Bug 437958 - /proc/<pid>/environ not always accessible when receiving PTRACE_EVENT_EXIT
Summary: /proc/<pid>/environ not always accessible when receiving PTRACE_EVENT_EXIT
Alias: None
Product: Red Hat Enterprise Linux 5
Classification: Red Hat
Component: kernel   
(Show other bugs)
Version: 5.2
Hardware: All
OS: Linux
Target Milestone: rc
: ---
Assignee: Jerome Marchand
QA Contact: Martin Jenner
Depends On: 285761
TreeView+ depends on / blocked
Reported: 2008-03-18 13:07 UTC by Jan Kratochvil
Modified: 2009-01-20 20:24 UTC (History)
2 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Last Closed: 2009-01-20 20:24:11 UTC
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---

Attachments (Terms of Use)

External Trackers
Tracker ID Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2009:0225 normal SHIPPED_LIVE Important: Red Hat Enterprise Linux 5.3 kernel security and bug fix update 2009-01-20 16:06:24 UTC

Description Jan Kratochvil 2008-03-18 13:07:39 UTC
+++ This bug was initially created as a clone of Bug #285761 +++

/proc/<pid>/maps is already accessible for RHEL-5.2.

Description of problem:
I trace a process using ptrace and the PTRACE_O_TRACEEXIT option. When I get
the PTRACE_EVENT_EXIT notification for the process I examine its
/proc/<pid>/environ. This works on RECENT vanilla Linux kernels.

I am not aware of any applications depending on such feature.

Version-Release number of selected component (if applicable):
(it works on upstream kernel 2.6.25-0.101.rc4.git3.fc8 x86_64)
(it works on F-8 kernel kernel-

How reproducible:
Every time.

Steps to Reproduce:
1. wget -O event-exit-proc-environ.c
2. gcc -o event-exit-proc-environ event-exit-proc-environ.c -Wall -ggdb2
3. ./event-exit-proc-environ; echo $?

Actual results:
/proc/15504/environ has uid 0 and mode 0400
./event-exit-proc-environ: Failed to open /proc/15504/environ: error 13:
Permission denied

Expected results:

-- Additional comment from roland@redhat.com on 2007-10-10 23:06 EST --
This problem is not really related to ptrace.  It's a Fedora difference that
AFAICT is more or less intentional, but at any rate I am not the sole person to
ask about it.

The issue is that Fedora makes maps et al not world-readable.  In all kernels,
the core dump code (even with ulimit -c 0) clears the process's (mm's)
"dumpable" flag.  Once this flag is clear, the /proc/pid file access all acts
with the files owned by root rather than by the euid.  Since maps has mode 400
in Fedora (444 upstream), you can't read it when it belongs to root, so you can
no longer open your own child's /proc files for reading.

This is probably an unintended confluence of factors motivated by different
things.  The 400 vs 444 is an intended security change in Fedora.  The
permission meaning of dumpable=0 is intended for keeping secure things that
changed uids or something like that--a privileged daemon that switches to your
uid does not dump a core file owned by you.  The core dump code clearing
dumpable is probably part of some necessary synchronization plan or something. 
All added together, they have the effect of denying a permission noone ever
intended to deny (/proc files of a task that is in the process of dying by a
core signal)--but this can only be seen in non-racy conditions when you are
either looking at a zombie (which has no such info as e.g. maps left to show
anyway) or are looking at a PTRACE_EVENT_EXIT stop.

-- Additional comment from roland@redhat.com on 2007-10-10 23:07 EST --
linux-2.6-execshield.patch is what changes the fs/proc/base.c permissions to
cause this.

-- Additional comment from roland@redhat.com on 2007-10-11 06:38 EST --

-- Additional comment from roland@redhat.com on 2007-11-12 17:18 EST --

A variant of my fix went in upstream today.  This should hit rawhide in the
fullness of time.  It would be trivial to backport to 2.6.23 if this is worth
bothering with fixing early for Fedora [678].

Comment 1 RHEL Product and Program Management 2008-06-18 03:41:01 UTC
This request was evaluated by Red Hat Product Management for inclusion in a Red
Hat Enterprise Linux maintenance release.  Product Management has requested
further review of this request by Red Hat Engineering, for potential
inclusion in a Red Hat Enterprise Linux Update release for currently deployed
products.  This request is not yet committed for inclusion in an Update

Comment 4 Don Zickus 2008-08-13 16:06:50 UTC
in kernel-2.6.18-104.el5
You can download this test kernel from http://people.redhat.com/dzickus/el5

Comment 9 errata-xmlrpc 2009-01-20 20:24:11 UTC
An advisory has been issued which should help the problem
described in this bug report. This report is therefore being
closed with a resolution of ERRATA. For more information
on therefore solution and/or where to find the updated files,
please follow the link below. You may reopen this bug report
if the solution does not work for you.


Note You need to log in before you can comment on or make changes to this bug.