PTRACE_GET_SYSCALL_INFO requires PTRACE_O_TRACESYSGOOD but not documented

From: Nate Eldredge
Date: Sat May 28 2022 - 02:13:16 EST


It seems that the PTRACE_GET_SYSCALL_INFO function of ptrace(2) only works properly if the tracer has set the PTRACE_O_TRACESYSGOOD option. The man page doesn't mention this requirement. Is it intentional?

The issue is that ptrace_get_syscall_info() in kernel/ptrace.c only calls the ptrace_get_syscall_info_{entry,exit} functions to fully populate the ptrace_syscall_info struct if child->last_siginfo->si_code == SIGTRAP | 0x80. And the 0x80 bit is only set when PTRACE_O_TRACESYSGOOD is in effect. Otherwise, the struct always comes back to userspace with op == PTRACE_SYSCALL_INFO_NONE and the entry (or exit) member is not filled in with the system call arguments (or return value).

--
Nate Eldredge
nate@xxxxxxxxxxxxxxxxxxxx