Skip to content

Commit 009e1f1

Browse files
PatKaminPatKamin
committed
Set ptracer permissions for IPC handle creation
Co-authored-by: [email protected]
1 parent 30fada6 commit 009e1f1

File tree

11 files changed

+27
-77
lines changed

11 files changed

+27
-77
lines changed

‎.github/workflows/reusable_basic.yml

Lines changed: 0 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -147,9 +147,6 @@ jobs:
147147
- name: Install libhwloc
148148
run: .github/scripts/install_hwloc.sh
149149

150-
- name: Set ptrace value for IPC test
151-
run: sudo bash -c "echo 0 > /proc/sys/kernel/yama/ptrace_scope"
152-
153150
- name: Configure build
154151
run: >
155152
${{ matrix.compiler.cxx == 'icpx' && '. /opt/intel/oneapi/setvars.sh &&' || ''}}

‎.github/workflows/reusable_fast.yml

Lines changed: 0 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -88,10 +88,6 @@ jobs:
8888
sudo apt-get install -y cmake libnuma-dev libtbb-dev
8989
.github/scripts/install_hwloc.sh # install hwloc-2.3.0 instead of hwloc-2.1.0 present in the OS package
9090
91-
- name: Set ptrace value for IPC test (on Linux only)
92-
if: ${{ matrix.os == 'ubuntu-latest' || matrix.os == 'ubuntu-20.04' }}
93-
run: sudo bash -c "echo 0 > /proc/sys/kernel/yama/ptrace_scope"
94-
9591
- name: Configure CMake
9692
if: matrix.simple_cmake == 'OFF'
9793
run: >

‎.github/workflows/reusable_proxy_lib.yml

Lines changed: 0 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -34,9 +34,6 @@ jobs:
3434
sudo apt-get update
3535
sudo apt-get install -y cmake libhwloc-dev libtbb-dev lcov
3636
37-
- name: Set ptrace value for IPC test
38-
run: sudo bash -c "echo 0 > /proc/sys/kernel/yama/ptrace_scope"
39-
4037
- name: Configure build
4138
run: >
4239
cmake

‎.github/workflows/reusable_sanitizers.yml

Lines changed: 0 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -40,10 +40,6 @@ jobs:
4040
sudo apt-get update
4141
sudo apt-get install -y intel-oneapi-ippcp-devel intel-oneapi-ipp-devel intel-oneapi-common-oneapi-vars intel-oneapi-compiler-dpcpp-cpp
4242
43-
44-
- name: Set ptrace value for IPC test
45-
run: sudo bash -c "echo 0 > /proc/sys/kernel/yama/ptrace_scope"
46-
4743
- name: Configure build
4844
run: >
4945
${{ matrix.compiler.cxx == 'icpx' && '. /opt/intel/oneapi/setvars.sh &&' || ''}}

‎README.md

Lines changed: 3 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -155,12 +155,7 @@ IPC API requires the `UMF_MEM_MAP_SHARED` memory `visibility` mode
155155
IPC API uses the file descriptor duplication. It requires using `pidfd_getfd(2)` to obtain
156156
a duplicate of another process's file descriptor (`pidfd_getfd(2)` is supported since Linux 5.6).
157157
Permission to duplicate another process's file descriptor is governed by a ptrace access mode
158-
`PTRACE_MODE_ATTACH_REALCREDS` check (see `ptrace(2)`) that can be changed using
159-
the `/proc/sys/kernel/yama/ptrace_scope` interface in the following way:
160-
161-
```sh
162-
$ sudo bash -c "echo 0 > /proc/sys/kernel/yama/ptrace_scope"
163-
```
158+
`PTRACE_MODE_ATTACH_REALCREDS` check (see `ptrace(2)`). UMF calls `prctl()` to allow the UMF process to be ptraced by other processes.
164159

165160
There are available two mechanisms for the shared memory mapping:
166161
1) a named shared memory object (used if the `shm_name` parameter is not NULL) or
@@ -187,12 +182,7 @@ A memory provider that provides memory from L0 device.
187182
IPC API uses the file descriptor duplication. It requires using `pidfd_getfd(2)` to obtain
188183
a duplicate of another process's file descriptor (`pidfd_getfd(2)` is supported since Linux 5.6).
189184
Permission to duplicate another process's file descriptor is governed by a ptrace access mode
190-
`PTRACE_MODE_ATTACH_REALCREDS` check (see `ptrace(2)`) that can be changed using
191-
the `/proc/sys/kernel/yama/ptrace_scope` interface in the following way:
192-
193-
```sh
194-
$ sudo bash -c "echo 0 > /proc/sys/kernel/yama/ptrace_scope"
195-
```
185+
`PTRACE_MODE_ATTACH_REALCREDS` check (see `ptrace(2)`). UMF calls `prctl()` to allow the UMF process to be ptraced by other processes.
196186

197187
##### Requirements
198188

@@ -345,7 +335,7 @@ The memory used by the proxy memory allocator is mmap'ed:
345335
1) with the `MAP_PRIVATE` flag by default or
346336
2) with the `MAP_SHARED` flag if the `UMF_PROXY` environment variable contains one of two following strings: `page.disposition=shared-shm` or `page.disposition=shared-fd`. These two options differ in a mechanism used during IPC:
347337
- `page.disposition=shared-shm` - IPC uses the named shared memory. An SHM name is generated using the `umf_proxy_lib_shm_pid_$PID` pattern, where `$PID` is the PID of the process. It creates the `/dev/shm/umf_proxy_lib_shm_pid_$PID` file.
348-
- `page.disposition=shared-fd` - IPC uses the file descriptor duplication. It requires using `pidfd_getfd(2)` to obtain a duplicate of another process's file descriptor. Permission to duplicate another process's file descriptor is governed by a ptrace access mode `PTRACE_MODE_ATTACH_REALCREDS` check (see `ptrace(2)`) that can be changed using the `/proc/sys/kernel/yama/ptrace_scope` interface. `pidfd_getfd(2)` is supported since Linux 5.6.
338+
- `page.disposition=shared-fd` - IPC uses the file descriptor duplication. It requires using `pidfd_getfd(2)` to obtain a duplicate of another process's file descriptor. Permission to duplicate another process's file descriptor is governed by a ptrace access mode `PTRACE_MODE_ATTACH_REALCREDS` check (see `ptrace(2)`). UMF calls `prctl()` to allow the UMF process to be ptraced by other processes. `pidfd_getfd(2)` is supported since Linux 5.6.
349339

350340
**Size threshold**
351341

‎examples/ipc_ipcapi/ipc_ipcapi_anon_fd.sh

Lines changed: 0 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -12,21 +12,6 @@ set -e
1212
# port should be a number from the range <1024, 65535>
1313
PORT=$(( 1024 + ( $$ % ( 65535 - 1024 ))))
1414

15-
# The ipc_ipcapi_anon_fd example requires using pidfd_getfd(2)
16-
# to obtain a duplicate of another process's file descriptor.
17-
# Permission to duplicate another process's file descriptor
18-
# is governed by a ptrace access mode PTRACE_MODE_ATTACH_REALCREDS check (see ptrace(2))
19-
# that can be changed using the /proc/sys/kernel/yama/ptrace_scope interface.
20-
PTRACE_SCOPE_FILE="/proc/sys/kernel/yama/ptrace_scope"
21-
VAL=0
22-
if [ -f $PTRACE_SCOPE_FILE ]; then
23-
PTRACE_SCOPE_VAL=$(cat $PTRACE_SCOPE_FILE)
24-
if [ $PTRACE_SCOPE_VAL -ne $VAL ]; then
25-
echo "SKIP: ptrace_scope is not set to 0 (classic ptrace permissions) - skipping the test"
26-
exit 125 # skip code defined in CMakeLists.txt
27-
fi
28-
fi
29-
3015
UMF_LOG_VAL="level:debug;flush:debug;output:stderr;pid:yes"
3116

3217
echo "Starting ipc_ipcapi_anon_fd CONSUMER on port $PORT ..."

‎scripts/qemu/run-tests.sh

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -23,8 +23,6 @@ UMF_DIR=$(pwd)
2323
# Drop caches, restores free memory on NUMA nodes
2424
echo password | sudo sync;
2525
echo password | sudo sh -c "/usr/bin/echo 3 > /proc/sys/vm/drop_caches"
26-
# Set ptrace value for IPC test
27-
echo password | sudo bash -c "echo 0 > /proc/sys/kernel/yama/ptrace_scope"
2826

2927
numactl -H
3028

‎src/libumf.c

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -8,6 +8,12 @@
88
*/
99

1010
#include <stddef.h>
11+
#ifdef __linux__
12+
#include <errno.h>
13+
#include <string.h>
14+
#include <sys/prctl.h>
15+
#include <unistd.h>
16+
#endif
1117

1218
#include "base_alloc_global.h"
1319
#include "ipc_cache.h"
@@ -34,6 +40,24 @@ int umfInit(void) {
3440

3541
LOG_DEBUG("UMF tracker created");
3642

43+
#ifdef __linux__
44+
// The prctl() function with PR_SET_PTRACER is used here to allow other processes to ptrace
45+
// the current process. This is necessary because UMF's memory providers on Linux (except CUDA)
46+
// use the pidfd_getfd(2) system call to duplicate another process's file descriptor, which is
47+
// governed by ptrace permissions. By default, on Ubuntu, /proc/sys/kernel/yama/ptrace_scope is
48+
// set to 1 ("restricted ptrace"), which prevents pidfd_getfd from working unless ptrace_scope
49+
// is set to 0. To overcome this limitation without requiring users to change the ptrace_scope
50+
// setting, we use prctl(PR_SET_PTRACER, pid) to allow the process that creates the IPC handle
51+
// to be ptraced by other processes, even when ptrace_scope is 1.
52+
int res = prctl(PR_SET_PTRACER, getppid());
53+
if (res != 0) {
54+
LOG_ERR("Failed to set ptracer permissions for IPC use");
55+
LOG_ERR("prctl() returned errno %d (%s)", errno, strerror(errno));
56+
return -1;
57+
}
58+
LOG_DEBUG("Ptracer permissions set for IPC use");
59+
#endif
60+
3761
umf_result_t umf_result = umfIpcCacheGlobalInit();
3862
if (umf_result != UMF_RESULT_SUCCESS) {
3963
LOG_ERR("Failed to initialize IPC cache");

‎src/utils/utils_posix_common.c

Lines changed: 0 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -91,9 +91,6 @@ umf_result_t utils_duplicate_fd(int pid, int fd_in, int *fd_out) {
9191
return UMF_RESULT_ERROR_NOT_SUPPORTED;
9292
#else
9393
// pidfd_getfd(2) is used to obtain a duplicate of another process's file descriptor.
94-
// Permission to duplicate another process's file descriptor
95-
// is governed by a ptrace access mode PTRACE_MODE_ATTACH_REALCREDS check (see ptrace(2))
96-
// that can be changed using the /proc/sys/kernel/yama/ptrace_scope interface.
9794
// pidfd_getfd(2) is supported since Linux 5.6
9895
// pidfd_open(2) is supported since Linux 5.3
9996
errno = 0;

‎test/ipc_os_prov_anon_fd.sh

Lines changed: 0 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -12,21 +12,6 @@ set -e
1212
# port should be a number from the range <1024, 65535>
1313
PORT=$(( 1024 + ( $$ % ( 65535 - 1024 ))))
1414

15-
# The ipc_os_prov_anon_fd example requires using pidfd_getfd(2)
16-
# to obtain a duplicate of another process's file descriptor.
17-
# Permission to duplicate another process's file descriptor
18-
# is governed by a ptrace access mode PTRACE_MODE_ATTACH_REALCREDS check (see ptrace(2))
19-
# that can be changed using the /proc/sys/kernel/yama/ptrace_scope interface.
20-
PTRACE_SCOPE_FILE="/proc/sys/kernel/yama/ptrace_scope"
21-
VAL=0
22-
if [ -f $PTRACE_SCOPE_FILE ]; then
23-
PTRACE_SCOPE_VAL=$(cat $PTRACE_SCOPE_FILE)
24-
if [ $PTRACE_SCOPE_VAL -ne $VAL ]; then
25-
echo "SKIP: ptrace_scope is not set to 0 (classic ptrace permissions) - skipping the test"
26-
exit 125 # skip code defined in CMakeLists.txt
27-
fi
28-
fi
29-
3015
UMF_LOG_VAL="level:debug;flush:debug;output:stderr;pid:yes"
3116

3217
echo "Starting ipc_os_prov_anon_fd CONSUMER on port $PORT ..."

‎test/providers/ipc_level_zero_prov.sh

Lines changed: 0 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -12,21 +12,6 @@ set -e
1212
# port should be a number from the range <1024, 65535>
1313
PORT=$(( 1024 + ( $$ % ( 65535 - 1024 ))))
1414

15-
# The ipc_level_zero_prov test requires using pidfd_getfd(2)
16-
# to obtain a duplicate of another process's file descriptor.
17-
# Permission to duplicate another process's file descriptor
18-
# is governed by a ptrace access mode PTRACE_MODE_ATTACH_REALCREDS check (see ptrace(2))
19-
# that can be changed using the /proc/sys/kernel/yama/ptrace_scope interface.
20-
PTRACE_SCOPE_FILE="/proc/sys/kernel/yama/ptrace_scope"
21-
VAL=0
22-
if [ -f $PTRACE_SCOPE_FILE ]; then
23-
PTRACE_SCOPE_VAL=$(cat $PTRACE_SCOPE_FILE)
24-
if [ $PTRACE_SCOPE_VAL -ne $VAL ]; then
25-
echo "SKIP: ptrace_scope is not set to 0 (classic ptrace permissions) - skipping the test"
26-
exit 125 # skip code defined in CMakeLists.txt
27-
fi
28-
fi
29-
3015
UMF_LOG_VAL="level:debug;flush:debug;output:stderr;pid:yes"
3116

3217
echo "Starting ipc_level_zero_prov CONSUMER on port $PORT ..."

0 commit comments

Comments
 (0)