Fix two races in debuggerd's PTRACE_ATTACH logic:
1. The target thread in a crash dump request could exit between the
/proc/<pid>/task/<tid> check and the PTRACE_ATTACH.
2. Sibling threads could exit between listing /proc/<pid>/task and the
PTRACE_ATTACH.
Bug: http://b/29555636
Change-Id: I4dfe1ea30e2c211d2389321bd66e3684dd757591
Soong is always on now, so we don't have to distinguish between
makefiles that should be ignored because Soong is handling them with an
Android.bp file, and makefiles that are still needed with Soong. All
obsolete Android.mk files have been removed, rename all Android.soong.mk
files to Android.mk.
Change-Id: Iabbddcbfb2c837cfd4556241b570474452cc5d4d
If the underlying local map changes, it's possible for multiple
threads to try and modify the map data associated with the UnwindLocalMap
object. Add a lock when generating the local map to avoid this problem.
In addition, add a read lock whenever any caller gets the maps iterator.
Updated all iterator callers to make this lock.
Bug: 29387050
Change-Id: Ie34822c3d8fd3bdb3dd126aeeb399969c36508c1
am: 4434b42cd0
* commit '4434b42cd0bd36be4ca7702e840886f67daaff2d':
Add a fortify test to crasher.
Change-Id: I3b8b473aa256b7de7ca5e50e14b32d0c3b0565e1
The code for dumping tombstones tries to read the log data. This was
silently failing after the change to drop root privileges. Fix this
by explicitly setting the groups allowed before dropping privileges.
Bug: 28590884
(cherry picked from commit edc2380109)
Change-Id: I225365edccb11f8752027566fd42f3b10ce10260
am: fd1eee58f9
* commit 'fd1eee58f985b3d528ca352ff278d7b200390ab2':
Set groups before dropping privileges.
Change-Id: I85c98abb0e7cc3b36ec714899540d65e6ca908c7
In the function dump_thread_info, if /proc/<PID>/comm is unreadable, then
threadname will be used in a strncmp causing a crash. The fix is to
avoid the check if threadname is null.
Bug: 28615417
(cherry picked from commit 039976e553)
Change-Id: I1e61431b1549ecfdc49a72cbf193a364069cda79
In the function dump_thread_info, if /proc/<PID>/comm is unreadable, then
threadname will be used in a strncmp causing a crash. The fix is to
avoid the check if threadname is null.
Bug: 28615417
Change-Id: I54eda86404c927dbf5a987f5dd2108487df9f16c
The code for dumping tombstones tries to read the log data. This was
silently failing after the change to drop root privileges. Fix this
by explicitly setting the groups allowed before dropping privileges.
Bug: 28590884
Change-Id: Iaccb1d2928268fc9fc855f6e3814c31ce019badf
When someone enables wait_for_gdb, activity manager will kill the
stopped process before a developer can attach to the process. To
allow debugging in this case, change the code to only contact the
activity manager right before continuing the process that is
crashing.
Also, modify the conditions under which to do a gdb attach. The previous
code did a partial attach if perform_dump failed. The new version simply
allows an attach regardless of whether perform_dump passes or fails.
Bug: 28409358
(cherry picked from commit 9818bd2bbe)
Change-Id: I42f464b69332748e16b07d9d00f44b3aa26ce8b7
When someone enables wait_for_gdb, activity manager will kill the
stopped process before a developer can attach to the process. To
allow debugging in this case, change the code to only contact the
activity manager right before continuing the process that is
crashing.
Also, modify the conditions under which to do a gdb attach. The previous
code did a partial attach if perform_dump failed. The new version simply
allows an attach regardless of whether perform_dump passes or fails.
Bug: 28409358
Change-Id: I4fe8d390c212d47e007cbe6543c2d114c3c7aeff
Before dropping root privileges, connect to the activity manager.
Also, only connect to the activity manager if this is a crash.
Bug: 28210681
(cherry picked from commit 0fc89f34b9)
Change-Id: Id25b92e550d71ffe1b9eafe43976ef514a83714b
Before dropping root privileges, connect to the activity manager.
Also, only connect to the activity manager if this is a crash.
Bug: 28210681
Change-Id: Ie266031910519fa2aa6835644a95c1fc56e24d8d
am: 437911e
* commit '437911ec87fe471a4cbe7e3dfa722e11d3187805':
debuggerd: set the name of the signal sender.
Change-Id: I23723649fcc33a624f4aba80cde81f1bbb71fc3b
Processes using seccomp will get SIGSYS when attempting to use a
disallowed syscall. We're currently not handling SIGSYS in bionic's
signal handler, but this change will let us dump a backtrace pointing at
rt_tgsigqueueinfo in our signal handler if seccomp policies block it
during a real crash.
Bug: http://b/27853687
Change-Id: I4e4aacc95eeef7249d895e19dc4ccd77a51c7a17
This was actually nonfunctional until f5e8f0b, because it was using kill
after privileges were dropped. This doesn't seem necessary after the
changes to the sibling thread ptrace logic, though.
Bug: http://b/27427439
Change-Id: I6bffbc14e0cf5e377bbfa39c945518e0d436c223
(cherry picked from commit b17f228ff6)
This was actually nonfunctional until f5e8f0b, because it was using kill
after privileges were dropped. This doesn't seem necessary after the
changes to the sibling thread ptrace logic, though.
Bug: http://b/27427439
Change-Id: I6bffbc14e0cf5e377bbfa39c945518e0d436c223
Use sigtimedwait on SIGCHLD to watch our forked worker processes for
failure, so that we can guarantee that we always resume/kill the target
process if libunwind crashes.
Bug: http://b/27427439
Change-Id: I5a5da1f1abd7dc9d01223f5b3778e946e2d47d20
(cherry picked from commit 630bc80e18)
system/core/debuggerd/debuggerd.cpp:683:5: warning: Value stored to 'logsocket' is never read
logsocket = -1;
^ ~~
Bug: http://b/27264392
Change-Id: I8eab8a02b67f219c32aea49e4d4957e5642df38f
(cherry picked from commit 6da1353863)
Use sigtimedwait on SIGCHLD to watch our forked worker processes for
failure, so that we can guarantee that we always resume/kill the target
process if libunwind crashes.
Bug: http://b/27427439
Change-Id: I5a5da1f1abd7dc9d01223f5b3778e946e2d47d20
Remove the logging of an error if a thread disappears before the unwind
can begin. This can happen, so allow the caller to determine if this
is really a problem worth logging.
Bug: 27449879
(cherry picked from commit 206a3b9798)
Change-Id: If9e7cfeb6eb7b122679a734c1a9eacee8354ef18
Remove the logging of an error if a thread disappears before the unwind
can begin. This can happen, so allow the caller to determine if this
is really a problem worth logging.
Bug: 27449879
Change-Id: Ie81718d53fb0e519fa0a7db9fd5f314b72bfa431
system/core/debuggerd/debuggerd.cpp:683:5: warning: Value stored to 'logsocket' is never read
logsocket = -1;
^ ~~
Bug: http://b/27264392
Change-Id: I8eab8a02b67f219c32aea49e4d4957e5642df38f
Previously, we weren't PTRACE_ATTACHing to all of the threads of a
process, and we were also trying to do it after forking and dropping
privileges. This patch ensures that all ptrace attaching/detaching
happens in one place, before forking/exiting respectively.
Bug: http://b/26443860
Bug: http://b/26436605
Bug: http://b/26436486
Change-Id: Id94e0c1d9d56c051d0dd281d895aaa3285079198
debuggerd_test stubs out the selinux/android.h interface, but was
relying on copied selinux headers to declare the interface. Create a
stub selinux/android.h header included by the test to declare the
interface.
Change-Id: I6a2d402dda1797deb2515f10b663b1a84d498eac
Use ScopedFd and unique_ptr to manage resources, so that we can early
exit instead of having 9 levels of indentation.
Change-Id: Ia5fed76c7d959f1f198ea540c56c508f7e1585c4
Add the following mount options to the /proc filesystem:
hidepid=2,gid=3009
This change blocks /proc access unless you're in group 3009
(aka AID_READPROC).
Please see
https://github.com/torvalds/linux/blob/master/Documentation/filesystems/proc.txt
for documentation on the hidepid option.
hidepid=2 is preferred over hidepid=1 since it leaks less information
and doesn't generate SELinux ptrace denials when trying to access
/proc without being in the proper group.
Add AID_READPROC to processes which need to access /proc entries for
other UIDs.
Bug: 23310674
Change-Id: I22bb55ff7b80ff722945e224845215196f09dafa
This is an optional diagnostic tool where it's useful to know if you are
running the version that you just built. Allow the use of __TIME__
without a warning or error.
Bug: 24204119
Change-Id: I78063c2694b80ccaf5891d1cd649ea17eda978cb
Keeping these means that every build has different init and debuggerd
binaries, even if the source was the same. So OTAs that don't touch
these sources would still need to update the binaries.
Both of these messages are only informational, so can be safely removed.
Bootchart already encodes build-specific information from the system
properties.
Bug: 24204119
Change-Id: I7ebd65a20a3e031e7528c9f741616e20b3cd7446
* commit '2fb90dc8b2b590e674c5e433e8bf3d3f08a887c8':
debuggerd: audit pid, uid and gid on SE Linux denial
property_service: log pid,uid and gid of setprop client
When debugging SE Linux audit messages from debuggerd, its
unclear what process is triggering the access violation. To
assist in debugging, we also log pid, uid and gid.
Before:
avc: denied { dump_backtrace } for scontext=u:r:dumpstate:s0 ...
After:
avc: denied { dump_backtrace } for pid=198 uid=1019 gid=1019 ..
Change-Id: I8263e6f5e77917139b73c3e84b76f7f97fd98003
Signed-off-by: William Roberts <william.c.roberts@intel.com>
Clang 3.8 warns against this now, and it is tripping up part of a test.
We suppress the warning, since we are trying to actually test that this
behavior is properly handled.
Change-Id: I8705900572e1a6704bbdc001fece3e2d16c7077c
This reverts commit ab5e583327.
And statically link llvm libraries on host to remove dependency
on 32-bit llvm shared library which is not included in the prebuilt.
Bug: 22229391
Change-Id: I8210687655ee1809fd820ab2a6ca5dfaf3f9096d
Static binaries don't get the signal handler installed (that's done by the
dynamic linker) so we don't need to worry about seeing SIGPIPE crashes from
old binaries.
Bug: http://b/20659371
Change-Id: I3b5566634fadd3e822262561188d29814bccd1fd
If the first read when dumping memory returns no data, skip ahead to
the next page boundary and try and read from there. This fixes a case
where the address at which to start dumping memory is unreadable, but
crosses back into readable memory.
Bug: 22234753
Change-Id: Ie28d5c027013577ca06f5396aba498366a3b6749
Use debug.debuggerd.wait_for_gdb being set to non-zero to
determine if debuggerd should stop and wait for someone to
attach gdb to the crashing process.
Bug: 22233908
Change-Id: Id55a1572b479a70d395b7270392ce6fb70dbfdca
We improved gdbclient to make the process simpler, but didn't update
debuggerd to match.
Bug: http://b/22233857
Change-Id: If4137943f567a9e566a3ac7f485c9b1eab2c68e9
The debuggerd code sometimes calls _LOG(..., logtype::ERROR, ...)
and sometimes ALOGE(). Standardize on ALOGE since the _LOG message
will wind up in the tombstone in weird places, but using ALOGE
will wind up in the logcat portion of the tombstone.
Bug: 21467089
Change-Id: Ie893f5e91d45b48ef3f5864c3a714e60ac848fb3
d34e407aeb removed support for
running with SELinux completely disabled. SELinux must either be
in permissive or enforcing mode now.
Remove unnecessary calls to is_selinux_enabled(). It always returns
true now.
Change-Id: Ife3156b74b13b2e590afe4accf716fc7776567e5
Previously, the map printing in tombstones for 64 bit devices uses
a variable length value. This means that the maps are not lined up.
The new format is to print the map as 00000000'00000000 in all ways.
Also fix a bug where the backtrace_map_t did not initialize all
parameters.
Add unit tests for all of the dump_all_maps function.
Bug: 20950813
(cherry picked from commit 862fe02919)
Change-Id: Ife5c48bddeb19006a98f9e87520474e97b97f6d9
Previously, the map printing in tombstones for 64 bit devices uses
a variable length value. This means that the maps are not lined up.
The new format is to print the map as 00000000'00000000 in all ways.
Also fix a bug where the backtrace_map_t did not initialize all
parameters.
Add unit tests for all of the dump_all_maps function.
Bug: 20950813
Change-Id: I30901c8a0251b00d85c4c01476b033ef8db84e32
- Add dumping memory around registers for x86/x86_64.
- Add unit tests for new dump_memory function.
- Cleanup all of the machine.cpp files.
- Increase the high address check for 32 bit, and decrease the high
address allowed for 64 bit slightly to match mips64.
Bug: 21206576
(cherry picked from commit e8bc77eb84)
Change-Id: I49ec237e30076a232f084da1072bf9aba15dc0cd
- Add dumping memory around registers for x86/x86_64.
- Add unit tests for new dump_memory function.
- Cleanup all of the machine.cpp files.
- Increase the high address check for 32 bit, and decrease the high
address allowed for 64 bit slightly to match mips64.
Bug: 21206576
Change-Id: I6f75141f3282db48b10f7c695a1cf2eb75a08351
Under some conditions, /proc/<pid>/maps might return nothing. If we
try and unwind in this case, we'll crash. Check this case and fail
the unwind.
Add checks that no other functions try and use map_ without
checking for nullptr.
Add logging when an unwind fails so it's clear what happened.
Bug: 21162746
Change-Id: I56ce51dda0cfc9db20475a441f118108196aa07c
(cherry picked from commit 30c942cf10)
Under some conditions, /proc/<pid>/maps might return nothing. If we
try and unwind in this case, we'll crash. Check this case and fail
the unwind.
Add checks that no other functions try and use map_ without
checking for nullptr.
Add logging when an unwind fails so it's clear what happened.
Bug: 21162746
Change-Id: I56ce51dda0cfc9db20475a441f118108196aa07c
This avoids the log daemon skipping some of the log output from
debuggerd.
Bug: 20846525
(cherry picked from commit b0412a5c2b)
Change-Id: Ifed48814d76c7e855645b6d5487d5e6e1fcafd9e
The new linker relocation packing support uses non-zero load bases,
so we better handle them properly.
Also print out the load base for a map if it's non-zero.
Bug: 20687795
(cherry picked from commit 329ed7dae4)
Change-Id: Ibc37d8c8bb032820dca4e7531184349ba6d402d2
The new linker relocation packing support uses non-zero load bases,
so we better handle them properly.
Also print out the load base for a map if it's non-zero.
Bug: 20687795
Change-Id: Iec2d1db2051e7b4a278c1dfa57d745128a7f2974
ELF said that padding is present, if necessary, to ensure 4-byte
alignment for the descriptor and next note entry, but such padding
is not included in namesz and descsz.
Change-Id: I7896783f3d9a787772d56c49905f52a493c9fba1
For every map that has a name, and if it's a mapped in shared library,
print the build id.
Refactor the way dump_all_maps logs data.
Refactor the way stack segments are dumped.
Bug: 19371018
Change-Id: Ic08d05a4b13f128925743936fb84d8059f7cb56f
Move away from using POSIX open(2) flags and introduce ANDROID_LOG_* flags to
replace them. Add security by preventing random mode flags from getting into
underlying POSIX calls. ANDROID_LOG_* flags overlap POSIX O_* flag definitions.
Change-Id: Ib32bb64c287e8bf150be62242e1ba46bb37839fc
Modifies the code so that if the unwind fails, the code still prints
as much data as possible.
Also, for sibling threads, skip printing the maps and memory/code
since it's not likely to be very relevant.
Fix a few cases where extra space is at the end of lines.
Fix an inverted if statement that was checking the wrong condition.
Bug: 18816322
Change-Id: Ic659e0c34489bf2c65c5a23e2b83e31653b927e4
The backtrace structure used to include a pointer to a backtrace_map_t
that represented the map data for a particular pc. This introduced a
race condition where the pointer could be discarded, but the backtrace
structure still contained a pointer to garbage memory. Now all of the map
information is right in the structure.
Bug: 19028453
Change-Id: If7088a73f3c6bf1f3bc8cdd2bb4b62e7cab831c0
The kernel finally has the pt_regs structure properly defined for mips,
so we don't need to define it ourselves.
Change-Id: Ifdf75ed827cd2390962e9b3a182bdbbf02fe0732
On 64 bit systems, calls to dump_backtrace_to_file or dump_tombstone
try and directly contact the correct debuggerd (32 bit vs 64 bit)
by reading the elf information for the executable.
Unfortunately, system_server makes a call to dump_backtrace_to_file
and it doesn't have permissions to read the executable data, so it
defaults to always contacting the 64 bit debuggerd.
This CL changes the code so that all dump requests go to the 64 bit
debuggerd, which reads the elf information and redirects requests for
32 bit processes to the 32 bit debuggerd.
Testing:
- Forced the watchdog code in system_server to dump stacks and
verified that all native stacks are dumped correctly.
- Verified that dumpstate and bugreport still properly dump the native
processes on a 64 bit and 32 bit system.
- Intentionally forced the 64 bit to 32 bit redirect to write only a
byte at a time and verified there are no errors, and no dropped data.
- Used debuggerd and debuggerd64 to dump 32 bit and 64 bit processes
seemlessly.
- Used debuggerd on a 32 bit system to dump native stacks.
Bug: https://code.google.com/p/android/issues/detail?id=97024
Change-Id: Ie01945153bdc1c4ded696c7334b61d58575314d1
- Fix a problem where a tid exits before the attach completes, and it
causes debuggerd to self terminate.
- Fix a problem where sibling tid dumps do not properly wait for the tid
to get signalled.
Bug: 17800180
Bug: 12567315
(cherry picked from commit 84ddb34a3a)
Change-Id: I45e33865614d4c96f4a89cf117398666b556d500
debuggerd allows uid-0 processes to dump tombstones or backtraces
of any process, and uid-system processes to dump backtraces of any
processes. Restrict these operations via SELinux based on the
client context, the target process context, and the action.
Depends on I8e120d319512ff207ed22ed87cde4e0432a13dda for the
corresponding policy definitions.
Change-Id: Ib317564e54e07cc21f259e75124b762ad17c6e16
Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
Also fix dumping of arm64's vector registers, which are actually 128 bits wide.
Also move the arm/arm64 FP registers to the tombstone. (We've never dumped
them at all for the other architectures.)
(cherry picked from commit b40c50351e)
Change-Id: Ic646fb9ea01e9beb42e1757feb8742c1d4efafa7
Also fix dumping of arm64's vector registers, which are actually 128 bits wide.
Also move the arm/arm64 FP registers to the tombstone. (We've never dumped
them at all for the other architectures.)
Change-Id: I239a86dd225b47fa90109bc824b7610df67ad812
There's no good reason to separate "fill the integer registers with
recognizable patterns and crash" from "fill the FP registers with recognizable
patterns and crash".
Also remove the incorrect use of ARCH_ARM_HAVE_VFP_D32 rather than try to fix
it.
Change-Id: I3a4a3aca1575de5489314027ae52168997404d79
Maps output now displays fault address location more intelligently. If
the fault is not in a mapped region, it now shows where that address is
with respect to the other maps.
In addition, the size of the map is now printed as part of the output.
Also, crasher now supports an "mmap" option which mmaps/munmaps a region
of memory and then attempts to access it, causing a fault address in
between mapped regions that can be used to test that new part of the
maps output.
Change-Id: Ia5e1926802bdfcbbdb7857e3631ddf395ae0c5b8
Now the debugging output shows the tid of the crashed thread instead of
the pid of the process that crashed.
Change-Id: I637f409ff02d73d458edc6d1a5c462c21d128211
The debug output was still showing the pathname that worked with
gdbclient before my changes, and therefore did not work after the fact.
Change-Id: Ie12d79f5346088914ce0a70bda69780707b31d31
If the fault address is not within a mapped region, it logs an error
message after the output. Otherwise, it prefixes the location of the
fault address with "--->" to make it easier to locate.
Change-Id: I330adaade4402ffeb09f1a6d34a944c2f054d06d
Now the functionality implemented by these semi-confusing cases has been
replaced with the same logtype enum behavior that is easier to
understand, and cases that used log-looking behavior to print to logcat
(when log = NULL) now use the more transparent ALOGE/ALOGD functions.
Change-Id: I7e38f2d4ca74a828df4d2266b3ea34edd3c6f5bb
Now the map output is only sent to the tombstone, and the entire
contents of /prod/$PID/maps is logged, not just 3 lines. Additionally,
crasher now supports "crasher SIGSEGV-non-null", which attempts to write to a
dereferenced function address, causing a SIGSEGV at a non-zero address.
This new crasher mode can be used to test the new maps output.
Bug: 15343662
Change-Id: I796d92e8352a6b9714bbbfe96f3143c56565ef2f
The system by which debuggerd filters its output to different locations
is now based on an enum called logtype with easy to understand
categories for log messages (like THREAD, MEMORY, etc.) instead of the
old, fairly esoteric scope_flags variable. Now much of the output that
previously went to logcat does not show up on the screen, but all output
can be found in the tombstone file. In addition, the tombstone's
location is now printed so it can be located easily.
Bug: 15341747
Change-Id: Ia2f2051d1dfdea934d0e6ed220f24345e35ba6a2
- auditd spawn log copy to events and main
- logcat delete events as one of the default logs
- debuggerd do not collect events.
- squish multiple spaces
- switch from strcpy to memmove for overlapping buffers
BUG: 14626551
Change-Id: I89b30273ce931ed2b25a53ea9be48e77f4c1bbf4
