[tor-commits] [tor/master] Move disable-debugger-attachment fn to compat where it belongs. Fix whitespace

[nickm at torproject.org]

commit eaa3a379f0ba15e488054a686b1eb838ebbf7cc5
Author: Nick Mathewson <nickm at torproject.org>
Date:   Thu Nov 24 23:45:47 2011 -0500

    Move disable-debugger-attachment fn to compat where it belongs. Fix whitespace
---
 src/common/compat.c |   59 +++++++++++++++++++++++++++++++++++++++++++++++
 src/common/compat.h |    1 +
 src/or/config.c     |   64 +++-----------------------------------------------
 3 files changed, 64 insertions(+), 60 deletions(-)

diff --git a/src/common/compat.c b/src/common/compat.c
index 9a2c9d7..ea95f9f 100644
--- a/src/common/compat.c
+++ b/src/common/compat.c
@@ -58,6 +58,14 @@
 #endif
 #endif
 
+/* Includes for the process attaching prevention */
+#if defined(HAVE_SYS_PRCTL_H) && defined(__linux__)
+#include <sys/prctl.h>
+#elif defined(__APPLE__)
+#include <sys/types.h>
+#include <sys/ptrace.h>
+#endif
+
 #ifdef HAVE_NETDB_H
 #include <netdb.h>
 #endif
@@ -1519,6 +1527,57 @@ switch_id(const char *user)
 #endif
 }
 
+/* We only use the linux prctl for now. There is no Win32 support; this may
+ * also work on various BSD systems and Mac OS X - send testing feedback!
+ *
+ * On recent Gnu/Linux kernels it is possible to create a system-wide policy
+ * that will prevent non-root processes from attaching to other processes
+ * unless they are the parent process; thus gdb can attach to programs that
+ * they execute but they cannot attach to other processes running as the same
+ * user. The system wide policy may be set with the sysctl
+ * kernel.yama.ptrace_scope or by inspecting
+ * /proc/sys/kernel/yama/ptrace_scope and it is 1 by default on Ubuntu 11.04.
+ *
+ * This ptrace scope will be ignored on Gnu/Linux for users with
+ * CAP_SYS_PTRACE and so it is very likely that root will still be able to
+ * attach to the Tor process.
+ */
+/** Attempt to disable debugger attachment: return 0 on success, -1 on
+ * failure. */
+int
+tor_disable_debugger_attach(void)
+{
+  int r, attempted;
+  r = -1;
+  attempted = 0;
+  log_debug(LD_CONFIG,
+            "Attemping to disable debugger attachment to Tor for "
+            "unprivileged users.");
+#if defined(__linux__) && defined(HAVE_SYS_PRCTL_H) && defined(HAVE_PRCTL)
+#ifdef PR_SET_DUMPABLE
+  attempted = 1;
+  r = prctl(PR_SET_DUMPABLE, 0);
+#endif
+#endif
+#if defined(__APPLE__) && defined(PT_DENY_ATTACH)
+  if (r < 0) {
+    attempted = 1;
+    r = ptrace(PT_DENY_ATTACH, 0, 0, 0);
+  }
+#endif
+
+  // XXX: TODO - Mac OS X has dtrace and this may be disabled.
+  // XXX: TODO - Windows probably has something similar
+  if (r == 0) {
+    log_debug(LD_CONFIG,"Debugger attachment disabled for "
+              "unprivileged users.");
+  } else if (attempted) {
+    log_warn(LD_CONFIG, "Unable to disable ptrace attach: %s",
+             strerror(errno));
+  }
+  return r;
+}
+
 #ifdef HAVE_PWD_H
 /** Allocate and return a string containing the home directory for the
  * user <b>username</b>. Only works on posix-like systems. */
diff --git a/src/common/compat.h b/src/common/compat.h
index b005dd2..f73e433 100644
--- a/src/common/compat.h
+++ b/src/common/compat.h
@@ -566,6 +566,7 @@ set_uint8(void *cp, uint8_t v)
 typedef unsigned long rlim_t;
 #endif
 int set_max_file_descriptors(rlim_t limit, int *max);
+int tor_disable_debugger_attach(void);
 int switch_id(const char *user);
 #ifdef HAVE_PWD_H
 char *get_user_homedir(const char *username);
diff --git a/src/or/config.c b/src/or/config.c
index a424637..c0ce404 100644
--- a/src/or/config.c
+++ b/src/or/config.c
@@ -40,14 +40,6 @@
 #include <shlobj.h>
 #endif
 
-/* Includes for the process attaching prevention */
-#if defined(HAVE_SYS_PRCTL_H) && defined(__linux__)
-#include <sys/prctl.h>
-#elif defined(__APPLE__)
-#include <sys/types.h>
-#include <sys/ptrace.h>
-#endif
-
 #include "procmon.h"
 
 /* From main.c */
@@ -687,55 +679,6 @@ get_dirportfrontpage(void)
   return global_dirfrontpagecontents;
 }
 
-/* We only use the linux prctl for now. There is no Win32 support; this may
- * also work on various BSD systems and Mac OS X - send testing feedback!
- * 
- * On recent Gnu/Linux kernels it is possible to create a system-wide policy
- * that will prevent non-root processes from attaching to other processes
- * unless they are the parent process; thus gdb can attach to programs that
- * they execute but they cannot attach to other processes running as the same
- * user. The system wide policy may be set with the sysctl
- * kernel.yama.ptrace_scope or by inspecting /proc/sys/kernel/yama/ptrace_scope
- * and it is 1 by default on Ubuntu 11.04.
- *
- * This ptrace scope will be ignored on Gnu/Linux for users with
- * CAP_SYS_PTRACE and so it is very likely that root will still be able to
- * attach to the Tor process.
-*/
-/** Attempt to disable debugger attachment. */
-static int
-tor_disable_debugger_attach(void)
-{
-    int r, attempted;
-    r = -1;
-    attempted = 0;
-    log_debug(LD_CONFIG,
-              "Attemping to disable debugger attachment to Tor for "
-              "unprivileged users.");
-#if defined(__linux__) && defined(HAVE_SYS_PRCTL_H) && defined(HAVE_PRCTL)
-#ifdef PR_SET_DUMPABLE
-    attempted = 1;
-    r = prctl(PR_SET_DUMPABLE, 0);
-#endif
-#endif
-#if defined(__APPLE__) && defined(PT_DENY_ATTACH)
-    if (r < 0) {
-      attempted = 1;
-      r = ptrace(PT_DENY_ATTACH, 0, 0, 0);
-    }
-#endif
-
-// XXX: TODO - Mac OS X has dtrace and this may be disabled - implement it here
-// XXX: TODO - Windows probably has something similar - implement it here
-    if (r == 0) {
-      log_debug(LD_CONFIG,"Debugger attachment disabled for unprivileged users.");
-    } else if (attempted) {
-      log_warn(LD_CONFIG, "Unable to disable ptrace attach: %s",
-                          strerror(errno));
-    }
-    return r;
-}
-
 /** Allocate an empty configuration object of a given format type. */
 static void *
 config_alloc(const config_format_t *fmt)
@@ -1346,11 +1289,12 @@ options_act(const or_options_t *old_options)
 
    /* disable ptrace and later, other basic debugging techniques */
   if (options->DisableDebuggerAttachment) {
-      tor_disable_debugger_attach();
+    tor_disable_debugger_attach();
   } else {
-      log_notice(LD_CONFIG,"Debugger attachment enabled for unprivileged users.");
+    log_notice(LD_CONFIG,"Debugger attachment enabled "
+               "for unprivileged users.");
   }
- 
+
   if (running_tor && !have_lockfile()) {
     if (try_locking(options, 1) < 0)
       return -1;