commit eaa3a379f0ba15e488054a686b1eb838ebbf7cc5 Author: Nick Mathewson <nickm@torproject.org> Date: Thu Nov 24 23:45:47 2011 -0500 Move disable-debugger-attachment fn to compat where it belongs. Fix whitespace --- src/common/compat.c | 59 +++++++++++++++++++++++++++++++++++++++++++++++ src/common/compat.h | 1 + src/or/config.c | 64 +++----------------------------------------------- 3 files changed, 64 insertions(+), 60 deletions(-) diff --git a/src/common/compat.c b/src/common/compat.c index 9a2c9d7..ea95f9f 100644 --- a/src/common/compat.c +++ b/src/common/compat.c @@ -58,6 +58,14 @@ #endif #endif +/* Includes for the process attaching prevention */ +#if defined(HAVE_SYS_PRCTL_H) && defined(__linux__) +#include <sys/prctl.h> +#elif defined(__APPLE__) +#include <sys/types.h> +#include <sys/ptrace.h> +#endif + #ifdef HAVE_NETDB_H #include <netdb.h> #endif @@ -1519,6 +1527,57 @@ switch_id(const char *user) #endif } +/* We only use the linux prctl for now. There is no Win32 support; this may + * also work on various BSD systems and Mac OS X - send testing feedback! + * + * On recent Gnu/Linux kernels it is possible to create a system-wide policy + * that will prevent non-root processes from attaching to other processes + * unless they are the parent process; thus gdb can attach to programs that + * they execute but they cannot attach to other processes running as the same + * user. The system wide policy may be set with the sysctl + * kernel.yama.ptrace_scope or by inspecting + * /proc/sys/kernel/yama/ptrace_scope and it is 1 by default on Ubuntu 11.04. + * + * This ptrace scope will be ignored on Gnu/Linux for users with + * CAP_SYS_PTRACE and so it is very likely that root will still be able to + * attach to the Tor process. + */ +/** Attempt to disable debugger attachment: return 0 on success, -1 on + * failure. */ +int +tor_disable_debugger_attach(void) +{ + int r, attempted; + r = -1; + attempted = 0; + log_debug(LD_CONFIG, + "Attemping to disable debugger attachment to Tor for " + "unprivileged users."); +#if defined(__linux__) && defined(HAVE_SYS_PRCTL_H) && defined(HAVE_PRCTL) +#ifdef PR_SET_DUMPABLE + attempted = 1; + r = prctl(PR_SET_DUMPABLE, 0); +#endif +#endif +#if defined(__APPLE__) && defined(PT_DENY_ATTACH) + if (r < 0) { + attempted = 1; + r = ptrace(PT_DENY_ATTACH, 0, 0, 0); + } +#endif + + // XXX: TODO - Mac OS X has dtrace and this may be disabled. + // XXX: TODO - Windows probably has something similar + if (r == 0) { + log_debug(LD_CONFIG,"Debugger attachment disabled for " + "unprivileged users."); + } else if (attempted) { + log_warn(LD_CONFIG, "Unable to disable ptrace attach: %s", + strerror(errno)); + } + return r; +} + #ifdef HAVE_PWD_H /** Allocate and return a string containing the home directory for the * user <b>username</b>. Only works on posix-like systems. */ diff --git a/src/common/compat.h b/src/common/compat.h index b005dd2..f73e433 100644 --- a/src/common/compat.h +++ b/src/common/compat.h @@ -566,6 +566,7 @@ set_uint8(void *cp, uint8_t v) typedef unsigned long rlim_t; #endif int set_max_file_descriptors(rlim_t limit, int *max); +int tor_disable_debugger_attach(void); int switch_id(const char *user); #ifdef HAVE_PWD_H char *get_user_homedir(const char *username); diff --git a/src/or/config.c b/src/or/config.c index a424637..c0ce404 100644 --- a/src/or/config.c +++ b/src/or/config.c @@ -40,14 +40,6 @@ #include <shlobj.h> #endif -/* Includes for the process attaching prevention */ -#if defined(HAVE_SYS_PRCTL_H) && defined(__linux__) -#include <sys/prctl.h> -#elif defined(__APPLE__) -#include <sys/types.h> -#include <sys/ptrace.h> -#endif - #include "procmon.h" /* From main.c */ @@ -687,55 +679,6 @@ get_dirportfrontpage(void) return global_dirfrontpagecontents; } -/* We only use the linux prctl for now. There is no Win32 support; this may - * also work on various BSD systems and Mac OS X - send testing feedback! - * - * On recent Gnu/Linux kernels it is possible to create a system-wide policy - * that will prevent non-root processes from attaching to other processes - * unless they are the parent process; thus gdb can attach to programs that - * they execute but they cannot attach to other processes running as the same - * user. The system wide policy may be set with the sysctl - * kernel.yama.ptrace_scope or by inspecting /proc/sys/kernel/yama/ptrace_scope - * and it is 1 by default on Ubuntu 11.04. - * - * This ptrace scope will be ignored on Gnu/Linux for users with - * CAP_SYS_PTRACE and so it is very likely that root will still be able to - * attach to the Tor process. -*/ -/** Attempt to disable debugger attachment. */ -static int -tor_disable_debugger_attach(void) -{ - int r, attempted; - r = -1; - attempted = 0; - log_debug(LD_CONFIG, - "Attemping to disable debugger attachment to Tor for " - "unprivileged users."); -#if defined(__linux__) && defined(HAVE_SYS_PRCTL_H) && defined(HAVE_PRCTL) -#ifdef PR_SET_DUMPABLE - attempted = 1; - r = prctl(PR_SET_DUMPABLE, 0); -#endif -#endif -#if defined(__APPLE__) && defined(PT_DENY_ATTACH) - if (r < 0) { - attempted = 1; - r = ptrace(PT_DENY_ATTACH, 0, 0, 0); - } -#endif - -// XXX: TODO - Mac OS X has dtrace and this may be disabled - implement it here -// XXX: TODO - Windows probably has something similar - implement it here - if (r == 0) { - log_debug(LD_CONFIG,"Debugger attachment disabled for unprivileged users."); - } else if (attempted) { - log_warn(LD_CONFIG, "Unable to disable ptrace attach: %s", - strerror(errno)); - } - return r; -} - /** Allocate an empty configuration object of a given format type. */ static void * config_alloc(const config_format_t *fmt) @@ -1346,11 +1289,12 @@ options_act(const or_options_t *old_options) /* disable ptrace and later, other basic debugging techniques */ if (options->DisableDebuggerAttachment) { - tor_disable_debugger_attach(); + tor_disable_debugger_attach(); } else { - log_notice(LD_CONFIG,"Debugger attachment enabled for unprivileged users."); + log_notice(LD_CONFIG,"Debugger attachment enabled " + "for unprivileged users."); } - + if (running_tor && !have_lockfile()) { if (try_locking(options, 1) < 0) return -1;