Linux ptrace() mechanism

Extensions

Jeff Dike implemented PTRACE_SYSCALL_MASK in order to implement time virtualisation efficiently in User Mode Linux, which relies on ptrace(). This would be useful for implementing PtraceJail efficiently. The patch was posted to linux-kernel as an RFC. Jeff Dike has not submitted it for inclusion in the mainline kernel.

utrace reimplementation

Roland McGrath's utrace is a reimplementation of the ptrace mechanism. As of 2007/12/01, it has not been merged into the mainline kernel, but it is apparently included in Fedora kernels.

Fail-safety

When ptrace() is being used for security, if the tracing process dies we want the traced processes to be killed or at least stopped. If the traced processes were no longer traced, all system call restrictions would be lifted. Based on the current documentation for ptrace(), there does not appear to be a way to use it in a fail-safe way.

Systems using ptrace

Libraries

Gotchas

Ptrace (last edited 2009-07-01 12:52:26 by MarkSeaborn)