New configuration option: DisableDebuggerAttachment

If set to 1, Tor will attempt to prevent basic debugging
attachment attempts by other processes. (Default: 1)

Supports Mac OS X and Gnu/Linux.

Sebastian provided useful feedback and refactoring suggestions.

Signed-off-by: Jacob Appelbaum <jacob@appelbaum.net>

1 files changed, 57 insertions, 0 deletions

diff --git a/src/or/config.c b/src/or/config.c
index f3c634569..5a153b01b 100644
--- a/src/or/config.c
+++ b/src/or/config.c
@@ -40,6 +40,14 @@
 
 #include "procmon.h"
 
+/* Includes for the process attaching prevention */
+#if defined(HAVE_SYS_PRCTL_H) && defined(__linux__)
+#include <sys/prctl.h> 
+#elif defined(__APPLE__)
+#include <sys/types.h>
+#include <sys/ptrace.h>
+#endif
+
 /** Enumeration of types which option values can take */
 typedef enum config_type_t {
   CONFIG_TYPE_STRING = 0,   /**< An arbitrary string. */
@@ -238,6 +246,7 @@ static config_var_t _option_vars[] = {
   V(DirReqStatistics,            BOOL,     "1"),
   VAR("DirServer",               LINELIST, DirServers, NULL),
   V(DisableAllSwap,              BOOL,     "0"),
+  V(DisableDebuggerAttachment,   BOOL,     "1"),
   V(DisableIOCP,                 BOOL,     "1"),
   V(DNSPort,                     PORT,     "0"),
   V(DNSListenAddress,            LINELIST, NULL),
@@ -649,6 +658,47 @@ get_dirportfrontpage(void)
   return global_dirfrontpagecontents;
 }
 
+/* We only use the linux prctl for now. There is no Win32 support; this may
+ * also work on various BSD systems and Mac OS X - send testing feedback!
+ * 
+ * On recent Gnu/Linux kernels it is possible to create a system-wide policy
+ * that will prevent non-root processes from attaching to other processes
+ * unless they are the parent process; thus gdb can attach to programs that
+ * they execute but they cannot attach to other processes running as the same
+ * user. The system wide policy may be set with the sysctl
+ * kernel.yama.ptrace_scope or by inspecting /proc/sys/kernel/yama/ptrace_scope
+ * and it is 1 by default on Ubuntu 11.04.
+ *
+ * This ptrace scope will be ignored on Gnu/Linux for users with
+ * CAP_SYS_PTRACE and so it is very likely that root will still be able to
+ * attach to the Tor process.
+*/
+/** Attempt to disable debugger attachment. */
+static int tor_disable_debugger_attach(void) {
+    int r;
+    r = -1;
+    log_debug(LD_CONFIG,
+    "Attemping to disable debugger attachment to Tor for unprivileged users.");
+#if defined(__linux__) && defined(HAVE_SYS_PRCTL_H) && defined(HAVE_PRCTL)
+#ifdef PR_SET_DUMPABLE
+    r = prctl(PR_SET_DUMPABLE, 0);
+#endif
+#endif
+#if defined(__APPLE__) && defined(PT_DENY_ATTACH)
+    r = ptrace(PT_DENY_ATTACH, 0, 0, 0);
+#endif
+
+// XXX: TODO - Mac OS X has dtrace and this may be disabled - implement it here
+// XXX: TODO - Windows probably has something similar - implement it here
+    if (r == 0) {
+      log_debug(LD_CONFIG,"Debugger attachment disabled for unprivileged users.");
+    } else {
+      log_warn(LD_CONFIG, "Unable to disable ptrace attach: %s",
+                          strerror(errno));
+    }
+    return r;
+}
+
 /** Allocate an empty configuration object of a given format type. */
 static void *
 config_alloc(config_format_t *fmt)
@@ -1195,6 +1245,13 @@ options_act(or_options_t *old_options)
   int running_tor = options->command == CMD_RUN_TOR;
   char *msg;
 
+   /* disable ptrace and later, other basic debugging techniques */
+  if (options->DisableDebuggerAttachment) {
+      tor_disable_debugger_attach();
+  } else {
+      log_notice(LD_CONFIG,"Debugger attachment enabled for unprivileged users.");
+  }
+ 
   if (running_tor && !have_lockfile()) {
     if (try_locking(options, 1) < 0)
       return -1;