Blame SOURCES/gdb-attach-fail-reasons-5of5.patch

4c2ad1
From FEDORA_PATCHES Mon Sep 17 00:00:00 2001
4c2ad1
From: Fedora GDB patches <invalid@email.com>
4c2ad1
Date: Fri, 27 Oct 2017 21:07:50 +0200
4c2ad1
Subject: gdb-attach-fail-reasons-5of5.patch
4c2ad1
4c2ad1
;; Print reasons for failed attach/spawn incl. SELinux deny_ptrace (BZ 786878).
4c2ad1
;;=push+jan
4c2ad1
4c2ad1
http://sourceware.org/ml/gdb-patches/2012-03/msg00171.html
4c2ad1
4c2ad1
Hi,
4c2ad1
4c2ad1
and here is the last bit for new SELinux 'deny_ptrace':
4c2ad1
	https://bugzilla.redhat.com/show_bug.cgi?id=786878
4c2ad1
4c2ad1
As even PTRACE_TRACEME fails in such case it needs to install hook for even
4c2ad1
that event.
4c2ad1
4c2ad1
Thanks,
4c2ad1
Jan
4c2ad1
4c2ad1
gdb/
4c2ad1
2012-03-06  Jan Kratochvil  <jan.kratochvil@redhat.com>
4c2ad1
4c2ad1
	* common/linux-ptrace.c [HAVE_SELINUX_SELINUX_H]: include
4c2ad1
	selinux/selinux.h.
4c2ad1
	(linux_ptrace_attach_warnings): Call linux_ptrace_create_warnings.
4c2ad1
	(linux_ptrace_create_warnings): New.
4c2ad1
	* common/linux-ptrace.h (linux_ptrace_create_warnings): New declaration.
4c2ad1
	* config.in: Regenerate.
4c2ad1
	* configure: Regenerate.
4c2ad1
	* configure.ac: Check selinux/selinux.h and the selinux library.
4c2ad1
	* inf-ptrace.c (inf_ptrace_me): Check the ptrace result.
4c2ad1
	* linux-nat.c (linux_nat_create_inferior): New variable ex.  Wrap
4c2ad1
	to_create_inferior into TRY_CATCH, call linux_ptrace_create_warnings.
4c2ad1
4c2ad1
gdb/gdbserver/
4c2ad1
	* config.in: Regenerate.
4c2ad1
	* configure: Regenerate.
4c2ad1
	* configure.ac: Check selinux/selinux.h and the selinux library.
4c2ad1
	* linux-low.c (linux_traceme): New function.
4c2ad1
	(linux_create_inferior, linux_tracefork_child): Call it instead of
4c2ad1
	direct ptrace.
4c2ad1
4c2ad1
diff --git a/gdb/config.in b/gdb/config.in
4c2ad1
--- a/gdb/config.in
4c2ad1
+++ b/gdb/config.in
4c2ad1
@@ -276,6 +276,9 @@
4c2ad1
 /* Define if librpm library is being used. */
4c2ad1
 #undef HAVE_LIBRPM
4c2ad1
 
4c2ad1
+/* Define to 1 if you have the `selinux' library (-lselinux). */
4c2ad1
+#undef HAVE_LIBSELINUX
4c2ad1
+
4c2ad1
 /* Define to 1 if you have the <libunwind-ia64.h> header file. */
4c2ad1
 #undef HAVE_LIBUNWIND_IA64_H
4c2ad1
 
4c2ad1
@@ -399,6 +402,9 @@
4c2ad1
 /* Define to 1 if you have the `scm_new_smob' function. */
4c2ad1
 #undef HAVE_SCM_NEW_SMOB
4c2ad1
 
4c2ad1
+/* Define to 1 if you have the <selinux/selinux.h> header file. */
4c2ad1
+#undef HAVE_SELINUX_SELINUX_H
4c2ad1
+
4c2ad1
 /* Define to 1 if you have the `setlocale' function. */
4c2ad1
 #undef HAVE_SETLOCALE
4c2ad1
 
4c2ad1
diff --git a/gdb/configure b/gdb/configure
4c2ad1
--- a/gdb/configure
4c2ad1
+++ b/gdb/configure
4c2ad1
@@ -15854,6 +15854,64 @@ cat >>confdefs.h <<_ACEOF
4c2ad1
 _ACEOF
4c2ad1
 
4c2ad1
 
4c2ad1
+for ac_header in selinux/selinux.h
4c2ad1
+do :
4c2ad1
+  ac_fn_c_check_header_mongrel "$LINENO" "selinux/selinux.h" "ac_cv_header_selinux_selinux_h" "$ac_includes_default"
4c2ad1
+if test "x$ac_cv_header_selinux_selinux_h" = x""yes; then :
4c2ad1
+  cat >>confdefs.h <<_ACEOF
4c2ad1
+#define HAVE_SELINUX_SELINUX_H 1
4c2ad1
+_ACEOF
4c2ad1
+
4c2ad1
+fi
4c2ad1
+
4c2ad1
+done
4c2ad1
+
4c2ad1
+{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for security_get_boolean_active in -lselinux" >&5
4c2ad1
+$as_echo_n "checking for security_get_boolean_active in -lselinux... " >&6; }
4c2ad1
+if test "${ac_cv_lib_selinux_security_get_boolean_active+set}" = set; then :
4c2ad1
+  $as_echo_n "(cached) " >&6
4c2ad1
+else
4c2ad1
+  ac_check_lib_save_LIBS=$LIBS
4c2ad1
+LIBS="-lselinux  $LIBS"
4c2ad1
+cat confdefs.h - <<_ACEOF >conftest.$ac_ext
4c2ad1
+/* end confdefs.h.  */
4c2ad1
+
4c2ad1
+/* Override any GCC internal prototype to avoid an error.
4c2ad1
+   Use char because int might match the return type of a GCC
4c2ad1
+   builtin and then its argument prototype would still apply.  */
4c2ad1
+#ifdef __cplusplus
4c2ad1
+extern "C"
4c2ad1
+#endif
4c2ad1
+char security_get_boolean_active ();
4c2ad1
+int
4c2ad1
+main ()
4c2ad1
+{
4c2ad1
+return security_get_boolean_active ();
4c2ad1
+  ;
4c2ad1
+  return 0;
4c2ad1
+}
4c2ad1
+_ACEOF
4c2ad1
+if ac_fn_c_try_link "$LINENO"; then :
4c2ad1
+  ac_cv_lib_selinux_security_get_boolean_active=yes
4c2ad1
+else
4c2ad1
+  ac_cv_lib_selinux_security_get_boolean_active=no
4c2ad1
+fi
4c2ad1
+rm -f core conftest.err conftest.$ac_objext \
4c2ad1
+    conftest$ac_exeext conftest.$ac_ext
4c2ad1
+LIBS=$ac_check_lib_save_LIBS
4c2ad1
+fi
4c2ad1
+{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_lib_selinux_security_get_boolean_active" >&5
4c2ad1
+$as_echo "$ac_cv_lib_selinux_security_get_boolean_active" >&6; }
4c2ad1
+if test "x$ac_cv_lib_selinux_security_get_boolean_active" = x""yes; then :
4c2ad1
+  cat >>confdefs.h <<_ACEOF
4c2ad1
+#define HAVE_LIBSELINUX 1
4c2ad1
+_ACEOF
4c2ad1
+
4c2ad1
+  LIBS="-lselinux $LIBS"
4c2ad1
+
4c2ad1
+fi
4c2ad1
+
4c2ad1
+
4c2ad1
 
4c2ad1
 # Support for --with-sysroot is a copy of GDB_AC_WITH_DIR,
4c2ad1
 # except that the argument to --with-sysroot is optional.
4c2ad1
diff --git a/gdb/configure.ac b/gdb/configure.ac
4c2ad1
--- a/gdb/configure.ac
4c2ad1
+++ b/gdb/configure.ac
4c2ad1
@@ -2054,6 +2054,10 @@ case $host_os in
4c2ad1
 esac
4c2ad1
 AC_DEFINE_UNQUOTED(GDBINIT,"$gdbinit",[The .gdbinit filename.])
4c2ad1
 
4c2ad1
+dnl Check security_get_boolean_active availability.
4c2ad1
+AC_CHECK_HEADERS(selinux/selinux.h)
4c2ad1
+AC_CHECK_LIB(selinux, security_get_boolean_active)
4c2ad1
+
4c2ad1
 dnl Handle optional features that can be enabled.
4c2ad1
 
4c2ad1
 # Support for --with-sysroot is a copy of GDB_AC_WITH_DIR,
4c2ad1
diff --git a/gdb/gdbserver/config.in b/gdb/gdbserver/config.in
4c2ad1
--- a/gdb/gdbserver/config.in
4c2ad1
+++ b/gdb/gdbserver/config.in
4c2ad1
@@ -126,6 +126,9 @@
4c2ad1
 /* Define to 1 if you have the `mcheck' library (-lmcheck). */
4c2ad1
 #undef HAVE_LIBMCHECK
4c2ad1
 
4c2ad1
+/* Define to 1 if you have the `selinux' library (-lselinux). */
4c2ad1
+#undef HAVE_LIBSELINUX
4c2ad1
+
4c2ad1
 /* Define if the target supports branch tracing. */
4c2ad1
 #undef HAVE_LINUX_BTRACE
4c2ad1
 
4c2ad1
@@ -202,6 +205,9 @@
4c2ad1
 /* Define to 1 if you have the `pwrite' function. */
4c2ad1
 #undef HAVE_PWRITE
4c2ad1
 
4c2ad1
+/* Define to 1 if you have the <selinux/selinux.h> header file. */
4c2ad1
+#undef HAVE_SELINUX_SELINUX_H
4c2ad1
+
4c2ad1
 /* Define to 1 if you have the `setns' function. */
4c2ad1
 #undef HAVE_SETNS
4c2ad1
 
4c2ad1
diff --git a/gdb/gdbserver/configure b/gdb/gdbserver/configure
4c2ad1
--- a/gdb/gdbserver/configure
4c2ad1
+++ b/gdb/gdbserver/configure
4c2ad1
@@ -8535,6 +8535,64 @@ if $want_ipa ; then
4c2ad1
    fi
4c2ad1
 fi
4c2ad1
 
4c2ad1
+for ac_header in selinux/selinux.h
4c2ad1
+do :
4c2ad1
+  ac_fn_c_check_header_mongrel "$LINENO" "selinux/selinux.h" "ac_cv_header_selinux_selinux_h" "$ac_includes_default"
4c2ad1
+if test "x$ac_cv_header_selinux_selinux_h" = x""yes; then :
4c2ad1
+  cat >>confdefs.h <<_ACEOF
4c2ad1
+#define HAVE_SELINUX_SELINUX_H 1
4c2ad1
+_ACEOF
4c2ad1
+
4c2ad1
+fi
4c2ad1
+
4c2ad1
+done
4c2ad1
+
4c2ad1
+{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for security_get_boolean_active in -lselinux" >&5
4c2ad1
+$as_echo_n "checking for security_get_boolean_active in -lselinux... " >&6; }
4c2ad1
+if test "${ac_cv_lib_selinux_security_get_boolean_active+set}" = set; then :
4c2ad1
+  $as_echo_n "(cached) " >&6
4c2ad1
+else
4c2ad1
+  ac_check_lib_save_LIBS=$LIBS
4c2ad1
+LIBS="-lselinux  $LIBS"
4c2ad1
+cat confdefs.h - <<_ACEOF >conftest.$ac_ext
4c2ad1
+/* end confdefs.h.  */
4c2ad1
+
4c2ad1
+/* Override any GCC internal prototype to avoid an error.
4c2ad1
+   Use char because int might match the return type of a GCC
4c2ad1
+   builtin and then its argument prototype would still apply.  */
4c2ad1
+#ifdef __cplusplus
4c2ad1
+extern "C"
4c2ad1
+#endif
4c2ad1
+char security_get_boolean_active ();
4c2ad1
+int
4c2ad1
+main ()
4c2ad1
+{
4c2ad1
+return security_get_boolean_active ();
4c2ad1
+  ;
4c2ad1
+  return 0;
4c2ad1
+}
4c2ad1
+_ACEOF
4c2ad1
+if ac_fn_c_try_link "$LINENO"; then :
4c2ad1
+  ac_cv_lib_selinux_security_get_boolean_active=yes
4c2ad1
+else
4c2ad1
+  ac_cv_lib_selinux_security_get_boolean_active=no
4c2ad1
+fi
4c2ad1
+rm -f core conftest.err conftest.$ac_objext \
4c2ad1
+    conftest$ac_exeext conftest.$ac_ext
4c2ad1
+LIBS=$ac_check_lib_save_LIBS
4c2ad1
+fi
4c2ad1
+{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_lib_selinux_security_get_boolean_active" >&5
4c2ad1
+$as_echo "$ac_cv_lib_selinux_security_get_boolean_active" >&6; }
4c2ad1
+if test "x$ac_cv_lib_selinux_security_get_boolean_active" = x""yes; then :
4c2ad1
+  cat >>confdefs.h <<_ACEOF
4c2ad1
+#define HAVE_LIBSELINUX 1
4c2ad1
+_ACEOF
4c2ad1
+
4c2ad1
+  LIBS="-lselinux $LIBS"
4c2ad1
+
4c2ad1
+fi
4c2ad1
+
4c2ad1
+
4c2ad1
 
4c2ad1
 
4c2ad1
 
4c2ad1
diff --git a/gdb/gdbserver/configure.ac b/gdb/gdbserver/configure.ac
4c2ad1
--- a/gdb/gdbserver/configure.ac
4c2ad1
+++ b/gdb/gdbserver/configure.ac
4c2ad1
@@ -486,6 +486,10 @@ if $want_ipa ; then
4c2ad1
    fi
4c2ad1
 fi
4c2ad1
 
4c2ad1
+dnl Check security_get_boolean_active availability.
4c2ad1
+AC_CHECK_HEADERS(selinux/selinux.h)
4c2ad1
+AC_CHECK_LIB(selinux, security_get_boolean_active)
4c2ad1
+
4c2ad1
 AC_SUBST(GDBSERVER_DEPFILES)
4c2ad1
 AC_SUBST(GDBSERVER_LIBS)
4c2ad1
 AC_SUBST(srv_xmlbuiltin)
4c2ad1
diff --git a/gdb/gdbserver/linux-low.c b/gdb/gdbserver/linux-low.c
4c2ad1
--- a/gdb/gdbserver/linux-low.c
4c2ad1
+++ b/gdb/gdbserver/linux-low.c
4c2ad1
@@ -967,7 +967,16 @@ linux_ptrace_fun ()
4c2ad1
 {
4c2ad1
   if (ptrace (PTRACE_TRACEME, 0, (PTRACE_TYPE_ARG3) 0,
4c2ad1
 	      (PTRACE_TYPE_ARG4) 0) < 0)
4c2ad1
-    trace_start_error_with_name ("ptrace");
4c2ad1
+    {
4c2ad1
+      int save_errno = errno;
4c2ad1
+
4c2ad1
+      std::string msg (linux_ptrace_create_warnings ());
4c2ad1
+
4c2ad1
+      msg += _("Cannot trace created process");
4c2ad1
+
4c2ad1
+      errno = save_errno;
4c2ad1
+      trace_start_error_with_name (msg.c_str ());
4c2ad1
+    }
4c2ad1
 
4c2ad1
   if (setpgid (0, 0) < 0)
4c2ad1
     trace_start_error_with_name ("setpgid");
4c2ad1
diff --git a/gdb/linux-nat.c b/gdb/linux-nat.c
4c2ad1
--- a/gdb/linux-nat.c
4c2ad1
+++ b/gdb/linux-nat.c
4c2ad1
@@ -1089,7 +1089,17 @@ linux_nat_target::create_inferior (const char *exec_file,
4c2ad1
   /* Make sure we report all signals during startup.  */
4c2ad1
   pass_signals (0, NULL);
4c2ad1
 
4c2ad1
-  inf_ptrace_target::create_inferior (exec_file, allargs, env, from_tty);
4c2ad1
+  TRY
4c2ad1
+    {
4c2ad1
+      inf_ptrace_target::create_inferior (exec_file, allargs, env, from_tty);
4c2ad1
+    }
4c2ad1
+  CATCH (ex, RETURN_MASK_ERROR)
4c2ad1
+    {
4c2ad1
+      std::string result =  linux_ptrace_create_warnings ();
4c2ad1
+
4c2ad1
+      throw_error (ex.error, "%s%s", result.c_str (), ex.message);
4c2ad1
+    }
4c2ad1
+  END_CATCH
4c2ad1
 }
4c2ad1
 
4c2ad1
 /* Callback for linux_proc_attach_tgid_threads.  Attach to PTID if not
4c2ad1
diff --git a/gdb/nat/linux-ptrace.c b/gdb/nat/linux-ptrace.c
4c2ad1
--- a/gdb/nat/linux-ptrace.c
4c2ad1
+++ b/gdb/nat/linux-ptrace.c
4c2ad1
@@ -25,6 +25,10 @@
4c2ad1
 #include <sys/procfs.h>
4c2ad1
 #endif
4c2ad1
 
4c2ad1
+#ifdef HAVE_SELINUX_SELINUX_H
4c2ad1
+# include <selinux/selinux.h>
4c2ad1
+#endif /* HAVE_SELINUX_SELINUX_H */
4c2ad1
+
4c2ad1
 /* Stores the ptrace options supported by the running kernel.
4c2ad1
    A value of -1 means we did not check for features yet.  A value
4c2ad1
    of 0 means there are no supported features.  */
4c2ad1
@@ -50,6 +54,8 @@ linux_ptrace_attach_fail_reason (pid_t pid)
4c2ad1
 		      "terminated"),
4c2ad1
 		    (int) pid);
4c2ad1
 
4c2ad1
+  result += linux_ptrace_create_warnings ();
4c2ad1
+
4c2ad1
   return result;
4c2ad1
 }
4c2ad1
 
4c2ad1
@@ -583,6 +589,25 @@ linux_ptrace_init_warnings (void)
4c2ad1
   linux_ptrace_test_ret_to_nx ();
4c2ad1
 }
4c2ad1
 
4c2ad1
+/* Print all possible reasons we could fail to create a traced process.  */
4c2ad1
+
4c2ad1
+std::string
4c2ad1
+linux_ptrace_create_warnings ()
4c2ad1
+{
4c2ad1
+  std::string result;
4c2ad1
+
4c2ad1
+#ifdef HAVE_LIBSELINUX
4c2ad1
+  /* -1 is returned for errors, 0 if it has no effect, 1 if PTRACE_ATTACH is
4c2ad1
+     forbidden.  */
4c2ad1
+  if (security_get_boolean_active ("deny_ptrace") == 1)
4c2ad1
+    string_appendf (result,
4c2ad1
+		    _("the SELinux boolean 'deny_ptrace' is enabled, "
4c2ad1
+		      "you can disable this process attach protection by: "
4c2ad1
+		      "(gdb) shell sudo setsebool deny_ptrace=0\n"));
4c2ad1
+#endif /* HAVE_LIBSELINUX */
4c2ad1
+  return result;
4c2ad1
+}
4c2ad1
+
4c2ad1
 /* Extract extended ptrace event from wait status.  */
4c2ad1
 
4c2ad1
 int
4c2ad1
diff --git a/gdb/nat/linux-ptrace.h b/gdb/nat/linux-ptrace.h
4c2ad1
--- a/gdb/nat/linux-ptrace.h
4c2ad1
+++ b/gdb/nat/linux-ptrace.h
4c2ad1
@@ -184,6 +184,7 @@ extern std::string linux_ptrace_attach_fail_reason (pid_t pid);
4c2ad1
 extern std::string linux_ptrace_attach_fail_reason_string (ptid_t ptid, int err);
4c2ad1
 
4c2ad1
 extern void linux_ptrace_init_warnings (void);
4c2ad1
+extern std::string linux_ptrace_create_warnings ();
4c2ad1
 extern void linux_check_ptrace_features (void);
4c2ad1
 extern void linux_enable_event_reporting (pid_t pid, int attached);
4c2ad1
 extern void linux_disable_event_reporting (pid_t pid);