using ptrace for system calls filter

Recently i just develop an online compiler system ,taking the server security into account . For example,if the user use the fork() syscall,and it will cause the server unsafe,the ptrace syscall can realize the system calls filter, if  the daemon find the unsafe syscalls kill the process!

ptrace is a system call found in several Unix and Unix-like operating systems. By using ptrace (the name is a abbreviation of "process trace") one process can control another, enabling the controller to inspect and manipulate the internal state of its target. ptrace is used by debuggers and other code-analysis tools, mostly as aids to software development.

ptrace is used by debuggers (such as gdb and dbx), by tracing tools like strace and ltrace, and by code coverage tools. ptrace is also used by specialised programs to patch running programs, to avoid unfixed bugs or to overcome security features.

#include <sys/ptrace.h>

long ptrace(enum __ptrace_request request, pid_t pid,             void

*addr, void *data);

the example code !

  

1. #include <sys/ptrace.h>
2. #include <sys/types.h>
3. #include <sys/wait.h>
4. #include <unistd.h>
5. #include <linux/user.h>   /* For constants
6.                                    ORIG_EAX etc */
7. int main()
8. {   pid_t child;
9.     long orig_eax;
10.     child = fork();
11.     if(child == 0) {
12.         ptrace(PTRACE_TRACEME, 0, NULL, NULL);
13.         execl("/bin/ls", "ls", NULL);
14.     }
15.     else {
16.         wait(NULL);
17.         orig_eax = ptrace(PTRACE_PEEKUSER,
18.                           child, 4 * ORIG_EAX,
19.                           NULL);
20.         printf("The child made a "
21.                "system call %ld\n", orig_eax);
22.         ptrace(PTRACE_CONT, child, NULL, NULL);
23.     }
24.     return 0;
25. }
    
    
    When run, this program prints:

    
    

    The child made a system call 11

    along with the output of ls. System call number 11 is execve, and it's the first system call executed by the child. For reference, system call numbers can be found in /usr/include/asm/unistd.h.

    it's cool!

reference

http://linux.die.net/man/2/ptrace

http://www.linuxjournal.com/article/6100