Messages in this thread | | | From | Dmitry Vyukov <> | Date | Mon, 19 Oct 2015 19:53:15 +0200 | Subject | Unkillable processes due to PTRACE_TRACEME |
| |
Hello,
The following program hangs in some interesting state and is not killable (started by a normal user, not root):
// autogenerated by syzkaller (http://github.com/google/syzkaller) #include <pthread.h> #include <unistd.h> #include <sys/ptrace.h> #include <stdio.h> #include <signal.h>
void *thr(void *arg) { ptrace(PTRACE_TRACEME, 0, 0, 0); sleep(3); kill(getpid(), SIGCHLD); return 0; }
int main() { if (fork() == 0) { sleep(1); pthread_t th; pthread_create(&th, 0, thr, 0); sleep(1); } return 0; }
The child process attaches as tracee to init process and then hangs in a state that I don't understand. When I did a similar thing but attached it to a normal parent process (shell), I still was able to get rid of it by killing parent (shell). But definitely you don't want to kill init.
I am not sure who is guilty here, but an unkillable process started by a normal user looks like an issue in itself. I am not sure whether it makes sense to allow to attach as tracee to init. But I've been told that it can make sense in some security setups where init traces everything. Also, what is that state that the process hangs in? It looks like a usual un-waited process, but when I just do ptrace(PTRACE_TRACEME) in main, the process does not hang. The additional thread somehow makes a difference.
I am on commit f9fbf6b72ffaaca8612979116c872c9d5d9cc1f5 (Sep 24).
Found with syzkaller system call fuzzer.
Thank you
| |