[tor-commits] [tor/master] Merge remote-tracking branch 'ioerror/DisableDebuggerAttachment'

[nickm at torproject.org]

commit 68114ca52cbed0b7970a60717be4ca22ffdc5d00
Merge: f634228 f79a75f
Author: Nick Mathewson <nickm at torproject.org>
Date:   Thu Nov 24 23:38:32 2011 -0500

    Merge remote-tracking branch 'ioerror/DisableDebuggerAttachment'
    
    Conflicts:
    	src/or/config.c

 changes/disable_debugger_attachment |   14 ++++++++
 doc/tor.1.txt                       |   14 ++++++++
 src/or/config.c                     |   57 +++++++++++++++++++++++++++++++++++
 src/or/or.h                         |    2 +
 4 files changed, 87 insertions(+), 0 deletions(-)

diff --cc src/or/config.c
index ef9e4ec,5a153b0..b8ff6e8
--- a/src/or/config.c
+++ b/src/or/config.c
@@@ -42,9 -40,14 +42,17 @@@
  
  #include "procmon.h"
  
 +/* From main.c */
 +extern int quiet_level;
 +
+ /* Includes for the process attaching prevention */
+ #if defined(HAVE_SYS_PRCTL_H) && defined(__linux__)
+ #include <sys/prctl.h> 
+ #elif defined(__APPLE__)
+ #include <sys/types.h>
+ #include <sys/ptrace.h>
+ #endif
+ 
  /** Enumeration of types which option values can take */
  typedef enum config_type_t {
    CONFIG_TYPE_STRING = 0,   /**< An arbitrary string. */
@@@ -246,8 -246,9 +254,9 @@@ static config_var_t _option_vars[] = 
    V(DirReqStatistics,            BOOL,     "1"),
    VAR("DirServer",               LINELIST, DirServers, NULL),
    V(DisableAllSwap,              BOOL,     "0"),
+   V(DisableDebuggerAttachment,   BOOL,     "1"),
    V(DisableIOCP,                 BOOL,     "1"),
 -  V(DNSPort,                     PORT,     "0"),
 +  V(DNSPort,                     LINELIST, NULL),
    V(DNSListenAddress,            LINELIST, NULL),
    V(DownloadExtraInfo,           BOOL,     "0"),
    V(EnforceDistinctSubnets,      BOOL,     "1"),
@@@ -678,9 -658,50 +687,50 @@@ get_dirportfrontpage(void
    return global_dirfrontpagecontents;
  }
  
+ /* We only use the linux prctl for now. There is no Win32 support; this may
+  * also work on various BSD systems and Mac OS X - send testing feedback!
+  * 
+  * On recent Gnu/Linux kernels it is possible to create a system-wide policy
+  * that will prevent non-root processes from attaching to other processes
+  * unless they are the parent process; thus gdb can attach to programs that
+  * they execute but they cannot attach to other processes running as the same
+  * user. The system wide policy may be set with the sysctl
+  * kernel.yama.ptrace_scope or by inspecting /proc/sys/kernel/yama/ptrace_scope
+  * and it is 1 by default on Ubuntu 11.04.
+  *
+  * This ptrace scope will be ignored on Gnu/Linux for users with
+  * CAP_SYS_PTRACE and so it is very likely that root will still be able to
+  * attach to the Tor process.
+ */
+ /** Attempt to disable debugger attachment. */
+ static int tor_disable_debugger_attach(void) {
+     int r;
+     r = -1;
+     log_debug(LD_CONFIG,
+     "Attemping to disable debugger attachment to Tor for unprivileged users.");
+ #if defined(__linux__) && defined(HAVE_SYS_PRCTL_H) && defined(HAVE_PRCTL)
+ #ifdef PR_SET_DUMPABLE
+     r = prctl(PR_SET_DUMPABLE, 0);
+ #endif
+ #endif
+ #if defined(__APPLE__) && defined(PT_DENY_ATTACH)
+     r = ptrace(PT_DENY_ATTACH, 0, 0, 0);
+ #endif
+ 
+ // XXX: TODO - Mac OS X has dtrace and this may be disabled - implement it here
+ // XXX: TODO - Windows probably has something similar - implement it here
+     if (r == 0) {
+       log_debug(LD_CONFIG,"Debugger attachment disabled for unprivileged users.");
+     } else {
+       log_warn(LD_CONFIG, "Unable to disable ptrace attach: %s",
+                           strerror(errno));
+     }
+     return r;
+ }
+ 
  /** Allocate an empty configuration object of a given format type. */
  static void *
 -config_alloc(config_format_t *fmt)
 +config_alloc(const config_format_t *fmt)
  {
    void *opts = tor_malloc_zero(fmt->size);
    *(uint32_t*)STRUCT_VAR_P(opts, fmt->magic_offset) = fmt->magic;
@@@ -1277,15 -1238,20 +1327,22 @@@ get_effective_bwburst(const or_options_
   * here yet.  Some is still in do_hup() and other places.
   */
  static int
 -options_act(or_options_t *old_options)
 +options_act(const or_options_t *old_options)
  {
    config_line_t *cl;
 -  or_options_t *options = get_options();
 +  or_options_t *options = get_options_mutable();
    int running_tor = options->command == CMD_RUN_TOR;
    char *msg;
 +  const int transition_affects_workers =
 +    old_options && options_transition_affects_workers(old_options, options);
  
+    /* disable ptrace and later, other basic debugging techniques */
+   if (options->DisableDebuggerAttachment) {
+       tor_disable_debugger_attach();
+   } else {
+       log_notice(LD_CONFIG,"Debugger attachment enabled for unprivileged users.");
+   }
+  
    if (running_tor && !have_lockfile()) {
      if (try_locking(options, 1) < 0)
        return -1;