Yama: add PTRACE exception tracking

The primary exception to Yama's descendant-based PTRACE restrictions is when an application has a predefined crash handler that is spawned in parallel with the crashed application (e.g. KDE, Chromium). These applications want to bypass the common RLIMIT_CORE=0, and gather state information from the process for upstream problem reporting. When the main application crashes, it generally has access to the PID of what will debug it (e.g. when a KDE app crashes, it knows the parent PID of the debugger that will be spawned).

So, since this programmatic method of PTRACEing is useful, there should be a way for processes to actively declare who can PTRACE them. This patch adds a prctl hook for Yama so that processes can exempt themselves from the PTRACE restrictions in the case of a crash when they know their debugger's PID.

As a matter of demonstration, here is what the patch to KDE4 would look like to support Yama, or other PTRACE-restricting LSMs that wanted to grant a similar exception:

@@ -41,6 +41,7 @@
 #include <sys/wait.h>
 #include <sys/un.h>
 #include <sys/socket.h>
+#include <sys/prctl.h>
 #include <errno.h>
 
 #include <qwindowdefs.h>

@@ -437,6 +438,7 @@
             //if the process was started directly, use waitpid(), as it's a child...
             while(waitpid(-1, NULL, 0) != pid) {}
         } else {
+            prctl(PR_SET_PTRACER, pid, 0, 0, 0);
             //...else poll its status using kill()
             while(kill(pid, 0) >= 0) {
                 sleep(1);

Kees Cook
Ubuntu Security Team