From: Frank Ch. Eigler <fche@elastic.org>
Date: Sat, 19 Jun 2010 03:01:13 +0000 (-0400)
Subject: new example: noptrace.stp
X-Git-Tag: release-1.3~213
X-Git-Url: https://sourceware.org/git/?a=commitdiff_plain;h=5481d677c7f542f6235a925de12fad4ed8b51c42;p=systemtap.git

new example: noptrace.stp
---

diff --git a/testsuite/systemtap.examples/index.html b/testsuite/systemtap.examples/index.html
index 09b576904..e215bad09 100644
--- a/testsuite/systemtap.examples/index.html
+++ b/testsuite/systemtap.examples/index.html
@@ -193,6 +193,9 @@ keywords: <a href="keyword-index.html#SYSCALL">SYSCALL</a> <a href="keyword-inde
 <li><a href="process/migrate.stp">process/migrate.stp</a> - Track the Migration of Specific Executables<br>
 keywords: <a href="keyword-index.html#SCHEDULER">SCHEDULER</a> <br>
 <p>The migrate.stp script takes an argument which is the executable name of the task it should monitor. Each time a task with that executable name migrates between processors an entry is printed with the process id (pid), the executable name, the processor off loading the task, and the process taking the task. Note that the task may or may not be executing at the time of the migration.</p></li>
+<li><a href="process/noptrace.stp">process/noptrace.stp</a> - disable ptrace(2) from hierarchies of processes<br>
+keywords: <a href="keyword-index.html#PROCESS">PROCESS</a> <a href="keyword-index.html#SECURITY">SECURITY</a> <br>
+<p>noptrace.stp blocks ptrace(2) attempts from processes identified by stap -c/-x, as also specifiable from /proc/systemtap/stap_XXX/ control files.  Processes may be added or removed from the blocked list.</p></li>
 <li><a href="process/pf2.stp">process/pf2.stp</a> - Profile kernel functions<br>
 keywords: <a href="keyword-index.html#PROFILING">PROFILING</a> <br>
 <p>The pf2.stp script sets up time-based sampling. Every five seconds it prints out a sorted list with the top ten kernel functions with samples.</p></li>
diff --git a/testsuite/systemtap.examples/index.txt b/testsuite/systemtap.examples/index.txt
index 995a27088..147638817 100644
--- a/testsuite/systemtap.examples/index.txt
+++ b/testsuite/systemtap.examples/index.txt
@@ -484,6 +484,15 @@ keywords: scheduler
   executing at the time of the migration.
 
 
+process/noptrace.stp - disable ptrace(2) from hierarchies of processes
+keywords: process security
+
+  noptrace.stp blocks ptrace(2) attempts from processes identified by
+  stap -c/-x, as also specifiable from /proc/systemtap/stap_XXX/
+  control files.  Processes may be added or removed from the blocked
+  list.
+
+
 process/pf2.stp - Profile kernel functions
 keywords: profiling
 
diff --git a/testsuite/systemtap.examples/keyword-index.html b/testsuite/systemtap.examples/keyword-index.html
index 69b75671c..2ca79f2d7 100644
--- a/testsuite/systemtap.examples/keyword-index.html
+++ b/testsuite/systemtap.examples/keyword-index.html
@@ -39,7 +39,7 @@
          	</ul>
 
 <h2>Examples by Keyword</h2>
-<p><tt><a href="#ALLOCATOR">ALLOCATOR</a> <a href="#AUTOFS">AUTOFS</a> <a href="#BACKTRACE">BACKTRACE</a> <a href="#BUFFER">BUFFER</a> <a href="#CALLGRAPH">CALLGRAPH</a> <a href="#CPU">CPU</a> <a href="#DEVICE">DEVICE</a> <a href="#DISK">DISK</a> <a href="#FILES">FILES</a> <a href="#FILESYSTEM">FILESYSTEM</a> <a href="#FORMAT">FORMAT</a> <a href="#FREE">FREE</a> <a href="#FUNCTIONS">FUNCTIONS</a> <a href="#FUTEX">FUTEX</a> <a href="#GRAPH">GRAPH</a> <a href="#HACK">HACK</a> <a href="#INTERRUPT">INTERRUPT</a> <a href="#IO">IO</a> <a href="#LOCKING">LOCKING</a> <a href="#MEMORY">MEMORY</a> <a href="#MONITORING">MONITORING</a> <a href="#NETWORK">NETWORK</a> <a href="#NFS">NFS</a> <a href="#NUMA">NUMA</a> <a href="#PER-PROCESS">PER-PROCESS</a> <a href="#PROCESS">PROCESS</a> <a href="#PROFILING">PROFILING</a> <a href="#READ">READ</a> <a href="#SCHEDULER">SCHEDULER</a> <a href="#SCSI">SCSI</a> <a href="#SIGNALS">SIGNALS</a> <a href="#SIMPLE">SIMPLE</a> <a href="#SLAB">SLAB</a> <a href="#SLEEP">SLEEP</a> <a href="#SOCKET">SOCKET</a> <a href="#STATISTICS">STATISTICS</a> <a href="#SYSCALL">SYSCALL</a> <a href="#TCP">TCP</a> <a href="#TIME">TIME</a> <a href="#TRACE">TRACE</a> <a href="#TRACEPOINT">TRACEPOINT</a> <a href="#TRAFFIC">TRAFFIC</a> <a href="#TTY">TTY</a> <a href="#USE">USE</a> <a href="#WAIT4">WAIT4</a> <a href="#WRITE">WRITE</a> </tt></p>
+<p><tt><a href="#ALLOCATOR">ALLOCATOR</a> <a href="#AUTOFS">AUTOFS</a> <a href="#BACKTRACE">BACKTRACE</a> <a href="#BUFFER">BUFFER</a> <a href="#CALLGRAPH">CALLGRAPH</a> <a href="#CPU">CPU</a> <a href="#DEVICE">DEVICE</a> <a href="#DISK">DISK</a> <a href="#FILES">FILES</a> <a href="#FILESYSTEM">FILESYSTEM</a> <a href="#FORMAT">FORMAT</a> <a href="#FREE">FREE</a> <a href="#FUNCTIONS">FUNCTIONS</a> <a href="#FUTEX">FUTEX</a> <a href="#GRAPH">GRAPH</a> <a href="#HACK">HACK</a> <a href="#INTERRUPT">INTERRUPT</a> <a href="#IO">IO</a> <a href="#LOCKING">LOCKING</a> <a href="#MEMORY">MEMORY</a> <a href="#MONITORING">MONITORING</a> <a href="#NETWORK">NETWORK</a> <a href="#NFS">NFS</a> <a href="#NUMA">NUMA</a> <a href="#PER-PROCESS">PER-PROCESS</a> <a href="#PROCESS">PROCESS</a> <a href="#PROFILING">PROFILING</a> <a href="#READ">READ</a> <a href="#SCHEDULER">SCHEDULER</a> <a href="#SCSI">SCSI</a> <a href="#SECURITY">SECURITY</a> <a href="#SIGNALS">SIGNALS</a> <a href="#SIMPLE">SIMPLE</a> <a href="#SLAB">SLAB</a> <a href="#SLEEP">SLEEP</a> <a href="#SOCKET">SOCKET</a> <a href="#STATISTICS">STATISTICS</a> <a href="#SYSCALL">SYSCALL</a> <a href="#TCP">TCP</a> <a href="#TIME">TIME</a> <a href="#TRACE">TRACE</a> <a href="#TRACEPOINT">TRACEPOINT</a> <a href="#TRAFFIC">TRAFFIC</a> <a href="#TTY">TTY</a> <a href="#USE">USE</a> <a href="#WAIT4">WAIT4</a> <a href="#WRITE">WRITE</a> </tt></p>
 <h3><a name="ALLOCATOR">ALLOCATOR</a></h3>
 <ul>
 <li><a href="memory/vm.tracepoints.stp">memory/vm.tracepoints.stp</a> - Collect slab allocation statistics<br>
@@ -342,6 +342,9 @@ keywords: <a href="keyword-index.html#PROCESS">PROCESS</a> <a href="keyword-inde
 <li><a href="process/forktracker.stp">process/forktracker.stp</a> - Trace Creation of Processes<br>
 keywords: <a href="keyword-index.html#PROCESS">PROCESS</a> <a href="keyword-index.html#SCHEDULER">SCHEDULER</a> <br>
 <p>The forktracker.stp script prints out a time-stamped entry showing each fork and exec operation on the machine. This can be useful to determine what process is creating a flurry of short-lived processes.</p></li>
+<li><a href="process/noptrace.stp">process/noptrace.stp</a> - disable ptrace(2) from hierarchies of processes<br>
+keywords: <a href="keyword-index.html#PROCESS">PROCESS</a> <a href="keyword-index.html#SECURITY">SECURITY</a> <br>
+<p>noptrace.stp blocks ptrace(2) attempts from processes identified by stap -c/-x, as also specifiable from /proc/systemtap/stap_XXX/ control files.  Processes may be added or removed from the blocked list.</p></li>
 <li><a href="process/pfiles.stp">process/pfiles.stp</a> - print process file descriptors<br>
 keywords: <a href="keyword-index.html#PROCESS">PROCESS</a> <a href="keyword-index.html#FILES">FILES</a> <br>
 <p>Run pfiles.stp to produce a human-readable summary of all open file descriptors of a given process.  Specify the process-id as -x PID for fastest performance.</p></li>
@@ -424,6 +427,12 @@ keywords: <a href="keyword-index.html#IO">IO</a> <a href="keyword-index.html#SCH
 keywords: <a href="keyword-index.html#IO">IO</a> <a href="keyword-index.html#PROFILING">PROFILING</a> <a href="keyword-index.html#SCSI">SCSI</a> <br>
 <p>The iostat-scsi.stp script provides a breakdown of the number of blks read and written on the machine's various SCSI devices. The script takes one argument which is the number of seconds between reports.</p></li>
 </ul>
+<h3><a name="SECURITY">SECURITY</a></h3>
+<ul>
+<li><a href="process/noptrace.stp">process/noptrace.stp</a> - disable ptrace(2) from hierarchies of processes<br>
+keywords: <a href="keyword-index.html#PROCESS">PROCESS</a> <a href="keyword-index.html#SECURITY">SECURITY</a> <br>
+<p>noptrace.stp blocks ptrace(2) attempts from processes identified by stap -c/-x, as also specifiable from /proc/systemtap/stap_XXX/ control files.  Processes may be added or removed from the blocked list.</p></li>
+</ul>
 <h3><a name="SIGNALS">SIGNALS</a></h3>
 <ul>
 <li><a href="process/sig_by_pid.stp">process/sig_by_pid.stp</a> -  Signal Counts by Process ID<br>
diff --git a/testsuite/systemtap.examples/keyword-index.txt b/testsuite/systemtap.examples/keyword-index.txt
index d559cbaf7..b6ce40afe 100644
--- a/testsuite/systemtap.examples/keyword-index.txt
+++ b/testsuite/systemtap.examples/keyword-index.txt
@@ -739,6 +739,15 @@ keywords: process scheduler
   determine what process is creating a flurry of short-lived processes.
 
 
+process/noptrace.stp - disable ptrace(2) from hierarchies of processes
+keywords: process security
+
+  noptrace.stp blocks ptrace(2) attempts from processes identified by
+  stap -c/-x, as also specifiable from /proc/systemtap/stap_XXX/
+  control files.  Processes may be added or removed from the blocked
+  list.
+
+
 process/pfiles.stp - print process file descriptors
 keywords: process files
 
@@ -980,6 +989,17 @@ keywords: io profiling scsi
   takes one argument which is the number of seconds between reports.
 
 
+= SECURITY =
+
+process/noptrace.stp - disable ptrace(2) from hierarchies of processes
+keywords: process security
+
+  noptrace.stp blocks ptrace(2) attempts from processes identified by
+  stap -c/-x, as also specifiable from /proc/systemtap/stap_XXX/
+  control files.  Processes may be added or removed from the blocked
+  list.
+
+
 = SIGNALS =
 
 process/sig_by_pid.stp -  Signal Counts by Process ID
diff --git a/testsuite/systemtap.examples/process/cycle_thief.stp b/testsuite/systemtap.examples/process/cycle_thief.stp
old mode 100644
new mode 100755
diff --git a/testsuite/systemtap.examples/process/noptrace.meta b/testsuite/systemtap.examples/process/noptrace.meta
new file mode 100644
index 000000000..238f405bd
--- /dev/null
+++ b/testsuite/systemtap.examples/process/noptrace.meta
@@ -0,0 +1,7 @@
+title: disable ptrace(2) from hierarchies of processes
+name: noptrace.stp
+keywords: process security
+description: noptrace.stp blocks ptrace(2) attempts from processes identified by stap -c/-x, as also specifiable from /proc/systemtap/stap_XXX/ control files.  Processes may be added or removed from the blocked list.
+test_check: stap -gp4 noptrace.stp -x $$
+test_installcheck: stap -g noptrace.stp -c 'strace ls'
+
diff --git a/testsuite/systemtap.examples/process/noptrace.stp b/testsuite/systemtap.examples/process/noptrace.stp
new file mode 100755
index 000000000..9b0fa5426
--- /dev/null
+++ b/testsuite/systemtap.examples/process/noptrace.stp
@@ -0,0 +1,64 @@
+#! /bin/sh
+
+# note use of guru mode, to enable changing of syscall arguments
+//bin/true && exec stap -g $0 ${1+"$@"}
+
+global noptrace # map pid->name: list of pids forbidden from ptrace(2)
+
+
+probe begin { # init. noptrace process list with stap -x PID/-c CMD, if given
+      if (target())
+         noptrace[target()]="?"
+}
+
+probe scheduler.process_fork { # propagate flag to child processes
+      if (parent_pid in noptrace)
+         noptrace[child_pid] = noptrace[parent_pid]
+}
+
+probe syscall.*execve {  # update stored pid->name mapping
+      if (pid() in noptrace)
+         noptrace[pid()] = filename
+}
+
+probe syscall.exit {  # optional; clean up pid->name mapping table
+      delete noptrace[pid()]
+}
+
+# procfs control files under /proc/systemtap/stap_XXXXX/
+
+probe procfs("blocked").read {   # report currently blocked processes
+      foreach (pid in noptrace) 
+              $value .= sprintf("%d %s\n",pid,noptrace[pid])      
+}
+
+probe procfs("block").write {  # block given pid
+      pid = strtol($value,10)
+      noptrace[pid]="?"
+}
+
+probe procfs("unblock").write {  # unblock given pid
+      pid = strtol($value,10)
+      delete noptrace[pid]
+}
+
+# payload
+
+probe syscall.ptrace {
+      if (pid() in noptrace) {
+         # disable the ptrace call in progress
+         # if it weren't for PTRACE_TRACEME, we could set $pid=1 => -EPERM
+         # changing it to an invalid request number works too
+         $request=0xbeef # anything invalid should do
+
+         # report
+         printf ("%s[%d] ptrace(%d) blocked: ", execname(), tid(), $request)
+         # (or if desired, accumulate counts and report at probe end {})
+      }
+}
+
+probe syscall.ptrace.return { # should occur instantly
+      if (pid() in noptrace) {
+         printf ("rc=%d\n", $return)
+      }
+}