It seems that the PTRACE_GET_SYSCALL_INFO function of ptrace(2) only works
properly if the tracer has set the PTRACE_O_TRACESYSGOOD option. The man
page doesn't mention this requirement. Is it intentional?
The issue is that ptrace_get_syscall_info() in kernel/ptrace.c only calls
the ptrace_get_syscall_info_{entry,exit} functions to fully populate the
ptrace_syscall_info struct if child->last_siginfo->si_code == SIGTRAP |
0x80. And the 0x80 bit is only set when PTRACE_O_TRACESYSGOOD is in
effect. Otherwise, the struct always comes back to userspace with op ==
PTRACE_SYSCALL_INFO_NONE and the entry (or exit) member is not filled in
with the system call arguments (or return value).
--
Nate Eldredge
[email protected]