xref: /openbsd-src/sys/kern/sys_process.c (revision db3296cf5c1dd9058ceecc3a29fe4aaa0bd26000)
1 /*	$OpenBSD: sys_process.c,v 1.25 2003/06/02 23:28:06 millert Exp $	*/
2 /*	$NetBSD: sys_process.c,v 1.55 1996/05/15 06:17:47 tls Exp $	*/
3 
4 /*-
5  * Copyright (c) 1994 Christopher G. Demetriou.  All rights reserved.
6  * Copyright (c) 1982, 1986, 1989, 1993
7  *	The Regents of the University of California.  All rights reserved.
8  * (c) UNIX System Laboratories, Inc.
9  * All or some portions of this file are derived from material licensed
10  * to the University of California by American Telephone and Telegraph
11  * Co. or Unix System Laboratories, Inc. and are reproduced herein with
12  * the permission of UNIX System Laboratories, Inc.
13  *
14  * Redistribution and use in source and binary forms, with or without
15  * modification, are permitted provided that the following conditions
16  * are met:
17  * 1. Redistributions of source code must retain the above copyright
18  *    notice, this list of conditions and the following disclaimer.
19  * 2. Redistributions in binary form must reproduce the above copyright
20  *    notice, this list of conditions and the following disclaimer in the
21  *    documentation and/or other materials provided with the distribution.
22  * 3. Neither the name of the University nor the names of its contributors
23  *    may be used to endorse or promote products derived from this software
24  *    without specific prior written permission.
25  *
26  * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
27  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
28  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
29  * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
30  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
31  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
32  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
33  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
34  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
35  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
36  * SUCH DAMAGE.
37  *
38  *	from: @(#)sys_process.c	8.1 (Berkeley) 6/10/93
39  */
40 
41 /*
42  * References:
43  *	(1) Bach's "The Design of the UNIX Operating System",
44  *	(2) sys/miscfs/procfs from UCB's 4.4BSD-Lite distribution,
45  *	(3) the "4.4BSD Programmer's Reference Manual" published
46  *		by USENIX and O'Reilly & Associates.
47  * The 4.4BSD PRM does a reasonably good job of documenting what the various
48  * ptrace() requests should actually do, and its text is quoted several times
49  * in this file.
50  */
51 
52 #include <sys/param.h>
53 #include <sys/systm.h>
54 #include <sys/proc.h>
55 #include <sys/signalvar.h>
56 #include <sys/errno.h>
57 #include <sys/ptrace.h>
58 #include <sys/uio.h>
59 #include <sys/user.h>
60 
61 #include <sys/mount.h>
62 #include <sys/syscallargs.h>
63 
64 #include <uvm/uvm_extern.h>
65 
66 #include <machine/reg.h>
67 
68 #include <miscfs/procfs/procfs.h>
69 
70 /*
71  * Process debugging system call.
72  */
73 int
74 sys_ptrace(p, v, retval)
75 	struct proc *p;
76 	void *v;
77 	register_t *retval;
78 {
79 	struct sys_ptrace_args /* {
80 		syscallarg(int) req;
81 		syscallarg(pid_t) pid;
82 		syscallarg(caddr_t) addr;
83 		syscallarg(int) data;
84 	} */ *uap = v;
85 	struct proc *t;				/* target process */
86 	struct uio uio;
87 	struct iovec iov;
88 	struct ptrace_io_desc piod;
89 	int error, write;
90 	int temp;
91 
92 	/* "A foolish consistency..." XXX */
93 	if (SCARG(uap, req) == PT_TRACE_ME)
94 		t = p;
95 	else {
96 
97 		/* Find the process we're supposed to be operating on. */
98 		if ((t = pfind(SCARG(uap, pid))) == NULL)
99 			return (ESRCH);
100 	}
101 
102 	if ((t->p_flag & P_INEXEC) != 0)
103 		return (EAGAIN);
104 
105 	/* Make sure we can operate on it. */
106 	switch (SCARG(uap, req)) {
107 	case  PT_TRACE_ME:
108 		/* Saying that you're being traced is always legal. */
109 		break;
110 
111 	case  PT_ATTACH:
112 		/*
113 		 * You can't attach to a process if:
114 		 *	(1) it's the process that's doing the attaching,
115 		 */
116 		if (t->p_pid == p->p_pid)
117 			return (EINVAL);
118 
119 		/*
120 		 *	(2) it's a system process
121 		 */
122 		if (ISSET(t->p_flag, P_SYSTEM))
123 			return (EPERM);
124 
125 		/*
126 		 *	(3) it's already being traced, or
127 		 */
128 		if (ISSET(t->p_flag, P_TRACED))
129 			return (EBUSY);
130 
131 		/*
132 		 *	(4) it's not owned by you, or the last exec
133 		 *	    gave us setuid/setgid privs (unless
134 		 *	    you're root), or...
135 		 *
136 		 *      [Note: once P_SUGID or P_SUGIDEXEC gets set in
137 		 *	execve(), they stay set until the process does
138 		 *	another execve().  Hence this prevents a setuid
139 		 *	process which revokes it's special privileges using
140 		 *	setuid() from being traced.  This is good security.]
141 		 */
142 		if ((t->p_cred->p_ruid != p->p_cred->p_ruid ||
143 		    ISSET(t->p_flag, P_SUGIDEXEC) ||
144 		    ISSET(t->p_flag, P_SUGID)) &&
145 		    (error = suser(p->p_ucred, &p->p_acflag)) != 0)
146 			return (error);
147 
148 		/*
149 		 *	(5) ...it's init, which controls the security level
150 		 *	    of the entire system, and the system was not
151 		 *          compiled with permanently insecure mode turned
152 		 *	    on.
153 		 */
154 		if ((t->p_pid == 1) && (securelevel > -1))
155 			return (EPERM);
156 		break;
157 
158 	case  PT_READ_I:
159 	case  PT_READ_D:
160 	case  PT_WRITE_I:
161 	case  PT_WRITE_D:
162 	case  PT_IO:
163 	case  PT_CONTINUE:
164 	case  PT_KILL:
165 	case  PT_DETACH:
166 #ifdef PT_STEP
167 	case  PT_STEP:
168 #endif
169 	case  PT_GETREGS:
170 	case  PT_SETREGS:
171 #ifdef PT_GETFPREGS
172 	case  PT_GETFPREGS:
173 #endif
174 #ifdef PT_SETFPREGS
175 	case  PT_SETFPREGS:
176 #endif
177 		/*
178 		 * You can't do what you want to the process if:
179 		 *	(1) It's not being traced at all,
180 		 */
181 		if (!ISSET(t->p_flag, P_TRACED))
182 			return (EPERM);
183 
184 		/*
185 		 *	(2) it's not being traced by _you_, or
186 		 */
187 		if (t->p_pptr != p)
188 			return (EBUSY);
189 
190 		/*
191 		 *	(3) it's not currently stopped.
192 		 */
193 		if (t->p_stat != SSTOP || !ISSET(t->p_flag, P_WAITED))
194 			return (EBUSY);
195 		break;
196 
197 	default:			/* It was not a legal request. */
198 		return (EINVAL);
199 	}
200 
201 	/* Do single-step fixup if needed. */
202 	FIX_SSTEP(t);
203 
204 	/* Now do the operation. */
205 	write = 0;
206 	*retval = 0;
207 
208 	switch (SCARG(uap, req)) {
209 	case  PT_TRACE_ME:
210 		/* Just set the trace flag. */
211 		SET(t->p_flag, P_TRACED);
212 		t->p_oppid = t->p_pptr->p_pid;
213 		return (0);
214 
215 	case  PT_WRITE_I:		/* XXX no separate I and D spaces */
216 	case  PT_WRITE_D:
217 		write = 1;
218 		temp = SCARG(uap, data);
219 	case  PT_READ_I:		/* XXX no separate I and D spaces */
220 	case  PT_READ_D:
221 		/* write = 0 done above. */
222 		iov.iov_base = (caddr_t)&temp;
223 		iov.iov_len = sizeof(int);
224 		uio.uio_iov = &iov;
225 		uio.uio_iovcnt = 1;
226 		uio.uio_offset = (off_t)(long)SCARG(uap, addr);
227 		uio.uio_resid = sizeof(int);
228 		uio.uio_segflg = UIO_SYSSPACE;
229 		uio.uio_rw = write ? UIO_WRITE : UIO_READ;
230 		uio.uio_procp = p;
231 		error = procfs_domem(p, t, NULL, &uio);
232 		if (write == 0)
233 			*retval = temp;
234 		return (error);
235 	case  PT_IO:
236 		error = copyin(SCARG(uap, addr), &piod, sizeof(piod));
237 		if (error)
238 			return (error);
239 		iov.iov_base = piod.piod_addr;
240 		iov.iov_len = piod.piod_len;
241 		uio.uio_iov = &iov;
242 		uio.uio_iovcnt = 1;
243 		uio.uio_offset = (off_t)(long)piod.piod_offs;
244 		uio.uio_resid = piod.piod_len;
245 		uio.uio_segflg = UIO_USERSPACE;
246 		uio.uio_procp = p;
247 		switch (piod.piod_op) {
248 		case PIOD_READ_D:
249 		case PIOD_READ_I:
250 			uio.uio_rw = UIO_READ;
251 			break;
252 		case PIOD_WRITE_D:
253 		case PIOD_WRITE_I:
254 			uio.uio_rw = UIO_WRITE;
255 			break;
256 		default:
257 			return (EINVAL);
258 		}
259 		error = procfs_domem(p, t, NULL, &uio);
260 		piod.piod_len -= uio.uio_resid;
261 		(void) copyout(&piod, SCARG(uap, addr), sizeof(piod));
262 		return (error);
263 #ifdef PT_STEP
264 	case  PT_STEP:
265 		/*
266 		 * From the 4.4BSD PRM:
267 		 * "Execution continues as in request PT_CONTINUE; however
268 		 * as soon as possible after execution of at least one
269 		 * instruction, execution stops again. [ ... ]"
270 		 */
271 #endif
272 	case  PT_CONTINUE:
273 		/*
274 		 * From the 4.4BSD PRM:
275 		 * "The data argument is taken as a signal number and the
276 		 * child's execution continues at location addr as if it
277 		 * incurred that signal.  Normally the signal number will
278 		 * be either 0 to indicate that the signal that caused the
279 		 * stop should be ignored, or that value fetched out of
280 		 * the process's image indicating which signal caused
281 		 * the stop.  If addr is (int *)1 then execution continues
282 		 * from where it stopped."
283 		 */
284 
285 		/* Check that the data is a valid signal number or zero. */
286 		if (SCARG(uap, data) < 0 || SCARG(uap, data) >= NSIG)
287 			return (EINVAL);
288 
289 		PHOLD(t);
290 		/* If the address paramter is not (int *)1, set the pc. */
291 		if ((int *)SCARG(uap, addr) != (int *)1)
292 			if ((error = process_set_pc(t, SCARG(uap, addr))) != 0)
293 				goto relebad;
294 
295 #ifdef PT_STEP
296 		/*
297 		 * Arrange for a single-step, if that's requested and possible.
298 		 */
299 		error = process_sstep(t, SCARG(uap, req) == PT_STEP);
300 		if (error)
301 			goto relebad;
302 #endif
303 		PRELE(t);
304 		goto sendsig;
305 
306 	case  PT_DETACH:
307 		/*
308 		 * From the 4.4BSD PRM:
309 		 * "The data argument is taken as a signal number and the
310 		 * child's execution continues at location addr as if it
311 		 * incurred that signal.  Normally the signal number will
312 		 * be either 0 to indicate that the signal that caused the
313 		 * stop should be ignored, or that value fetched out of
314 		 * the process's image indicating which signal caused
315 		 * the stop.  If addr is (int *)1 then execution continues
316 		 * from where it stopped."
317 		 */
318 
319 		/* Check that the data is a valid signal number or zero. */
320 		if (SCARG(uap, data) < 0 || SCARG(uap, data) >= NSIG)
321 			return (EINVAL);
322 
323 		PHOLD(t);
324 #ifdef PT_STEP
325 		/*
326 		 * Arrange for a single-step, if that's requested and possible.
327 		 */
328 		error = process_sstep(t, SCARG(uap, req) == PT_STEP);
329 		if (error)
330 			goto relebad;
331 #endif
332 		PRELE(t);
333 
334 		/* give process back to original parent or init */
335 		if (t->p_oppid != t->p_pptr->p_pid) {
336 			struct proc *pp;
337 
338 			pp = pfind(t->p_oppid);
339 			proc_reparent(t, pp ? pp : initproc);
340 		}
341 
342 		/* not being traced any more */
343 		t->p_oppid = 0;
344 		CLR(t->p_flag, P_TRACED|P_WAITED);
345 
346 	sendsig:
347 		/* Finally, deliver the requested signal (or none). */
348 		if (t->p_stat == SSTOP) {
349 			t->p_xstat = SCARG(uap, data);
350 			setrunnable(t);
351 		} else {
352 			if (SCARG(uap, data) != 0)
353 				psignal(t, SCARG(uap, data));
354 		}
355 		return (0);
356 
357 	relebad:
358 		PRELE(t);
359 		return (error);
360 
361 	case  PT_KILL:
362 		/* just send the process a KILL signal. */
363 		SCARG(uap, data) = SIGKILL;
364 		goto sendsig;	/* in PT_CONTINUE, above. */
365 
366 	case  PT_ATTACH:
367 		/*
368 		 * As done in procfs:
369 		 * Go ahead and set the trace flag.
370 		 * Save the old parent (it's reset in
371 		 *   _DETACH, and also in kern_exit.c:wait4()
372 		 * Reparent the process so that the tracing
373 		 *   proc gets to see all the action.
374 		 * Stop the target.
375 		 */
376 		SET(t->p_flag, P_TRACED);
377 		t->p_oppid = t->p_pptr->p_pid;
378 		if (t->p_pptr != p)
379 			proc_reparent(t, p);
380 		SCARG(uap, data) = SIGSTOP;
381 		goto sendsig;
382 
383 	case  PT_SETREGS:
384 		write = 1;
385 	case  PT_GETREGS:
386 		/* write = 0 done above. */
387 		if (!procfs_validregs(t, NULL))
388 			return (EINVAL);
389 		else {
390 			iov.iov_base = SCARG(uap, addr);
391 			iov.iov_len = sizeof(struct reg);
392 			uio.uio_iov = &iov;
393 			uio.uio_iovcnt = 1;
394 			uio.uio_offset = 0;
395 			uio.uio_resid = sizeof(struct reg);
396 			uio.uio_segflg = UIO_USERSPACE;
397 			uio.uio_rw = write ? UIO_WRITE : UIO_READ;
398 			uio.uio_procp = p;
399 			return (procfs_doregs(p, t, NULL, &uio));
400 		}
401 #ifdef PT_SETFPREGS
402 	case  PT_SETFPREGS:
403 		write = 1;
404 #endif
405 #ifdef PT_GETFPREGS
406 	case  PT_GETFPREGS:
407 		/* write = 0 done above. */
408 #endif
409 #if defined(PT_SETFPREGS) || defined(PT_GETFPREGS)
410 		if (!procfs_validfpregs(t, NULL))
411 			return (EINVAL);
412 		else {
413 			iov.iov_base = SCARG(uap, addr);
414 			iov.iov_len = sizeof(struct fpreg);
415 			uio.uio_iov = &iov;
416 			uio.uio_iovcnt = 1;
417 			uio.uio_offset = 0;
418 			uio.uio_resid = sizeof(struct fpreg);
419 			uio.uio_segflg = UIO_USERSPACE;
420 			uio.uio_rw = write ? UIO_WRITE : UIO_READ;
421 			uio.uio_procp = p;
422 			return (procfs_dofpregs(p, t, NULL, &uio));
423 		}
424 #endif
425 	}
426 
427 #ifdef DIAGNOSTIC
428 	panic("ptrace: impossible");
429 #endif
430 	return 0;
431 }
432