CODEWITHSUNDEEP
c++linuxprocessptrace
golobitch
golobitch

Reputation: 1334

Can two process attach to same PID via ptrace

So, the title says it all.

Is it possible that one process has two tracers?

I am playing around with ptrace, and I can see that whenever someone attaches to process, then in /proc//status under TracerPID will be PID of the tracer. However, is it possible to have two tracers?

I have two programs (tracer, and tracee). And I ran tracee in debug mode, and then I ran tracer, and got error Operation not permited (even with root permissions).

Regards, golobich

Upvotes: 3

Views: 1384

Answers (1)

grungegurunge
grungegurunge

Reputation: 891

They can't. It is indirectly confirmed in ptrace man page:

   EPERM  The  specified  process cannot be traced.  This could be because
          the tracer has insufficient privileges (the required  capability
          is  CAP_SYS_PTRACE);  unprivileged  processes  cannot trace pro‐
          cesses that they cannot send signals to or  those  running  set-
          user-ID/set-group-ID  programs,  for  obvious reasons.  Alterna‐
          tively, the process may already be being traced, or (on  kernels
          before 2.6.26) be init(1) (PID 1).

Upvotes: 6

Related Questions