Re: [PATCH] forbid ptrace(PTRACE_TRACEME, ...) by init

Mike Coleman (mkc@kc.net)
04 Nov 1999 23:36:31 -0600


Jamie Lokier <lkd@tantalophile.demon.co.uk> writes:
> Jakub Jelinek wrote:
> > Aieee, it hurts. So why do you do that? I mean there are many other ways how
> > can root shoot himself in the foot, so I don't think this issue is worth
> > adding a few bytes into the kernel.

Admittedly, it would be a foolish thing to do, and surely no init does it at
present. Nonetheless, I believe the current behavior violates the stated (or
at least heavily implied) spec for ptrace. I don't think it should be left
this way when there is a simple fix--I want the kernel to be perfect.

> Trying `strace -p 1' looks like quite a reasonable thing to me. If that
> would break the kernel, IMO the kernel should refuse it.

Given the current ptrace spec, this is disallowed. Every ptrace subcommand
(except TRACEME) is forbidden to be run on init. Thus there is no useful
reason for init to do a TRACEME, and given init's special role (e.g., it is
its own parent (?)), that TRACEME is likely to corrupt the system.

It would be interesting to strace init, but I don't think this could be
accomplished without substantial changes to the kernel.

--Mike

-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.rutgers.edu
Please read the FAQ at http://www.tux.org/lkml/