Bug 285811 - Debuggers in jail can't evaluate string literals
Summary: Debuggers in jail can't evaluate string literals
Status: Closed FIXED
Alias: None
Product: Base System
Classification: Unclassified
Component: kern (show other bugs)
Version: CURRENT
Hardware: Any Any
: --- Affects Only Me
Assignee: freebsd-bugs (Nobody)
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2025-03-31 16:04 UTC by Gleb Popov
Modified: 2025-04-07 04:37 UTC (History)
2 users (show)

See Also:


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Gleb Popov freebsd_committer freebsd_triage 2025-03-31 16:04:44 UTC
The following simple testcase fails when ran in jail, but works outside:

# gdb /bin/cat
(gdb) run
...
^C
(gdb) print (char*)"asd"
Cannot access memory at address 0x7fffffffe45f

Interestingly, the address looks completely different in the prison 0:

(gdb) print (char*)"asd"
$2 = 0x801608028 "asd"

I first thought it is a gdb-specific problem, but it seems that lldb also suffers from it. The only difference is much less clear error message:

(lldb) print (char*)"asd"
error: Can't evaluate the expression without a running target due to: Interpreter doesn't handle one of the expression's operands
Comment 1 Konstantin Belousov freebsd_committer freebsd_triage 2025-03-31 20:39:19 UTC
address 0x7fffffffe45f vs address  0x801608028 suggests that debugger either
- cannot disable aslr,
- or cannot properly read disabled aslr status,
in the jail.  Can you try to see if either is the case?
Comment 2 Ed Maste freebsd_committer freebsd_triage 2025-04-01 20:49:25 UTC
Also just to confirm, lldb does work as expected outside of a jail?
Comment 3 Gleb Popov freebsd_committer freebsd_triage 2025-04-02 11:36:07 UTC
(In reply to Konstantin Belousov from comment #1)
Doesn't seem to be the either case. In GDB the ASLR handling is consolidated here [1]. I put the debugging output everywhere in this function and verified that all procctl() calls succeed.

I also tried setting kern.elf64.aslr.enable=0 outside of the jail (without restarting the jail, though) and it had no effect on the problem. Neither running gdb under proccontrol -m aslr -s disable change anything. I also tried elfctl -e +noaslr on both gdb and cat binaries - nothing helps the issue.

[1] https://github.com/bminor/binutils-gdb/blob/877d74ab5f2f33aa062c4b8d1ba910a46e4ef9d1/gdb/fbsd-nat.c#L1776
Comment 4 Gleb Popov freebsd_committer freebsd_triage 2025-04-02 11:36:38 UTC
(In reply to Ed Maste from comment #2)
Yes, outside of a jail the 'print (char*)"asd"' command works fine in both debuggers.
Comment 5 Konstantin Belousov freebsd_committer freebsd_triage 2025-04-02 19:28:20 UTC
Could you try to ktrace gdb in the jail and see what syscall fails, and how?

BTW, when you say that gdb in jail fails, you do run both the target process
and gdb itself in the same jail, right?
Comment 6 Gleb Popov freebsd_committer freebsd_triage 2025-04-03 05:55:22 UTC
(In reply to Konstantin Belousov from comment #5)
I see suspicious ptrace failures at the end of the dump:

 53589 gdb151   CALL  ptrace(PT_LWPINFO,0x76ae2,0x8227bb130,0xa0)
 53589 gdb151   RET   ptrace 0
 53589 gdb151   CALL  ptrace(PT_IO,0x76ae2,0x8227bb1b0,0)
 53589 gdb151   RET   ptrace -1 errno 1 Operation not permitted

At the same time, there are no ptrace failures in the dump of the unjailed process.

> BTW, when you say that gdb in jail fails, you do run both the target process
and gdb itself in the same jail, right?

Yep.
Comment 7 Konstantin Belousov freebsd_committer freebsd_triage 2025-04-06 17:08:29 UTC
https://reviews.freebsd.org/D49682
Comment 8 commit-hook freebsd_committer freebsd_triage 2025-04-06 22:14:04 UTC
A commit in branch main references this bug:

URL: https://cgit.FreeBSD.org/src/commit/?id=8ef6d8ad1a61a17cdaed2f5666d5a6904fd0737c

commit 8ef6d8ad1a61a17cdaed2f5666d5a6904fd0737c
Author:     Konstantin Belousov <kib@FreeBSD.org>
AuthorDate: 2025-04-06 16:57:01 +0000
Commit:     Konstantin Belousov <kib@FreeBSD.org>
CommitDate: 2025-04-06 22:13:30 +0000

    jails: delegate checking PRIV_PROC_MEM_WRITE to priv_check_cred()

    PR:     285811
    Fixes:  4a5fa1086184f7450f63d4a8e403b16f40a78fce
    Reviewed by:    markj
    Sponsored by:   The FreeBSD Foundation
    MFC after:      1 week
    Differential revision:  https://reviews.freebsd.org/D49682

 sys/kern/kern_jail.c | 5 +++++
 1 file changed, 5 insertions(+)
Comment 9 Gleb Popov freebsd_committer freebsd_triage 2025-04-07 04:37:20 UTC
Yep, it worked for me too. Thanks!