nihilist/tor
1
0
Fork 0
mirror of https://gitlab.torproject.org/tpo/core/tor.git synced 2024-11-11 05:33:47 +01:00
Code Issues Packages Projects Releases Wiki Activity

Move disable-debugger-attachment fn to compat where it belongs. Fix whitespace

Browse Source
This commit is contained in:
Nick Mathewson 2011-11-24 23:45:47 -05:00
parent 3508de3cd6
commit eaa3a379f0
3 changed files with 64 additions and 60 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

59
src/common/compat.c
View File

@ -58,6 +58,14 @@
#endif
#endif
/* Includes for the process attaching prevention */
#if defined(HAVE_SYS_PRCTL_H) && defined(__linux__)
#include <sys/prctl.h>
#elif defined(__APPLE__)
#include <sys/types.h>
#include <sys/ptrace.h>
#endif
#ifdef HAVE_NETDB_H
#include <netdb.h>
#endif
@ -1519,6 +1527,57 @@ switch_id(const char *user)
#endif
}
/* We only use the linux prctl for now. There is no Win32 support; this may
* also work on various BSD systems and Mac OS X - send testing feedback!
*
* On recent Gnu/Linux kernels it is possible to create a system-wide policy
* that will prevent non-root processes from attaching to other processes
* unless they are the parent process; thus gdb can attach to programs that
* they execute but they cannot attach to other processes running as the same
* user. The system wide policy may be set with the sysctl
* kernel.yama.ptrace_scope or by inspecting
* /proc/sys/kernel/yama/ptrace_scope and it is 1 by default on Ubuntu 11.04.
*
* This ptrace scope will be ignored on Gnu/Linux for users with
* CAP_SYS_PTRACE and so it is very likely that root will still be able to
* attach to the Tor process.
*/
/** Attempt to disable debugger attachment: return 0 on success, -1 on
* failure. */
int
tor_disable_debugger_attach(void)
{
int r, attempted;
r = -1;
attempted = 0;
log_debug(LD_CONFIG,
"Attemping to disable debugger attachment to Tor for "
"unprivileged users.");
#if defined(__linux__) && defined(HAVE_SYS_PRCTL_H) && defined(HAVE_PRCTL)
#ifdef PR_SET_DUMPABLE
attempted = 1;
r = prctl(PR_SET_DUMPABLE, 0);
#endif
#endif
#if defined(__APPLE__) && defined(PT_DENY_ATTACH)
if (r < 0) {
attempted = 1;
r = ptrace(PT_DENY_ATTACH, 0, 0, 0);
}
#endif
// XXX: TODO - Mac OS X has dtrace and this may be disabled.
// XXX: TODO - Windows probably has something similar
if (r == 0) {
log_debug(LD_CONFIG,"Debugger attachment disabled for "
"unprivileged users.");
} else if (attempted) {
log_warn(LD_CONFIG, "Unable to disable ptrace attach: %s",
strerror(errno));
}
return r;
}
#ifdef HAVE_PWD_H
/** Allocate and return a string containing the home directory for the
* user <b>username</b>. Only works on posix-like systems. */

1
src/common/compat.h
View File

@ -566,6 +566,7 @@ set_uint8(void *cp, uint8_t v)
typedef unsigned long rlim_t;
#endif
int set_max_file_descriptors(rlim_t limit, int *max);
int tor_disable_debugger_attach(void);
int switch_id(const char *user);
#ifdef HAVE_PWD_H
char *get_user_homedir(const char *username);

64
src/or/config.c
View File

@ -40,14 +40,6 @@
#include <shlobj.h>
#endif
/* Includes for the process attaching prevention */
#if defined(HAVE_SYS_PRCTL_H) && defined(__linux__)
#include <sys/prctl.h>
#elif defined(__APPLE__)
#include <sys/types.h>
#include <sys/ptrace.h>
#endif
#include "procmon.h"
/* From main.c */
@ -687,55 +679,6 @@ get_dirportfrontpage(void)
return global_dirfrontpagecontents;
}
/* We only use the linux prctl for now. There is no Win32 support; this may
* also work on various BSD systems and Mac OS X - send testing feedback!
*
* On recent Gnu/Linux kernels it is possible to create a system-wide policy
* that will prevent non-root processes from attaching to other processes
* unless they are the parent process; thus gdb can attach to programs that
* they execute but they cannot attach to other processes running as the same
* user. The system wide policy may be set with the sysctl
* kernel.yama.ptrace_scope or by inspecting /proc/sys/kernel/yama/ptrace_scope
* and it is 1 by default on Ubuntu 11.04.
*
* This ptrace scope will be ignored on Gnu/Linux for users with
* CAP_SYS_PTRACE and so it is very likely that root will still be able to
* attach to the Tor process.
*/
/** Attempt to disable debugger attachment. */
static int
tor_disable_debugger_attach(void)
{
int r, attempted;
r = -1;
attempted = 0;
log_debug(LD_CONFIG,
"Attemping to disable debugger attachment to Tor for "
"unprivileged users.");
#if defined(__linux__) && defined(HAVE_SYS_PRCTL_H) && defined(HAVE_PRCTL)
#ifdef PR_SET_DUMPABLE
attempted = 1;
r = prctl(PR_SET_DUMPABLE, 0);
#endif
#endif
#if defined(__APPLE__) && defined(PT_DENY_ATTACH)
if (r < 0) {
attempted = 1;
r = ptrace(PT_DENY_ATTACH, 0, 0, 0);
}
#endif
// XXX: TODO - Mac OS X has dtrace and this may be disabled - implement it here
// XXX: TODO - Windows probably has something similar - implement it here
if (r == 0) {
log_debug(LD_CONFIG,"Debugger attachment disabled for unprivileged users.");
} else if (attempted) {
log_warn(LD_CONFIG, "Unable to disable ptrace attach: %s",
strerror(errno));
}
return r;
}
/** Allocate an empty configuration object of a given format type. */
static void *
config_alloc(const config_format_t *fmt)
@ -1346,11 +1289,12 @@ options_act(const or_options_t *old_options)
/* disable ptrace and later, other basic debugging techniques */
if (options->DisableDebuggerAttachment) {
tor_disable_debugger_attach();
tor_disable_debugger_attach();
} else {
log_notice(LD_CONFIG,"Debugger attachment enabled for unprivileged users.");
log_notice(LD_CONFIG,"Debugger attachment enabled "
"for unprivileged users.");
}
if (running_tor && !have_lockfile()) {
if (try_locking(options, 1) < 0)
return -1;