Re: [PATCH] 2-ptrace_multi

[renzo@cs.unibo.it (Renzo Davoli)]

To summarize the thread we have agreed that
/proc/*/mem should be writable, at least with ptrace permissions.

Even reading from /proc/*/mem does not currently have the same permissions of
ptrace. E.g. when a setuid process is started under ptrace it runs
without the setuid semantics, thus it is possible to get/put data
using PTRACE_{PEEK,POKE}*.
There are no security threats as the process is running in an
unprivileged way, on the contrary this is a feature that allows
virtual machines to run setuid code, e.g. we use this feature to
run /bin/ping on virtual networks.
Instead it is not possible to read the memory through /proc/*/mem
in the same situation.
(In UMview -- see our cvs if you like -- to manage this exception
there is now a read from /proc/*/mem file and if the read fails it 
rolls back to the standard PTRACE_PEEKDATA.)

Let me point out that PTRACE_MULTI is not only related to memory access.
We are using PTRACE_MULTI also to store the registers and restart the
execution of the ptraced process with a single syscall.
This is very effective when umview runs on a ppc32 architecture. In
fact, PPC_PTRACE_{G,S}ETREGS do not exist for that architecture
(IMHO there is no evident reason for that). Without PTRACE_MULTI each register
must be read/written individually by a PTRACE_{PEEK,POKE}USER(*)

PTRACE_MULTI can be also used to optimize many other virtualized calls,
e.g. to read/write all the buffers for a readv/writev/recvmsg/sendmsg
call at once.

Therefore I feel that /proc/*/mem access can help but PTRACE_MULTI
gives something more.

	renzo

(*) two notes about PPC_PTRACE_{G,S}ETREGS for powerpc.
It is not clear to me why the same calls are okay for ppc64 and forbidden
for ppc32, all the statements inside this ifdef

arch/powerpc/kernel/ptrace.c: 407  #ifdef CONFIG_PPC64
arch/powerpc/kernel/ptrace.c: 408  case PPC_PTRACE_GETREGS: { /* Get GPRs 0 - 31. */
...

are meaningful for ppc32 too. I have not tested it yet, but maybe
deleting the #ifdef is enough to provide PPC_PTRACE_{G,S}ETREGS to
ppc32, too.
There is another detail. IMVHO in ppc64 architecture the security control 
that forbids to change the PT_ORIG_R3 register by PTRACE_POKEUSER

arch/powerpc/kernel/ptrace.c: 329  if (index == PT_ORIG_R3)
arch/powerpc/kernel/ptrace.c: 330    break;

is circunvented by PPC_PTRACE_SETREGS that rewrites all the registers
including PT_ORIG_R3. (Maybe I am wrong but I haven't seen any
check about this).