Bug 285761 - /proc/<pid>/maps not always accessible when receiving PTRACE_EVENT_EXIT
/proc/<pid>/maps not always accessible when receiving PTRACE_EVENT_EXIT
Product: Fedora
Classification: Fedora
Component: kernel (Show other bugs)
All Linux
medium Severity low
: ---
: ---
Assigned To: Kernel Maintainer List
Fedora Extras Quality Assurance
Depends On:
Blocks: 312031 312041 437958
  Show dependency treegraph
Reported: 2007-09-11 07:40 EDT by Magnus Vesterlund
Modified: 2008-03-18 09:07 EDT (History)
3 users (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Last Closed: 2007-11-12 17:18:27 EST
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---

Attachments (Terms of Use)
Test case. (2.49 KB, text/plain)
2007-09-11 07:40 EDT, Magnus Vesterlund
no flags Details
enhanced test case (2.71 KB, text/plain)
2007-10-11 00:10 EDT, Roland McGrath
no flags Details

  None (edit)
Description Magnus Vesterlund 2007-09-11 07:40:06 EDT
Description of problem:
I trace a process using ptrace and the PTRACE_O_TRACEEXIT option. When I get
the PTRACE_EVENT_EXIT notification for the process I examine its memory
mappings by reading /proc/<pid>/maps. This works on vanilla Linux kernels.

On the Fedora kernel this works if the process exited normally, but if it was
killed by a signal I get EACCES when trying to open /proc/<pid>/maps.

I guess this is undocumented behaviour, but it would be good to know if I
should expect a fix or work around the problem somehow.

I am running the x86_64 version of the kernel on a Core 2 T7200.

Version-Release number of selected component (if applicable):

How reproducible:
Every time.

Steps to Reproduce:
1. Compile and run the attached test case.

Actual results:
Test case fails to open /proc/<pid>/maps.

Expected results:
Test case prints the contents of /proc/<pid>/maps.
Comment 1 Magnus Vesterlund 2007-09-11 07:40:06 EDT
Created attachment 192401 [details]
Test case.
Comment 2 Jan Kratochvil 2007-09-26 17:28:09 EDT
Verified on: kernel-2.6.23-0.195.rc7.git3.fc8.x86_64
Comment 3 Jan Kratochvil 2007-10-04 14:07:10 EDT
(It was a verification it is still buggy there in Comment 2.)

You must not be root to make the test fail on the Fedora kernel.
(The test really works even for non-root on the upstream kernels.)
Comment 4 Roland McGrath 2007-10-10 23:06:05 EDT
This problem is not really related to ptrace.  It's a Fedora difference that
AFAICT is more or less intentional, but at any rate I am not the sole person to
ask about it.

The issue is that Fedora makes maps et al not world-readable.  In all kernels,
the core dump code (even with ulimit -c 0) clears the process's (mm's)
"dumpable" flag.  Once this flag is clear, the /proc/pid file access all acts
with the files owned by root rather than by the euid.  Since maps has mode 400
in Fedora (444 upstream), you can't read it when it belongs to root, so you can
no longer open your own child's /proc files for reading.

This is probably an unintended confluence of factors motivated by different
things.  The 400 vs 444 is an intended security change in Fedora.  The
permission meaning of dumpable=0 is intended for keeping secure things that
changed uids or something like that--a privileged daemon that switches to your
uid does not dump a core file owned by you.  The core dump code clearing
dumpable is probably part of some necessary synchronization plan or something. 
All added together, they have the effect of denying a permission noone ever
intended to deny (/proc files of a task that is in the process of dying by a
core signal)--but this can only be seen in non-racy conditions when you are
either looking at a zombie (which has no such info as e.g. maps left to show
anyway) or are looking at a PTRACE_EVENT_EXIT stop.
Comment 5 Roland McGrath 2007-10-10 23:07:34 EDT
linux-2.6-execshield.patch is what changes the fs/proc/base.c permissions to
cause this.
Comment 6 Roland McGrath 2007-10-11 00:10:15 EDT
Created attachment 223861 [details]
enhanced test case

This version of the test case displays the uid/mode of the proc file, which
demonstrates what's going on in different kernels clearly.
Comment 7 Roland McGrath 2007-10-11 06:38:00 EDT
Comment 8 Roland McGrath 2007-11-12 17:18:27 EST

A variant of my fix went in upstream today.  This should hit rawhide in the
fullness of time.  It would be trivial to backport to 2.6.23 if this is worth
bothering with fixing early for Fedora [678].
Comment 9 Jan Kratochvil 2008-03-09 00:57:03 EST
Both cases:
verified as fixed on Fedora 8:
  kernel- (F8)
  kernel-2.6.25-0.101.rc4.git3.fc9.x86_64 (Rawhide)

Note You need to log in before you can comment on or make changes to this bug.