On Fri, Apr 28, 2006 at 09:49:56PM -0400, Jeff Dike wrote:
> On Fri, Apr 28, 2006 at 10:28:46PM +0200, Blaisorblade wrote:
> > Ok, this gives us a definite proposal, which I finally like:
> >
> > * to exclude sys_tee:
> >
> > bitmask = 0;
> > set_bit(__NR_tee, bitmask);
> > ptrace(PTRACE_SET_NOTRACE, bitmask);
> >
> > * to trace only sys_tee:
> >
> > bitmask = 0;
> > set_bit(__NR_tee, bitmask);
> > ptrace(PTRACE_SET_TRACEONLY, bitmask);
>
> Yup, I like this.
I really recommend you not do this. One (better) suggestion earlier
was:
struct {
int bitmask_length;
int flags;
char bitmask[0];
};
The difference between this case and the sigprocmask example is that
the size of a sigset_t is very hard to change - it's a userspace ABI
break. If you want to model it after sigprocmask, don't look at the
man page, which describes the POSIX function. Look at the more recent
RT version of the syscall instead:
sys_rt_sigprocmask(int how, sigset_t __user *set, sigset_t __user *oset, size_t sigsetsize)
Suppose the kernel knows about 32 more syscalls than userspace. It's
going to read extra bits out of the bitmask that userspace didn't
initialize!
Also, if you store the mask with the child process, it risks surprising
existing tracers: attach, set mask, detach, then the next time someone
attaches an old version of strace some syscalls will be "hidden".
--
Daniel Jacobowitz
CodeSourcery
On Mon, May 01, 2006 at 09:51:27AM -0400, Daniel Jacobowitz wrote:
> On Fri, Apr 28, 2006 at 09:49:56PM -0400, Jeff Dike wrote:
> > On Fri, Apr 28, 2006 at 10:28:46PM +0200, Blaisorblade wrote:
> > > bitmask = 0;
> > > set_bit(__NR_tee, bitmask);
> > > ptrace(PTRACE_SET_TRACEONLY, bitmask);
> >
> > Yup, I like this.
>
> I really recommend you not do this.
> Suppose the kernel knows about 32 more syscalls than userspace. It's
> going to read extra bits out of the bitmask that userspace didn't
> initialize!
The example above is a sketch, not a fully formed, compilable user. Every
proposed interface has had the mask length passed in - in the case
above in the data argument.
> Also, if you store the mask with the child process, it risks surprising
> existing tracers: attach, set mask, detach, then the next time someone
> attaches an old version of strace some syscalls will be "hidden".
Not if the mask only survives for the duration of a PTRACE_ATTACH, and
the mask is released on PTRACE_DETACH.
Jeff
On Mon, May 01, 2006 at 09:45:52AM -0400, Jeff Dike wrote:
> The example above is a sketch, not a fully formed, compilable user. Every
> proposed interface has had the mask length passed in - in the case
> above in the data argument.
Oh. Well, then, I must have missed a message when I read the thread
this morning - sorry. I'll watch for the next posting.
--
Daniel Jacobowitz
CodeSourcery