linux(4) prctl(2): Implement PR_[GS]ET_DUMPABLE

[cem]

Summary

Proxy the flag to the roughly analogous FreeBSD procctl 'TRACE'.

TRACE-disabled processes are not coredumped, and Linux !DUMPABLE processes
can not be ptraced. There are some additional semantics around ownership of
files in the /proc/[pid] pseudo-filesystem, which we do not attempt to
emulate correctly at this time.

[cem]

Stub wasn't sufficient; chrome self-tests that disabling dump is reflected in
subsequent GET. Instead, proxy the prctl to the similar procctl PROC_TRACE.

[markj]

This diff doesn't appear to match the description.

sys/compat/linux/linux_misc.c

1918

aldo -> also

[cem]

In D27015#602732, @markj wrote:

This diff doesn't appear to match the description.

Ah, yes. Arc diff update doesn’t update the commit message text on phabricator. I’ve rewritten the text somewhat and will update it manually in a bit.

Thanks for taking a look at all of these.

sys/compat/linux/linux_misc.c

1918

Fixed locally, will update in a minute. I should probably also drop the comment about ownership— SUID_DUMP_ROOT was short-lived and is no longer an acceptable mode.

1939

Caveat: I have no idea if Linux inherits this flag across exec or not.

[cem]

Fix typo

[cem]

• Update the comment. No functional change.

[markj]

sys/compat/linux/linux_misc.c

1932

Why is id 0 here? I don't see any special handling in kern_procctl() for that case: id gets passed to pfind().

[cem]

sys/compat/linux/linux_misc.c

1932

Copied from PROC_PDEATHSIG_STATUS above, but now I see that has special handling in kern_procctl. So yes, we need to explicitly include curthread's pid.

[cem]

• Fix PID passed to kern_procctl. Previously, the syscall would manipulate the tracability of the kernel 0 process, which is probably meaningless and certainly not intended.

[markj]

sys/compat/linux/linux_misc.c

1914–1954

For LINUX_PR_SET_DUMPABLE we unconditionally return but here we only do so upon error.

1939

By my reading of Linux the "dumpable" flags are preserved across execve, so I think this is right. bprm_mm_init() calls mm_alloc(), which preserves flags from the current mm if they are in MM_INIT_MASK, which includes MMF_DUMPABLE_MASK.

[cem]

sys/compat/linux/linux_misc.c

1914–1954

The break is essentially just return (error). The prevailing pattern seems to use break, but given we don't have other cleanup to perform and we exit early in a number of error cases, I'm inclined to reconcile this by explicitly returning in GET_DUMPABLE as well.

1939

Thanks for checking.

[cem]

• Unify return style of GET/SET cases in switch