ptrace(2) System Calls Manual ptrace(2) ptrace - (libc -lc) #include long ptrace(enum __ptrace_request op, pid_t pid, void *addr, void *data); ptrace() ( "tracer") ( "tracee") . . . : ( ) . "" " ()" " ( )". Ptrace ptrace(PTRACE_foo, pid, ...) pid . ( " " CLONE_THREAD clone(2).) fork(2) PTRACE_TRACEME () execve(2). PTRACE_ATTACH PTRACE_SEIZE. . ( SIGKILL ). waitpid(2) ( "" ) status . ptrace . ( ). PTRACE_O_TRACEEXEC execve(2) SIGTRAP . PTRACE_DETACH. op : PTRACE_TRACEME . . ( pid addr data.) PTRACE_TRACEME . pid . PTRACE_ATTACH PTRACE_SEIZE PTRACE_INTERRUPT PTRACE_KILL . PTRACE_PEEKTEXT PTRACE_PEEKDATA addr ptrace(). . ( data NOTES.) PTRACE_PEEKUSER addr USER ( ). ptrace(). (word-aligned) . NOTES. ( data NOTES.) PTRACE_POKETEXT PTRACE_POKEDATA data addr . PTRACE_PEEKTEXT PTRACE_PEEKDATA . PTRACE_POKEUSER data addr USER . PTRACE_PEEKUSER . USER . PTRACE_GETREGS PTRACE_GETFPREGS data . . ( addr). SPARC data addr data addr. PTRACE_GETREGS PTRACE_GETFPREGS . PTRACE_GETREGSET ( 2.6.34) . addr . NT_PRSTATUS ( 1) . addr NT_foo . data struct iovec . iov.len . PTRACE_SETREGS PTRACE_SETFPREGS data . PTRACE_POKEUSER . ( addr). SPARC data addr data addr. PTRACE_SETREGS PTRACE_SETFPREGS . PTRACE_SETREGSET ( 2.6.34) . addr data PTRACE_GETREGSET. PTRACE_GETSIGINFO ( 2.3.99-pre6) . siginfo_t ( sigaction(2)) data . ( addr). PTRACE_SETSIGINFO ( 2.3.99-pre6) : siginfo_t data . . ptrace() . ( addr). PTRACE_PEEKSIGINFO ( 3.10) siginfo_t . addr ptrace_peeksiginfo_args . siginfo_t data. ( ). siginfo si_code (__SI_CHLD __SI_FAULT ) . struct ptrace_peeksiginfo_args { u64 off; /* */ u32 flags; /* PTRACE_PEEKSIGINFO_SHARED 0 */ s32 nr; /* */ }; PTRACE_PEEKSIGINFO_SHARED . . PTRACE_GETSIGMASK ( 3.11) ( sigprocmask(2)) data sigset_t. addr data ( sizeof(sigset_t)). PTRACE_SETSIGMASK ( 3.11) ( sigprocmask(2)) data sigset_t. addr data ( sizeof(sigset_t)). PTRACE_SETOPTIONS ( 2.4.6 BUGS ) ptrace data. ( addr). data : PTRACE_O_EXITKILL ( 3.8) SIGKILL . ptrace (jailers) . PTRACE_O_TRACECLONE ( 2.5.46) clone(2) SIGSTOP PTRACE_EVENT_STOP PTRACE_SEIZE. waitpid(2) status status>>8 == (SIGTRAP | (PTRACE_EVENT_CLONE<<8)) (PID) PTRACE_GETEVENTMSG. clone(2) . clone(2) CLONE_VFORK PTRACE_EVENT_VFORK PTRACE_O_TRACEVFORK clone(2) SIGCHLD PTRACE_EVENT_FORK PTRACE_O_TRACEFORK . PTRACE_O_TRACEEXEC ( 2.5.46) execve(2) . waitpid(2) status status>>8 == (SIGTRAP | (PTRACE_EVENT_EXEC<<8)) . 3.0 PTRACE_GETEVENTMSG. PTRACE_O_TRACEEXIT ( 2.5.60) . waitpid(2) status status>>8 == (SIGTRAP | (PTRACE_EVENT_EXIT<<8)) PTRACE_GETEVENTMSG. . . PTRACE_O_TRACEFORK ( 2.5.46) fork(2) SIGSTOP PTRACE_EVENT_STOP PTRACE_SEIZE. waitpid(2) status status>>8 == (SIGTRAP | (PTRACE_EVENT_FORK<<8)) (PID) PTRACE_GETEVENTMSG. PTRACE_O_TRACESYSGOOD ( 2.4.6) 7 ( SIGTRAP|0x80). . PTRACE_O_TRACEVFORK ( 2.5.46) vfork(2) (vforked) SIGSTOP PTRACE_EVENT_STOP PTRACE_SEIZE. waitpid(2) status status>>8 == (SIGTRAP | (PTRACE_EVENT_VFORK<<8)) (PID) PTRACE_GETEVENTMSG. PTRACE_O_TRACEVFORKDONE ( 2.5.60) vfork(2) . waitpid(2) status status>>8 == (SIGTRAP | (PTRACE_EVENT_VFORK_DONE<<8)) ( 2.6.18) (PID) PTRACE_GETEVENTMSG. PTRACE_O_TRACESECCOMP ( 3.5) SECCOMP_RET_TRACE seccomp(2). waitpid(2) status status>>8 == (SIGTRAP | (PTRACE_EVENT_SECCOMP<<8)) PTRACE_EVENT syscall-enter-stop. PTRACE_EVENT_SECCOMP . seccomp ( SECCOMP_RET_DATA seccomp) PTRACE_GETEVENTMSG. PTRACE_O_SUSPEND_SECCOMP ( 4.3) seccomp . seccomp . seccomp . CAP_SYS_ADMIN seccomp PTRACE_O_SUSPEND_SECCOMP . PTRACE_GETEVENTMSG ( 2.5.46) ( unsigned long) ptrace data . PTRACE_EVENT_EXIT . PTRACE_EVENT_FORK PTRACE_EVENT_VFORK PTRACE_EVENT_VFORK_DONE PTRACE_EVENT_CLONE (PID) . PTRACE_EVENT_SECCOMP SECCOMP_RET_DATA seccomp(2) . ( addr). PTRACE_CONT . data . . ( addr). PTRACE_SYSCALL PTRACE_SINGLESTEP PTRACE_CONT . ( ). SIGTRAP. PTRACE_SYSCALL PTRACE_SYSCALL . data PTRACE_CONT. ( addr). PTRACE_SET_SYSCALL ( 2.6.16) syscall-enter-stop data. addr. arm ( arm64 ) ( ). PTRACE_SYSEMU PTRACE_SYSEMU_SINGLESTEP ( 2.6.14) PTRACE_SYSEMU . syscall-stops . PTRACE_SYSEMU_SINGLESTEP . User Mode Linux . data PTRACE_CONT. addr. x86. PTRACE_LISTEN ( 3.4) . SIGSTOP ( ). "group-stop" . PTRACE_LISTEN PTRACE_SEIZE. PTRACE_KILL SIGKILL . ( addr data.) ! SIGKILL kill(2) tgkill(2). PTRACE_KILL signal-delivery-stop ( ). SIGKILL . PTRACE_INTERRUPT ( 3.4) . PTRACE_SYSCALL syscall-exit-stop. ( ). PTRACE_LISTEN PTRACE_EVENT_STOP WSTOPSIG(status) . ptrace-stop ( ) ptrace-stop . ( ) PTRACE_EVENT_STOP WSTOPSIG(status) SIGTRAP. PTRACE_INTERRUPT PTRACE_SEIZE. PTRACE_ATTACH pid . SIGSTOP waitpid(2) . "Attaching and detaching" . ( addr data.) PTRACE_ATTACH ptrace PTRACE_MODE_ATTACH_REALCREDS . PTRACE_SEIZE ( 3.4) pid . PTRACE_ATTACH PTRACE_SEIZE . (Group-stops) PTRACE_EVENT_STOP WSTOPSIG(status) . PTRACE_EVENT_STOP WSTOPSIG(status) SIGTRAP SIGSTOP . execve(2) SIGTRAP . PTRACE_SEIZE PTRACE_INTERRUPT PTRACE_LISTEN. " " PTRACE_O_TRACEFORK PTRACE_O_TRACEVFORK PTRACE_O_TRACECLONE. addr . data ptrace . PTRACE_SEIZE ptrace PTRACE_MODE_ATTACH_REALCREDS . PTRACE_SECCOMP_GET_FILTER ( 4.4) BPF . addr . 0. addr ENOENT. data struct sock_filter BPF NULL . BPF. data NULL struct sock_filter . EACCES CAP_SYS_ADMIN seccomp . addr BPF EMEDIUMTYPE. CONFIG_SECCOMP_FILTER CONFIG_CHECKPOINT_RESTORE. PTRACE_DETACH PTRACE_CONT . . ( addr.) PTRACE_GET_THREAD_AREA ( 2.6.0) get_thread_area(2). TLS GDT addr struct user_desc data. ( get_thread_area(2) entry_number struct user_desc.) PTRACE_SET_THREAD_AREA ( 2.6.0) set_thread_area(2). TLS GDT addr struct user_desc data. ( set_thread_area(2) entry_number struct user_desc ptrace TLS .) PTRACE_GET_SYSCALL_INFO ( 5.3) . data struct ptrace_syscall_info. addr data ( sizeof(struct ptrace_syscall_info)). . addr . ptrace_syscall_info : struct ptrace_syscall_info { __u8 op; /* */ __u8 reserved; /* */ __u16 flags; /* */ __u32 arch; /* AUDIT_ARCH_* seccomp(2) */ __u64 instruction_pointer; /* */ __u64 stack_pointer; /* */ union { struct { /* op == PTRACE_SYSCALL_INFO_ENTRY */ __u64 nr; /* */ __u64 args[6]; /* */ } entry; struct { /* op == PTRACE_SYSCALL_INFO_EXIT */ __s64 rval; /* */ __u8 is_error; /* : rval (-ERRCODE) */ } exit; struct { /* op == PTRACE_SYSCALL_INFO_SECCOMP */ __u64 nr; /* */ __u64 args[6]; /* */ __u32 ret_data; /* SECCOMP_RET_DATA SECCOMP_RET_TRACE */ } seccomp; }; }; op arch instruction_pointer stack_pointer ptrace. (union) op. op ( ) (union) : PTRACE_SYSCALL_INFO_ENTRY entry . PTRACE_SYSCALL_INFO_EXIT exit . PTRACE_SYSCALL_INFO_SECCOMP seccomp PTRACE_EVENT_SECCOMP. PTRACE_SYSCALL_INFO_NONE . PTRACE_GET_SYSCALL_INFO PTRACE_SYSCALL_INFO_NONE PTRACE_O_TRACESYSGOOD . PTRACE_SET_SYSCALL_INFO ( 6.16) . data struct ptrace_syscall_info . addr sizeof(struct ptrace_syscall_info). nr args rval . ptrace ( ) ( SIG_DFL ) . . waitpid(2). signal-delivery-stop ( ) ( ) . ( "signal-delivery-stop" ). SIGKILL signal-delivery-stop . SIGKILL ( syscall-exit-stop SIGKILL). SIGKILL ( ) ptrace. _exit(2) . . exit_group(2) . PTRACE_O_TRACEEXIT PTRACE_EVENT_EXIT . exit(2) exit_group(2) ( SIGKILL BUGS ) execve(2) . ptrace. ( SIGKILL). ESRCH ptrace. ptrace ( ) ptrace. / ESRCH " " ptrace-stop. waitpid(WNOHANG) ptrace ESRCH. waitpid(WNOHANG) 0 . " " ptrace. WIFEXITED(status) WIFSIGNALED(status) . execve(2) (PID) ptrace . : . ptrace ( read(2) pause(2) ) . PTRACE_LISTEN : ptrace-stop ( ptrace waitpid(2)) "" ( ) group-stop PTRACE_LISTEN SIGCONT. ptrace. . ptrace ptrace-stop. ptrace signal-delivery-stop group-stop syscall-stop PTRACE_EVENT stops . . ptrace-stop waitpid(2) ( "" ). : pid = waitpid(pid_or_minus_1, &status, __WALL); ptrace pid 0 WIFSTOPPED(status) . __WALL WSTOPPED WEXITED . WCONTINUED waitpid(2): "" . WNOHANG waitpid(2) 0 (" ") . : errno = 0; ptrace(PTRACE_CONT, pid, 0L, 0L); if (errno == ESRCH) { /* */ r = waitpid(tracee, &status, __WALL | WNOHANG); /* r ! */ } ptrace-stops: signal-delivery-stops group-stops PTRACE_EVENT stops syscall-stops. waitpid(2) WIFSTOPPED(status) . status>>8 PTRACE_GETSIGINFO. (: WSTOPSIG(status) (status>>8) & 0xff.) (Signal-delivery-stop) ( ) SIGKILL . ( tgkill(2) ). signal-delivery-stop. . ptrace . (signal injection) . signal-delivery-stop SIGSTOP . Signal-delivery-stop waitpid(2) WIFSTOPPED(status) WSTOPSIG(status). SIGTRAP ptrace-stop "Syscall-stops" "execve" . WSTOPSIG(status) group-stop . signal-delivery-stop ptrace(PTRACE_restart, pid, 0, sig) PTRACE_restart ptrace. sig 0 . sig. (signal injection) signal-delivery-stop. sig WSTOPSIG(status): . . : ( restart_syscall(2) ) PTRACE_SYSCALL. ( poll(2)) EINTR . ptrace ptrace-stops signal-delivery-stop sig . sig . Ptrace " " : tgkill(2) . ptrace signal-delivery-stops ptrace. group-stop signal-delivery-stop ptrace(PTRACE_restart, pid, 0, stopsig) stopsig stopsig . SIGCONT ( ) (group-stopped). signal-delivery-stop. ( SIGCONT ). group-stop signal-delivery-stop ( ) SIGCONT SIGCONT. SIGCONT . ( ) group-stop. . 2.4 SIGSTOP. PTRACE_GETSIGINFO siginfo_t . PTRACE_SETSIGINFO . PTRACE_SETSIGINFO siginfo_t si_signo sig . (Group-stop) ( ) . " " (group-stop). " " (signal-delivery-stop) ( ) ( ) " " . " " . Group-stop waitpid(2) WIFSTOPPED(status) WSTOPSIG(status). ptrace-stops ptrace(PTRACE_GETSIGINFO, pid, 0, &siginfo) SIGSTOP SIGTSTP SIGTTIN SIGTTOU . group-stop. PTRACE_GETSIGINFO. PTRACE_GETSIGINFO EINVAL group-stop. ( ESRCH (" ") SIGKILL ). PTRACE_SEIZE group-stop PTRACE_EVENT_STOP: status>>16 == PTRACE_EVENT_STOP. group-stops PTRACE_GETSIGINFO . 2.6.38 ptrace-stop ( SIGKILL) waitpid(2) . . group-stop -- . waitpid(2) SIGCONT SIGCONT . 3.4 : PTRACE_CONT PTRACE_LISTEN waitpid(2) ( SIGCONT). PTRACE_EVENT PTRACE_O_TRACE_* ptrace-stops PTRACE_EVENT. PTRACE_EVENT waitpid(2) WIFSTOPPED(status) WSTOPSIG(status) SIGTRAP ( PTRACE_EVENT_STOP group-stop). : status>>8 ((PTRACE_EVENT_foo<<8) | SIGTRAP). : PTRACE_EVENT_VFORK vfork(2) clone(2) CLONE_VFORK. exec ( vfork(2)). PTRACE_EVENT_FORK fork(2) clone(2) SIGCHLD. PTRACE_EVENT_CLONE clone(2). PTRACE_EVENT_VFORK_DONE vfork(2) clone(2) CLONE_VFORK exec. ( ) . PTRACE_GETEVENTMSG . PTRACE_EVENT_EXEC execve(2). 3.0 PTRACE_GETEVENTMSG . PTRACE_EVENT_EXIT ( exit_group(2)) execve(2) . PTRACE_GETEVENTMSG . ( ""). PTRACE_CONT PTRACE_DETACH . PTRACE_EVENT_STOP PTRACE_INTERRUPT ptrace ( PTRACE_SEIZE). PTRACE_EVENT_SECCOMP seccomp(2) PTRACE_O_TRACESECCOMP. seccomp ( SECCOMP_RET_DATA seccomp) PTRACE_GETEVENTMSG. . PTRACE_GETSIGINFO PTRACE_EVENT SIGTRAP si_signo si_code (event<<8) | SIGTRAP. PTRACE_SYSCALL PTRACE_SYSEMU "---" ( PTRACE_SYSEMU ). --- PTRACE_SYSCALL "---" . ( -- --- --- ---). ( PTRACE_SYSEMU) ---. PTRACE_SYSEMU PTRACE_SYSEMU_SINGLESTEP. PTRACE_SYSCALL ---. PTRACE_EVENT ( seccomp) ( _exit(2) exit_group(2)) SIGKILL ( execve(2) ). --- --- waitpid(2) WIFSTOPPED(status) WSTOPSIG(status) SIGTRAP. PTRACE_O_TRACESYSGOOD WSTOPSIG(status) (SIGTRAP | 0x80). -- SIGTRAP PTRACE_GETSIGINFO : si_code <= 0 SIGTRAP (tgkill(2) kill(2) sigqueue(3) ) POSIX POSIX / . si_code == SI_KERNEL (0x80) SIGTRAP . si_code == SIGTRAP si_code == (SIGTRAP|0x80) . ( ) PTRACE_GETSIGINFO . . x86 rax == -ENOSYS ---. SIGTRAP ( ) --- rax -ENOSYS SIGTRAP " ---" "--- " . . PTRACE_O_TRACESYSGOOD ptrace . --- ---. ptrace . --- --- PTRACE_EVENT ptrace . seccomp ( ) --- . seccomp ---. --- PTRACE_SYSCALL ---. PTRACE_GETSIGINFO SIGTRAP si_signo si_code SIGTRAP (SIGTRAP|0x80). PTRACE_EVENT_SECCOMP ( 3.5 4.7) PTRACE_EVENT_SECCOMP ptrace . 4.7 (). . PTRACE_EVENT_SECCOMP SECCOMP_RET_TRACE. . seccomp PTRACE_SYSEMU . . PTRACE_SYSCALL PTRACE_SYSEMU --- . PTRACE_EVENT_SECCOMP --- . PTRACE_EVENT_SECCOMP PTRACE_SYSCALL --- --- . PTRACE_EVENT_SECCOMP ( 4.8) 4.8 PTRACE_EVENT_SECCOMP --- ---. seccomp ( PTRACE_EVENT_SECCOMP) PTRACE_SYSEMU. PTRACE_EVENT_SECCOMP --- ( PTRACE_SYSCALL --- ). --- . PTRACE_EVENT_SECCOMP seccomp SECCOMP_RET_TRACE SECCOMP_RET_ALLOW. PTRACE_EVENT_SECCOMP . PTRACE_SINGLESTEP [ .] ptrace ptrace ( PTRACE_ATTACH PTRACE_SEIZE PTRACE_TRACEME PTRACE_INTERRUPT PTRACE_KILL) -ptrace ESRCH. -ptrace . -ptrace: ptrace(PTRACE_PEEKTEXT/PEEKDATA/PEEKUSER, pid, addr, 0); ptrace(PTRACE_POKETEXT/POKEDATA/POKEUSER, pid, addr, long_val); ptrace(PTRACE_GETREGS/GETFPREGS, pid, 0, &struct); ptrace(PTRACE_SETREGS/SETFPREGS, pid, 0, &struct); ptrace(PTRACE_GETREGSET, pid, NT_foo, &iov); ptrace(PTRACE_SETREGSET, pid, NT_foo, &iov); ptrace(PTRACE_GETSIGINFO, pid, 0, &siginfo); ptrace(PTRACE_SETSIGINFO, pid, 0, &siginfo); ptrace(PTRACE_GETEVENTMSG, pid, 0, &long_var); ptrace(PTRACE_SETOPTIONS, pid, 0, PTRACE_O_flags); . (siginfo) ptrace ( 0 errno) PTRACE_GETEVENTMSG ptrace . ptrace(PTRACE_SETOPTIONS, pid, 0, PTRACE_O_flags); . . PTRACE_O_TRACEFORK PTRACE_O_TRACEVFORK PTRACE_O_TRACECLONE . ptrace . : ptrace(cmd, pid, 0, sig); cmd PTRACE_CONT PTRACE_LISTEN PTRACE_DETACH PTRACE_SYSCALL PTRACE_SINGLESTEP PTRACE_SYSEMU PTRACE_SYSEMU_SINGLESTEP. -- sig ( ). sig. ( ptrace -- 0 sig). ptrace(PTRACE_ATTACH, pid, 0, 0); ptrace(PTRACE_SEIZE, pid, 0, PTRACE_O_flags); PTRACE_ATTACH SIGSTOP . SIGSTOP . -- () ! SIGSTOP SIGSTOP. ptrace SIGSTOP SIGSTOP . SIGSTOP EINTR " ". 3.4 PTRACE_SEIZE PTRACE_ATTACH. PTRACE_SEIZE . ( ) PTRACE_INTERRUPT. ptrace(PTRACE_TRACEME, 0, 0, 0); . ( -ptrace). PTRACE_TRACEME raise(SIGSTOP); ( ) -- . PTRACE_O_TRACEFORK PTRACE_O_TRACEVFORK PTRACE_O_TRACECLONE vfork(2) clone(2) CLONE_VFORK fork(2) clone(2) SIGCHLD clone(2) . SIGSTOP -- . : ptrace(PTRACE_DETACH, pid, 0, sig); PTRACE_DETACH -ptrace. -- . sig . SIGSTOP ( tgkill(2) ) -- SIGSTOP ( SIGSTOP). SIGSTOP . ptrace SIGSTOP. ptrace - SIGSTOP. . " " SIGCONT. -- . execve(2) ptrace execve(2) ( ). ( execve(2) execve(2) execve(2)). : o PTRACE_EVENT_EXIT PTRACE_O_TRACEEXIT . _exit(2) 0. o execve(2). ( ptrace "pid" waitpid(2) ptrace ). . o PTRACE_EVENT_EXEC PTRACE_O_TRACEEXEC . o PTRACE_EVENT_EXIT " ". (: WIFEXITED(status) ). " ". ( ) execve(2) (execing tracee). . PTRACE_O_TRACEEXEC . PTRACE_EVENT_EXEC execve(2). PTRACE_GETEVENTMSG . ( 3.0). PTRACE_O_TRACEEXEC SIGTRAP execve(2). PTRACE_EVENT_EXEC . PTRACE_EVENT_EXEC - == == . : execve(2) : *** --- 1: ** PID1 execve("/bin/foo", "foo" *** PTRACE_SYSCALL 1 ** *** --- 2: ** PID2 execve("/bin/bar", "bar" *** PTRACE_SYSCALL 2 ** *** PTRACE_EVENT_EXEC PID0 PTRACE_SYSCALL ** *** --- PID0: ** PID0 <... execve resumed> ) = 0 PTRACE_O_TRACEEXEC PTRACE_ATTACH PTRACE_SEIZE SIGTRAP execve(2). ( kill -TRAP) ptrace. PTRACE_GETSIGINFO si_code 0 (SI_USER). (). ( strace(1)) SIGTRAP execve ( SIGTRAP SIG_DFL ). SIGTRAP . PTRACE_O_TRACEEXEC PTRACE_SEIZE SIGTRAP . ptrace / waitpid(2). waitpid(2) . 2.6.38 (BUGS) . 2.6.38 : o / waitpid(2) ( ). . PTRACE_PEEK* ( ) PTRACE_SECCOMP_GET_FILTER BPF PTRACE_GET_SYSCALL_INFO . -1 errno . PTRACE_PEEK* -1 errno . EBUSY ( i386 ) . EFAULT . EIO EFAULT . EINVAL . EIO op . EPERM . ( CAP_SYS_PTRACE) set-user-ID/set-group-ID . ( 2.6.26) init(1) (PID 1). ESRCH ( ). . SVr4, 4.3BSD. 2.6.26 init(1) PID 1. ptrace() glibc ptrace() op . / 0L (void *) 0. execve(2). USER . struct user. "" ( 32- 32 ). ptrace() . . ptrace() . Ptrace - ( ptrace()) " ptrace" ( "" ). . "" (LSM) -- SELinux Yama Smack-- commoncap LSM ( ). 2.6.27 . 2.6.27 : PTRACE_MODE_READ "" : get_robust_list(2) kcmp(2) /proc/pid/auxv /proc/pid/environ /proc/pid/stat readlink(2) /proc/pid/ns/*. PTRACE_MODE_ATTACH "" : ptrace (PTRACE_ATTACH) process_vm_writev(2). ( PTRACE_MODE_ATTACH 2.6.27.) 4.5 ( OR) : PTRACE_MODE_FSCREDS UID GID ( credentials(7)) LSM. PTRACE_MODE_REALCREDS UID GID LSM. 4.5. : PTRACE_MODE_READ_FSCREDS PTRACE_MODE_READ | PTRACE_MODE_FSCREDS. PTRACE_MODE_READ_REALCREDS PTRACE_MODE_READ | PTRACE_MODE_REALCREDS. PTRACE_MODE_ATTACH_FSCREDS PTRACE_MODE_ATTACH | PTRACE_MODE_FSCREDS. PTRACE_MODE_ATTACH_REALCREDS PTRACE_MODE_ATTACH | PTRACE_MODE_REALCREDS. ( OR) : PTRACE_MODE_NOAUDIT ( 3.3) . ptrace ( /proc/pid/stat) . . . PTRACE_MODE_* . ptrace ( /proc). . ptrace . ( /proc/pid " " PID " ".) : (1) . (2) PTRACE_MODE_FSCREDS UID GID . ( credentials(7) UID GID .) PTRACE_MODE_REALCREDS UID GID . ( UID GID . PTRACE_MODE_REALCREDS .) (3) : o . o CAP_SYS_PTRACE . (4) " " 1 (SUID_DUMP_USER PR_SET_DUMPABLE prctl(2)) CAP_SYS_PTRACE . (5) LSM security_ptrace_access_check() ptrace . LSM. commoncap LSM : (5.1) PTRACE_MODE_FSCREDS ( PTRACE_MODE_REALCREDS ) . (5.2) : o . o CAP_SYS_PTRACE . commoncap LSM PTRACE_MODE_READ PTRACE_MODE_ATTACH. (6) . /proc/sys/kernel/yama/ptrace_scope Yama Linux Security Module (LSM) ( CONFIG_SECURITY_YAMA) /proc/sys/kernel/yama/ptrace_scope ( 3.4) ptrace() ( strace(1) gdb(1)). ptrace ( GPG SSH) . Yama LSM : o ptrace PTRACE_MODE_ATTACH -- ptrace() PTRACE_ATTACH. ( " Ptrace" .) o ptrace() PTRACE_TRACEME. CAP_SYS_PTRACE /proc/sys/kernel/yama/ptrace_scope : 0 (" ptrace ") PTRACE_MODE_ATTACH ( commoncap LSM ). PTRACE_TRACEME . 1 ("ptrace ") [ ] PTRACE_MODE_ATTACH CAP_SYS_PTRACE . . prctl(2) PR_SET_PTRACER PID PTRACE_MODE_ATTACH . Documentation/admin-guide/LSM/Yama.rst . PTRACE_TRACEME . 2 (" ") CAP_SYS_PTRACE PTRACE_MODE_ATTACH PTRACE_TRACEME. 3 (" ") PTRACE_MODE_ATTACH PTRACE_TRACEME. . 1 2 Yama. UID UID ( CAP_SYS_PTRACE) ( ). Yama LSM. C PTRACE_PEEKTEXT PTRACE_PEEKDATA PTRACE_PEEKUSER : data . glibc "" . 2.6 PTRACE_SETOPTIONS 2.4. 2.6 2.4. PTRACE_SETOPTIONS PTRACE_OLDSETOPTIONS . . 2.6.38.6. _exit(2) PTRACE_EVENT_EXIT ( ) WIFEXITED . execve(2) . execve(2) . PTRACE_DETACH . 2.6.38.6. SIGKILL PTRACE_EVENT_EXIT . SIGKILL ptrace. 3.13. EINTR . ( : SIGSTOP ). 3.2.9 ( ): epoll_wait(2) read(2) inotify(7). strace -p restart_syscall(<... ...>_ select(6, [5], NULL, [5], NULL_ ('_' ) . : clock_gettime(CLOCK_MONOTONIC, {15370, 690928118}) = 0 epoll_wait(4,_ epoll_wait(2) strace(1) . epoll_wait(2) EINTR. EINTR epoll_wait(2) . ( EINTR <<>> strace(1) .) glibc ptrace() errno . gdb(1) ltrace(1) strace(1) clone(2) execve(2) fork(2) gettid(2) prctl(2) seccomp(2) sigaction(2) tgkill(2) vfork(2) waitpid(2) exec(3) capabilities(7) signal(7) 3 . . : . 6.18 10 2026 ptrace(2)