[Author Prev][Author Next][Thread Prev][Thread Next][Author Index][Thread Index]
[tor-commits] [tor/master] New configuration option: DisableDebuggerAttachment
commit f79a75f59731eab85c019c41827c0c0e89d90498
Author: Jacob Appelbaum <jacob@xxxxxxxxxxxxx>
Date: Mon May 30 17:06:51 2011 +0200
New configuration option: DisableDebuggerAttachment
If set to 1, Tor will attempt to prevent basic debugging
attachment attempts by other processes. (Default: 1)
Supports Mac OS X and Gnu/Linux.
Sebastian provided useful feedback and refactoring suggestions.
Signed-off-by: Jacob Appelbaum <jacob@xxxxxxxxxxxxx>
---
changes/disable_debugger_attachment | 14 ++++++++
doc/tor.1.txt | 14 ++++++++
src/or/config.c | 57 +++++++++++++++++++++++++++++++++++
src/or/or.h | 2 +
4 files changed, 87 insertions(+), 0 deletions(-)
diff --git a/changes/disable_debugger_attachment b/changes/disable_debugger_attachment
new file mode 100644
index 0000000..366f972
--- /dev/null
+++ b/changes/disable_debugger_attachment
@@ -0,0 +1,14 @@
+ o Minor features:
+ - If set to 1, Tor will attempt to prevent basic debugging attachment
+ attempts by other processes. It has no impact for users who wish to
+ attach if they have CAP_SYS_PTRACE or if they are root. We believe that
+ this feature works on modern Gnu/Linux distributions, and that it may
+ also work on *BSD systems (untested). Some modern Gnu/Linux systems such
+ as Ubuntu have the kernel.yama.ptrace_scope sysctl and by default enable
+ it as an attempt to limit the PTRACE scope for all user processes by
+ default. This feature will attempt to limit the PTRACE scope for Tor
+ specifically - it will not attempt to alter the system wide ptrace scope
+ as it may not even exist. If you wish to attach to Tor with a debugger
+ such as gdb or strace you will want to set this to 0 for the duration of
+ your debugging. Normal users should leave it on. (Default: 1)
+
diff --git a/doc/tor.1.txt b/doc/tor.1.txt
index 7d72350..c37c44c 100644
--- a/doc/tor.1.txt
+++ b/doc/tor.1.txt
@@ -251,6 +251,20 @@ Other options can be specified either on the command-line (--option
option requires that you start your Tor as root, and you should use the
**User** option to properly reduce Tor's privileges. (Default: 0)
+**DisableDebuggerAttachment** **0**|**1**::
+ If set to 1, Tor will attempt to prevent basic debugging attachment attempts
+ by other processes. It has no impact for users who wish to attach if they
+ have CAP_SYS_PTRACE or if they are root. We believe that this feature
+ works on modern Gnu/Linux distributions, and that it may also work on *BSD
+ systems (untested). Some modern Gnu/Linux systems such as Ubuntu have the
+ kernel.yama.ptrace_scope sysctl and by default enable it as an attempt to
+ limit the PTRACE scope for all user processes by default. This feature will
+ attempt to limit the PTRACE scope for Tor specifically - it will not attempt
+ to alter the system wide ptrace scope as it may not even exist. If you wish
+ to attach to Tor with a debugger such as gdb or strace you will want to set
+ this to 0 for the duration of your debugging. Normal users should leave it
+ on. (Default: 1)
+
**FetchDirInfoEarly** **0**|**1**::
If set to 1, Tor will always fetch directory information like other
directory caches, even if you don't meet the normal criteria for fetching
diff --git a/src/or/config.c b/src/or/config.c
index f3c6345..5a153b0 100644
--- a/src/or/config.c
+++ b/src/or/config.c
@@ -40,6 +40,14 @@
#include "procmon.h"
+/* Includes for the process attaching prevention */
+#if defined(HAVE_SYS_PRCTL_H) && defined(__linux__)
+#include <sys/prctl.h>
+#elif defined(__APPLE__)
+#include <sys/types.h>
+#include <sys/ptrace.h>
+#endif
+
/** Enumeration of types which option values can take */
typedef enum config_type_t {
CONFIG_TYPE_STRING = 0, /**< An arbitrary string. */
@@ -238,6 +246,7 @@ static config_var_t _option_vars[] = {
V(DirReqStatistics, BOOL, "1"),
VAR("DirServer", LINELIST, DirServers, NULL),
V(DisableAllSwap, BOOL, "0"),
+ V(DisableDebuggerAttachment, BOOL, "1"),
V(DisableIOCP, BOOL, "1"),
V(DNSPort, PORT, "0"),
V(DNSListenAddress, LINELIST, NULL),
@@ -649,6 +658,47 @@ get_dirportfrontpage(void)
return global_dirfrontpagecontents;
}
+/* We only use the linux prctl for now. There is no Win32 support; this may
+ * also work on various BSD systems and Mac OS X - send testing feedback!
+ *
+ * On recent Gnu/Linux kernels it is possible to create a system-wide policy
+ * that will prevent non-root processes from attaching to other processes
+ * unless they are the parent process; thus gdb can attach to programs that
+ * they execute but they cannot attach to other processes running as the same
+ * user. The system wide policy may be set with the sysctl
+ * kernel.yama.ptrace_scope or by inspecting /proc/sys/kernel/yama/ptrace_scope
+ * and it is 1 by default on Ubuntu 11.04.
+ *
+ * This ptrace scope will be ignored on Gnu/Linux for users with
+ * CAP_SYS_PTRACE and so it is very likely that root will still be able to
+ * attach to the Tor process.
+*/
+/** Attempt to disable debugger attachment. */
+static int tor_disable_debugger_attach(void) {
+ int r;
+ r = -1;
+ log_debug(LD_CONFIG,
+ "Attemping to disable debugger attachment to Tor for unprivileged users.");
+#if defined(__linux__) && defined(HAVE_SYS_PRCTL_H) && defined(HAVE_PRCTL)
+#ifdef PR_SET_DUMPABLE
+ r = prctl(PR_SET_DUMPABLE, 0);
+#endif
+#endif
+#if defined(__APPLE__) && defined(PT_DENY_ATTACH)
+ r = ptrace(PT_DENY_ATTACH, 0, 0, 0);
+#endif
+
+// XXX: TODO - Mac OS X has dtrace and this may be disabled - implement it here
+// XXX: TODO - Windows probably has something similar - implement it here
+ if (r == 0) {
+ log_debug(LD_CONFIG,"Debugger attachment disabled for unprivileged users.");
+ } else {
+ log_warn(LD_CONFIG, "Unable to disable ptrace attach: %s",
+ strerror(errno));
+ }
+ return r;
+}
+
/** Allocate an empty configuration object of a given format type. */
static void *
config_alloc(config_format_t *fmt)
@@ -1195,6 +1245,13 @@ options_act(or_options_t *old_options)
int running_tor = options->command == CMD_RUN_TOR;
char *msg;
+ /* disable ptrace and later, other basic debugging techniques */
+ if (options->DisableDebuggerAttachment) {
+ tor_disable_debugger_attach();
+ } else {
+ log_notice(LD_CONFIG,"Debugger attachment enabled for unprivileged users.");
+ }
+
if (running_tor && !have_lockfile()) {
if (try_locking(options, 1) < 0)
return -1;
diff --git a/src/or/or.h b/src/or/or.h
index 4b20b57..db3b171 100644
--- a/src/or/or.h
+++ b/src/or/or.h
@@ -2900,6 +2900,8 @@ typedef struct {
disclaimer. This allows a server administrator to show
that they're running Tor and anyone visiting their server
will know this without any specialized knowledge. */
+ int DisableDebuggerAttachment; /**< Currently Linux only specific attempt to
+ disable ptrace; needs BSD testing. */
/** Boolean: if set, we start even if our resolv.conf file is missing
* or broken. */
int ServerDNSAllowBrokenConfig;
_______________________________________________
tor-commits mailing list
tor-commits@xxxxxxxxxxxxxxxxxxxx
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-commits