[Bug shlibs/16344] New: Linux /proc/PID/map_files/ for deleted files

[Bug shlibs/16344] New: Linux /proc/PID/map_files/ for deleted files

[jan.kratochvil at redhat dot com]

https://sourceware.org/bugzilla/show_bug.cgi?id=16344

            Bug ID: 16344
           Summary: Linux /proc/PID/map_files/ for deleted files
           Product: gdb
           Version: HEAD
            Status: NEW
          Severity: normal
          Priority: P2
         Component: shlibs
          Assignee: unassigned at sourceware dot org
          Reporter: jan.kratochvil at redhat dot com

Backtracing already deleted files does not work:

$ gdb -q -p $p
Attaching to process 12280
.../elfutils/tests/deleted (deleted): No such file or directory.
(gdb) bt
#0  0x472bd360 in ?? ()
Cannot access memory at address 0x2cc946e8

This commonly happens for long-term running processes/daemons which have been
nightly automatically upgraded or which have been nightly prelinked by prelink.

But it could work, recent Linux kernels support /proc/PID/map_files/
demonstrated by elfutils use:
 
https://lists.fedorahosted.org/pipermail/elfutils-devel/2013-December/003638.html

Current Linux kernels (3.11.10) permit only root user as the tracer but (1)
hopefully it gets fixed in the future and (2) at least for the use in ABRT it
is OK as backtracer is run from core dumping hook.

Linux kernels have always supported also /proc/PID/exe which works for deleted
main executable.  It even works for non-root users.  But it works only for the
executable, not for shared libraries.  I find more useful to push for Linux
kernel /proc/PID/map_files/ permissions fix than to implement /proc/PID/exe.

-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug shlibs/16344] Linux /proc/PID/map_files/ for deleted files

[jan.kratochvil at redhat dot com]

https://sourceware.org/bugzilla/show_bug.cgi?id=16344

Jan Kratochvil <jan.kratochvil at redhat dot com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Blocks|                            |11579

-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug shlibs/16344] Linux /proc/PID/map_files/ for deleted files

[jan.kratochvil at redhat dot com]

https://sourceware.org/bugzilla/show_bug.cgi?id=16344

Jan Kratochvil <jan.kratochvil at redhat dot com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |jan.kratochvil at redhat dot com

--- Comment #1 from Jan Kratochvil <jan.kratochvil at redhat dot com> ---
Security discussion of relaxing root-only access to /proc/PID/map_files/:
 
https://lists.fedorahosted.org/pipermail/elfutils-devel/2014-February/003824.html

So far I think /proc/PID/map_files/ will remain root-only accessible.
But one still can access /proc/PID/mem and all the info required for unwinding
is present there, future elfutils-0.159 can do it.

-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug shlibs/16344] Linux /proc/PID/map_files/ for deleted files

[sam at gentoo dot org]

https://sourceware.org/bugzilla/show_bug.cgi?id=16344

Sam James <sam at gentoo dot org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |sam at gentoo dot org

--- Comment #2 from Sam James <sam at gentoo dot org> ---
(In reply to Jan Kratochvil from comment #1)
> Security discussion of relaxing root-only access to /proc/PID/map_files/:
>  
> https://lists.fedorahosted.org/pipermail/elfutils-devel/2014-February/003824.
> html
> 

New link:
https://lists.stg.fedoraproject.org/archives/list/elfutils-devel@lists.stg.fedorahosted.org/thread/4FJ7VJ3C65TFJAYKYXXVVC7YHV5ZDCCK/

> So far I think /proc/PID/map_files/ will remain root-only accessible.
> But one still can access /proc/PID/mem and all the info required for
> unwinding is present there, future elfutils-0.159 can do it.

Not sure that ever got merged, or did it?

-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug shlibs/16344] Linux /proc/PID/map_files/ for deleted files

[sam at gentoo dot org]

https://sourceware.org/bugzilla/show_bug.cgi?id=16344

Sam James <sam at gentoo dot org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |mark at klomp dot org

-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug shlibs/16344] Linux /proc/PID/map_files/ for deleted files

[hmeyer.eu at gmail dot com]

https://sourceware.org/bugzilla/show_bug.cgi?id=16344

Henning Meyer <hmeyer.eu at gmail dot com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |hmeyer.eu at gmail dot com

--- Comment #3 from Henning Meyer <hmeyer.eu at gmail dot com> ---
(In reply to Sam James from comment #2)
> (In reply to Jan Kratochvil from comment #1)
> > Security discussion of relaxing root-only access to /proc/PID/map_files/:
> >  
> > https://lists.fedorahosted.org/pipermail/elfutils-devel/2014-February/003824.
> > html
> > 
> 
> New link:
> https://lists.stg.fedoraproject.org/archives/list/elfutils-devel@lists.stg.
> fedorahosted.org/thread/4FJ7VJ3C65TFJAYKYXXVVC7YHV5ZDCCK/
> 
> > So far I think /proc/PID/map_files/ will remain root-only accessible.
> > But one still can access /proc/PID/mem and all the info required for
> > unwinding is present there, future elfutils-0.159 can do it.
> 
> Not sure that ever got merged, or did it?

I get exactly only one hit when searching for map_files in the code base, and
that is a comment in linux-tdep.c

This was never implemented, but is feasible without root permissions since
kernel version 4.4.

Here is corresponding commit in Linux:

https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=bdb4d100afe9818aebd1d98ced575c5ef143456c

Date:   Wed Sep 9 15:35:54 2015 -0700

    procfs: always expose /proc/<pid>/map_files/ and make it readable

    [...]

    This patch moves map_files/ out from behind CONFIG_CHECKPOINT_RESTORE, and
    adjusts the permissions enforced on it as follows:

    * proc_map_files_lookup()
    * proc_map_files_readdir()
    * map_files_d_revalidate()

            Remove the CAP_SYS_ADMIN restriction, leaving only the current
            restriction requiring PTRACE_MODE_READ. The information made
            available to userspace by these three functions is already
            available in /proc/PID/maps with MODE_READ, so I don't see any
            reason to limit them any further (see below for more detail).

-- 
You are receiving this mail because:
You are on the CC list for the bug.