Messages in this thread | | | Date | Sat, 28 May 2022 00:03:39 -0600 (MDT) | From | Nate Eldredge <> | Subject | PTRACE_GET_SYSCALL_INFO requires PTRACE_O_TRACESYSGOOD but not documented |
| |
It seems that the PTRACE_GET_SYSCALL_INFO function of ptrace(2) only works properly if the tracer has set the PTRACE_O_TRACESYSGOOD option. The man page doesn't mention this requirement. Is it intentional?
The issue is that ptrace_get_syscall_info() in kernel/ptrace.c only calls the ptrace_get_syscall_info_{entry,exit} functions to fully populate the ptrace_syscall_info struct if child->last_siginfo->si_code == SIGTRAP | 0x80. And the 0x80 bit is only set when PTRACE_O_TRACESYSGOOD is in effect. Otherwise, the struct always comes back to userspace with op == PTRACE_SYSCALL_INFO_NONE and the entry (or exit) member is not filled in with the system call arguments (or return value).
-- Nate Eldredge nate@thatsmathematics.com
| |