Re: strace can lie

From: Pavel Machek (pavelat_private)
Date: Tue Dec 28 1999 - 14:18:20 PST

  • Next message: Aleph One: "ISSalert: ISS Security Advisory: Buffer Overflow in Solaris Snoop"

    Hi!
    
    >  >> Any ideas how to get rid of this problem?  It is nasty.  It is
    >  >> very nasty and makes strace unusable for anything
    >  >> security-sensitive.
    >
    >  dM> Unfortunately, as long as the information is fetched from
    >  dM> userland by userland via ptrace, with an opportunity for it to
    >  dM> change before the kernel uses it, there is no hope for
    >  dM> eliminating the race.
    >
    >  dM> If you really feel ambitious, you could try to make Linux support
    >  dM> ktrace. :-)
    >
    >   I beleive there is a workaround: one can assign RealTime Scheduler to
    > debugger process (sched_setscheduler (strace_pid, SCHED_FIFO, p)) so it will
    > preempt any of processess being debugged. Of course, scheduling priority of
    > strace should be higher than one of process if process works under RT
    > scheduler too.
    
    That will not work on SMP machine, and it will not be reliable on UP,
    either (what if you hit pagefault? what if tracer accesses filesystem
    and sleeps?).
    
    								Pavel
    --
    I'm pavelat_private "In my country we have almost anarchy and I don't care."
    Panos Katsaloulis describing me w.r.t. patents me at discussat_private
    



    This archive was generated by hypermail 2b30 : Fri Apr 13 2001 - 15:25:34 PDT