This is the mail archive of the
gdb-patches@sourceware.org
mailing list for the GDB project.
Re: [PATCH v2] gdbserver: linux_low: elf_64_file_p cache results
- From: Pedro Alves <palves at redhat dot com>
- To: Jon Ringle <jon at ringle dot org>
- Cc: gdb-patches at sourceware dot org, Jon Ringle <jringle at gridpoint dot com>
- Date: Thu, 24 Aug 2017 15:42:20 +0100
- Subject: Re: [PATCH v2] gdbserver: linux_low: elf_64_file_p cache results
- Authentication-results: sourceware.org; auth=none
- Authentication-results: ext-mx03.extmail.prod.ext.phx2.redhat.com; dmarc=none (p=none dis=none) header.from=redhat.com
- Authentication-results: ext-mx03.extmail.prod.ext.phx2.redhat.com; spf=fail smtp.mailfrom=palves at redhat dot com
- Dmarc-filter: OpenDMARC Filter v1.3.2 mx1.redhat.com 3AE5A75714
- References: <1503549910-24770-1-git-send-email-jon@ringle.org> <402cb282-9cd1-2725-f6de-ec5f9eb15e0d@redhat.com> <CAMwGMjwPzZd-P8KRrjY6-mowkPbOLX+JTz-yL2W=N63q7BkzzA@mail.gmail.com>
On 08/24/2017 03:14 PM, Jon Ringle wrote:
> On Thu, Aug 24, 2017 at 5:26 AM, Pedro Alves <palves@redhat.com> wrote:
>> Hi Jon,
>>
>> On 08/24/2017 05:45 AM, jon@ringle.org wrote:
>>
>>> The problem lied in the fact that the function elf_64_file_p() (call on
>>> line 7184), was returning -1 because it could not open the file (with errno
>>> set to EACCESS). This was because the inferior's code was dropping root
>>> privileges and no longer was able to read the file.
>>
>> I feel like I'm missing something. If it's the inferior that
>> is dropping privileges, how can that affect gdbserver? It's gdbserver
>> that opens the file, not the inferior.
>>
>> It'd be nice to have a testcase for this. Would it be possible to come
>> up with a small reproducer?
>>
>
> I learned something while coming up with a small reproducer. The real
> program I'm debugging is a systemd service and has a
> CapabilityBoundingSet. The CapabilityBoundingSet turns out to be a
> crucial point for reproducing.
>
> I setup a systemd service:
> $ cat /lib/systemd/system/droproot-test.service
> [Unit]
> Description=gdbserver droproot test service
>
> [Service]
> Type=simple
> ExecStart=/home/jringle/build/gdbserver/gdbserver :5555
> /home/jringle/git/droproot-test/droproot-test jringle
> Restart=on-success
> CapabilityBoundingSet=CAP_SETGID CAP_SETUID
OK, I don't know much about this, but it sounds like
without that, your "droproot" test wouldn't be able
to call setgid/setuid successfully to change to the
"jringle" user.
I'm still mystified about why can't gdbserver read
the file after "droproot" has changed user.
I assume gdbserver is running as root? Why wouldn't
a gdbserver running as root be able to read "jringle"'s
/proc file?
Does CAP_PTRACE make a difference?
I have to wonder whether there's a better way to do this..
gdbserver needs to read other /proc files, some not cacheable.
I fear that you may have run into just one case so far, and
that we may run into problems if we take this route.
Thanks,
Pedro Alves