Add --ptrace to retain CAP_SYS_PTRACE for native debugging

Author: nitanmarcel

jrunas.cpp

@@ -10,7 +10,9 @@
 #include <signal.h>
 #include <stdlib.h>
 #include <string.h>
+#include <sys/capability.h>
 #include <sys/ioctl.h>
+#include <sys/prctl.h>
 #include <sys/stat.h>
 #include <sys/types.h>
 #include <sys/wait.h>
@@ -97,12 +99,33 @@ static void set_selinux_context(uid_t uid, const char* seinfo, const char* pkgna
   }
 }
 
+static void retain_ptrace_capability() {
+  __user_cap_header_struct hdr = {};
+  hdr.version = _LINUX_CAPABILITY_VERSION_3;
+  hdr.pid = 0;
+  __user_cap_data_struct data[2] = {};
+  const unsigned int idx = CAP_SYS_PTRACE >> 5;
+  const unsigned int bit = 1u << (CAP_SYS_PTRACE & 31);
+  data[idx].effective = bit;
+  data[idx].permitted = bit;
+  data[idx].inheritable = bit;
+  if (capset(&hdr, data) != 0) error(1, errno, "capset(CAP_SYS_PTRACE) failed");
+  if (prctl(PR_CAP_AMBIENT, PR_CAP_AMBIENT_RAISE, CAP_SYS_PTRACE, 0, 0) != 0) {
+    error(1, errno, "PR_CAP_AMBIENT_RAISE(CAP_SYS_PTRACE) failed");
+  }
+}
+
 static void become_app_and_exec(uid_t app_id, const char* seinfo, const char* pkgname,
-                                const std::string& data_dir, char** cmd_argv) {
+                                const std::string& data_dir, char** cmd_argv,
+                                bool keep_ptrace) {
   std::vector<gid_t> gids = get_supplementary_gids(app_id);
   if (setgroups(gids.size(), gids.data()) == -1) error(1, errno, "setgroups failed");
+  if (keep_ptrace && prctl(PR_SET_KEEPCAPS, 1, 0, 0, 0) != 0) {
+    error(1, errno, "PR_SET_KEEPCAPS failed");
+  }
   if (setresgid(app_id, app_id, app_id) == -1) error(1, errno, "setresgid failed");
   if (setresuid(app_id, app_id, app_id) == -1) error(1, errno, "setresuid failed");
+  if (keep_ptrace) retain_ptrace_capability();
 
   set_selinux_context(app_id, seinfo, pkgname);
 
@@ -145,7 +168,7 @@ static void write_all(int fd, const char* buf, size_t len) {
 }
 
 static int run_on_pty(uid_t app_id, const char* seinfo, const char* pkgname,
-                      const std::string& data_dir, char** cmd_argv) {
+                      const std::string& data_dir, char** cmd_argv, bool keep_ptrace) {
   int ref_tty = isatty(STDOUT_FILENO) ? STDOUT_FILENO : STDIN_FILENO;
   struct termios ref_attr;
   bool have_attr = (tcgetattr(ref_tty, &ref_attr) == 0);
@@ -169,7 +192,7 @@ static int run_on_pty(uid_t app_id, const char* seinfo, const char* pkgname,
     dup2(slave, STDOUT_FILENO);
     dup2(slave, STDERR_FILENO);
     if (slave > STDERR_FILENO) close(slave);
-    become_app_and_exec(app_id, seinfo, pkgname, data_dir, cmd_argv);
+    become_app_and_exec(app_id, seinfo, pkgname, data_dir, cmd_argv, keep_ptrace);
     _exit(127);
   }
 
@@ -228,18 +251,24 @@ static int run_on_pty(uid_t app_id, const char* seinfo, const char* pkgname,
 }
 
 int main(int argc, char* argv[]) {
-  if (argc < 2) {
-    error(1, 0, "usage: jrunas <package-name> [--user <id>] [<command> [<args>]]");
+  const char* usage =
+      "usage: jrunas [--ptrace] <package-name> [--user <id>] [<command> [<args>]]";
+
+  int argi = 1;
+  bool keep_ptrace = false;
+  if (argi < argc && strcmp(argv[argi], "--ptrace") == 0) {
+    keep_ptrace = true;
+    argi++;
   }
 
-  char* pkgname = argv[1];
-  int cmd_argv_offset = 2;
+  if (argi >= argc) error(1, 0, "%s", usage);
+  char* pkgname = argv[argi++];
 
   int userId = 0;
-  if (argc >= 4 && strcmp(argv[2], "--user") == 0) {
-    userId = atoi(argv[3]);
+  if (argc - argi >= 2 && strcmp(argv[argi], "--user") == 0) {
+    userId = atoi(argv[argi + 1]);
     if (userId < 0) error(1, 0, "negative user id: %d", userId);
-    cmd_argv_offset += 2;
+    argi += 2;
   }
 
   bool is_root = (getuid() == AID_ROOT);
@@ -264,12 +293,12 @@ int main(int argc, char* argv[]) {
   std::string data_dir = "/data/user/" + std::to_string(userId) + "/" + pkgname;
   check_data_path(pkgname, data_dir.c_str(), userAppId);
 
-  char** cmd_argv = argv + cmd_argv_offset;
+  char** cmd_argv = argv + argi;
 
   if (isatty(STDIN_FILENO) || isatty(STDOUT_FILENO)) {
-    return run_on_pty(userAppId, info.seinfo.c_str(), pkgname, data_dir, cmd_argv);
+    return run_on_pty(userAppId, info.seinfo.c_str(), pkgname, data_dir, cmd_argv, keep_ptrace);
   }
 
-  become_app_and_exec(userAppId, info.seinfo.c_str(), pkgname, data_dir, cmd_argv);
+  become_app_and_exec(userAppId, info.seinfo.c_str(), pkgname, data_dir, cmd_argv, keep_ptrace);
   return 1;
 }