Re: [PATCH] ptrace.2: Add details about usage of PTRACE_GET_SYSCALL_INFO

["Φώτης Βαλασιάδης" <fvalasiad@gmail.com>]

Hi yet again Alex!

You didn't confirm so I was wondering if you received my message!

Let me know if possible.

-- fvalasiad --

On 27/2/23 21:19, Φώτης Βαλασιάδης wrote:
> Hi Alex!
>
> Is that good enough?
>
> -- fvalasiad --
>
> On 27/2/23 21:17, Fotios Valasiadis wrote:
>> Document the role of PTRACE_O_TRACESYSGOOD option in connection with
>> PTRACE_GET_SYSCALL_INFO.
>>
>> Came upon this after writing a test program using 
>> PTRACE_GET_SYSCALL_INFO.
>> After failing to find what's wrong I posted a StackOverflow question
>> which you can find right here:
>> <https://stackoverflow.com/questions/72410182/ptrace-get-syscall-info-always-returns-info-op-as-ptrace-syscall-info-none> 
>>
>>
>> Nate Eldredge found out what happens by looking into the kernel's source
>> code, here is a link to the relevant part
>> <https://github.com/torvalds/linux/blob/8291eaafed36f575f23951f3ce18407f480e9ecf/kernel/ptrace.c#L1018> 
>>
>>
>> In the code it can be seen that in case of system call entry or
>> exit stops, the union is filled if and only if the signal matches
>> "SIGTRAP | 0x80", a signal which is only sent if the 
>> PTRACE_O_TRACESYSGOOD
>> option is set.  You can read about that in the PTRACE_O_TRACESYSGOOD
>> section of ptrace(2)'s manual.
>>
>> Complements: fc91449cb "ptrace.2: Document PTRACE_GET_SYSCALL_INFO"
>> Cowritten-by: Dmitry V. Levin <ldv@strace.io>
>> Signed-off-by: Dmitry V. Levin <ldv@strace.io>
>> Signed-off-by: Fotios Valasiadis <fvalasiad@gmail.com>
>> Acked-by: Nate Eldredge <nate@thatsmathematics.com>
>> Cc: Elvira Khabirova <lineprinter0@gmail.com>
>> Signed-off-by: Alejandro Colomar <alx@kernel.org>
>> ---
>>   man2/ptrace.2 | 9 +++++++++
>>   1 file changed, 9 insertions(+)
>>
>> diff --git a/man2/ptrace.2 b/man2/ptrace.2
>> index 55d9fd36d..9737b3825 100644
>> --- a/man2/ptrace.2
>> +++ b/man2/ptrace.2
>> @@ -1111,6 +1111,15 @@ stop.
>>   .B PTRACE_SYSCALL_INFO_NONE
>>   No component of the union contains relevant information.
>>   .RE
>> +.IP
>> +In case of system call entry or exit stops,
>> +the data returned by
>> +.B PTRACE_GET_SYSCALL_INFO
>> +is limited to type
>> +.B PTRACE_SYSCALL_INFO_NONE
>> +unless
>> +.B PTRACE_O_TRACESYSGOOD
>> +option is set before the corresponding system call stop has occurred.
>>   .\"
>>   .SS Death under ptrace
>>   When a (possibly multithreaded) process receives a killing signal