374 pp = pfind(t->p_oppid); 375 proc_reparent(t, pp ? pp : initproc); 376 } 377 378 /* not being traced any more */ 379 t->p_oppid = 0; 380 CLR(t->p_flag, P_TRACED|P_WAITED); 381 382 sendsig: 383 bzero(t->p_ptstat, sizeof(*t->p_ptstat)); 384 385 /* Finally, deliver the requested signal (or none). */ 386 if (t->p_stat == SSTOP) { 387 t->p_xstat = SCARG(uap, data); 388 SCHED_LOCK(s); 389 setrunnable(t); 390 SCHED_UNLOCK(s); 391 } else { 392 if (SCARG(uap, data) != 0) 393 psignal(t, SCARG(uap, data)); 394 } 395 return (0); 396 397 relebad: 398 PRELE(t); 399 return (error); 400 401 case PT_KILL: 402 /* just send the process a KILL signal. */ 403 SCARG(uap, data) = SIGKILL; 404 goto sendsig; /* in PT_CONTINUE, above. */ 405 406 case PT_ATTACH: 407 /* 408 * As done in procfs: 409 * Go ahead and set the trace flag. 410 * Save the old parent (it's reset in 411 * _DETACH, and also in kern_exit.c:wait4() 412 * Reparent the process so that the tracing 413 * proc gets to see all the action. 414 * Stop the target. 415 */ 416 SET(t->p_flag, P_TRACED); 417 t->p_oppid = t->p_pptr->p_pid; 418 if (t->p_pptr != p) 419 proc_reparent(t, p); 420 if (t->p_ptstat == NULL) 421 t->p_ptstat = malloc(sizeof(*t->p_ptstat), 422 M_SUBPROC, M_WAITOK); 423 SCARG(uap, data) = SIGSTOP; 424 goto sendsig; 425 426 case PT_GET_EVENT_MASK: 427 if (SCARG(uap, data) != sizeof(pe)) 428 return (EINVAL); 429 bzero(&pe, sizeof(pe)); 430 pe.pe_set_event = t->p_ptmask; 431 return (copyout(&pe, SCARG(uap, addr), sizeof(pe))); 432 case PT_SET_EVENT_MASK: 433 if (SCARG(uap, data) != sizeof(pe)) 434 return (EINVAL); 435 if ((error = copyin(SCARG(uap, addr), &pe, sizeof(pe)))) 436 return (error); 437 t->p_ptmask = pe.pe_set_event; 438 return (0); 439 440 case PT_GET_PROCESS_STATE: 441 if (SCARG(uap, data) != sizeof(*t->p_ptstat)) 442 return (EINVAL); 443 return (copyout(t->p_ptstat, SCARG(uap, addr), 444 sizeof(*t->p_ptstat))); 445 446 case PT_SETREGS: 447 KASSERT((p->p_flag & P_SYSTEM) == 0); 448 if ((error = process_checkioperm(p, t)) != 0) 449 return (error); 450 451 regs = malloc(sizeof(*regs), M_TEMP, M_WAITOK); 452 error = copyin(SCARG(uap, addr), regs, sizeof(*regs)); 453 if (error == 0) { 454 PHOLD(p); 455 error = process_write_regs(t, regs); 456 PRELE(p); 457 } 458 free(regs, M_TEMP); 459 return (error); 460 case PT_GETREGS: 461 KASSERT((p->p_flag & P_SYSTEM) == 0); 462 if ((error = process_checkioperm(p, t)) != 0) 463 return (error); 464 465 regs = malloc(sizeof(*regs), M_TEMP, M_WAITOK); 466 PHOLD(p); 467 error = process_read_regs(t, regs); 468 PRELE(p); 469 if (error == 0) 470 error = copyout(regs, 471 SCARG(uap, addr), sizeof (*regs)); 472 free(regs, M_TEMP); 473 return (error); 474 #ifdef PT_SETFPREGS 475 case PT_SETFPREGS: 476 KASSERT((p->p_flag & P_SYSTEM) == 0); 477 if ((error = process_checkioperm(p, t)) != 0) 478 return (error); 479 480 fpregs = malloc(sizeof(*fpregs), M_TEMP, M_WAITOK); 481 error = copyin(SCARG(uap, addr), fpregs, sizeof(*fpregs)); 482 if (error == 0) { 483 PHOLD(p); 484 error = process_write_fpregs(t, fpregs); 485 PRELE(p); 486 } 487 free(fpregs, M_TEMP); 488 return (error); 489 #endif 490 #ifdef PT_GETFPREGS 491 case PT_GETFPREGS: 492 KASSERT((p->p_flag & P_SYSTEM) == 0); 493 if ((error = process_checkioperm(p, t)) != 0) 494 return (error); 495 496 fpregs = malloc(sizeof(*fpregs), M_TEMP, M_WAITOK); 497 PHOLD(p); 498 error = process_read_fpregs(t, fpregs); 499 PRELE(p); 500 if (error == 0) 501 error = copyout(fpregs, 502 SCARG(uap, addr), sizeof(*fpregs)); 503 free(fpregs, M_TEMP); 504 return (error); 505 #endif 506 #ifdef PT_SETXMMREGS 507 case PT_SETXMMREGS: 508 KASSERT((p->p_flag & P_SYSTEM) == 0); 509 if ((error = process_checkioperm(p, t)) != 0) 510 return (error); 511 512 xmmregs = malloc(sizeof(*xmmregs), M_TEMP, M_WAITOK); 513 error = copyin(SCARG(uap, addr), xmmregs, sizeof(*xmmregs)); 514 if (error == 0) { 515 PHOLD(p); 516 error = process_write_xmmregs(t, xmmregs); 517 PRELE(p); 518 } 519 free(xmmregs, M_TEMP); 520 return (error); 521 #endif 522 #ifdef PT_GETXMMREGS 523 case PT_GETXMMREGS: 524 KASSERT((p->p_flag & P_SYSTEM) == 0); 525 if ((error = process_checkioperm(p, t)) != 0) 526 return (error); 527 528 xmmregs = malloc(sizeof(*xmmregs), M_TEMP, M_WAITOK); 529 PHOLD(p); 530 error = process_read_xmmregs(t, xmmregs); 531 PRELE(p); 532 if (error == 0) 533 error = copyout(xmmregs, 534 SCARG(uap, addr), sizeof(*xmmregs)); 535 free(xmmregs, M_TEMP); 536 return (error); 537 #endif 538 #ifdef PT_WCOOKIE 539 case PT_WCOOKIE: 540 wcookie = process_get_wcookie (t); 541 return (copyout(&wcookie, SCARG(uap, addr), 542 sizeof (register_t))); 543 #endif 544 } 545 546 #ifdef DIAGNOSTIC 547 panic("ptrace: impossible"); 548 #endif 549 return 0; 550 } 551 #endif /* PTRACE */ 552 553 /* 554 * Check if a process is allowed to fiddle with the memory of another. 555 * 556 * p = tracer 557 * t = tracee 558 * 559 * 1. You can't attach to a process not owned by you or one that has raised 560 * its privileges. 561 * 1a. ...unless you are root. 562 * 563 * 2. init is always off-limits because it can control the securelevel. 564 * 2a. ...unless securelevel is permanently set to insecure. 565 * 566 * 3. Processes that are in the process of doing an exec() are always 567 * off-limits because of the can of worms they are. Just wait a 568 * second. 569 */ 570 int 571 process_checkioperm(struct proc *p, struct proc *t) 572 { 573 int error; 574 575 if ((t->p_cred->p_ruid != p->p_cred->p_ruid || 576 ISSET(t->p_flag, P_SUGIDEXEC) || 577 ISSET(t->p_flag, P_SUGID)) && 578 (error = suser(p, 0)) != 0) 579 return (error); 580 581 if ((t->p_pid == 1) && (securelevel > -1)) 582 return (EPERM); 583 584 if (t->p_flag & P_INEXEC) 585 return (EAGAIN); 586 587 return (0); 588 } 589 590 int 591 process_domem(struct proc *curp, struct proc *p, struct uio *uio, int req) 592 { 593 int error; 594 vaddr_t addr; 595 vsize_t len; 596 597 len = uio->uio_resid; 598 if (len == 0) 599 return (0); 600 601 if ((error = process_checkioperm(curp, p)) != 0) 602 return (error); 603 604 /* XXXCDC: how should locking work here? */ 605 if ((p->p_flag & P_WEXIT) || (p->p_vmspace->vm_refcnt < 1)) 606 return(EFAULT); 607 addr = uio->uio_offset; 608 p->p_vmspace->vm_refcnt++; /* XXX */ 609 error = uvm_io(&p->p_vmspace->vm_map, uio, 610 (req == PT_WRITE_I) ? UVM_IO_FIXPROT : 0); 611 uvmspace_free(p->p_vmspace); 612 613 if (error == 0 && req == PT_WRITE_I) 614 pmap_proc_iflush(p, addr, len); 615 616 return (error); 617 } 618