Turn the ptrace(2) syscall into a kernel compile option, option PTRACE in

your kernel configuration file.
By default, GENERIC will enable this.

When PTRACE is not enabled, several ptrace-like features of the procfs
filesystem will be disabled as well (namely, the ability to read and write
any process' registers, as well as attching, single stepping and detaching
to/from processes).

This should help paranoid people build better sandboxens, and us to build
smaller ramdisks.

10 files changed, 44 insertions, 18 deletions

diff --git a/sys/compat/bsdos/syscalls.master b/sys/compat/bsdos/syscalls.master
index a5330202bb1..5c24913ca64 100644
--- a/sys/compat/bsdos/syscalls.master
+++ b/sys/compat/bsdos/syscalls.master
@@ -1,4 +1,4 @@
-	$OpenBSD: syscalls.master,v 1.8 2001/05/16 17:14:37 millert Exp $
+	$OpenBSD: syscalls.master,v 1.9 2002/03/14 00:42:24 miod Exp $
 
 ; OpenBSD COMPAT_BSDOS system call name/number "master" file.
 ; (See syscalls.conf to see what it is processed into.)
@@ -74,8 +74,12 @@
 23	NOARGS		{ int sys_setuid(uid_t uid); }
 24	NOARGS		{ uid_t sys_getuid(void); }
 25	NOARGS		{ uid_t sys_geteuid(void); }
+#ifdef PTRACE
 26	NOARGS		{ int sys_ptrace(int req, pid_t pid, \
 			    caddr_t addr, int data); }
+#else
+26	UNIMPL		ptrace
+#endif
 27	NOARGS		{ int sys_recvmsg(int s, struct msghdr *msg, \
 			    int flags); }
 28	NOARGS		{ int sys_sendmsg(int s, caddr_t msg, int flags); }
diff --git a/sys/compat/freebsd/files.freebsd b/sys/compat/freebsd/files.freebsd
index 1382efaddfa..74f4a56a627 100644
--- a/sys/compat/freebsd/files.freebsd
+++ b/sys/compat/freebsd/files.freebsd
@@ -1,4 +1,4 @@
-#	$OpenBSD: files.freebsd,v 1.4 2001/02/02 19:48:07 tholo Exp $
+#	$OpenBSD: files.freebsd,v 1.5 2002/03/14 00:42:25 miod Exp $
 #	$NetBSD: files.freebsd,v 1.1 1995/10/10 01:19:26 mycroft Exp $
 #
 # Config.new file description for machine-independent FreeBSD compat code.
@@ -11,7 +11,7 @@ file	compat/freebsd/freebsd_exec.c		compat_freebsd
 file	compat/freebsd/freebsd_file.c		compat_freebsd
 file	compat/freebsd/freebsd_ioctl.c		compat_freebsd
 file	compat/freebsd/freebsd_misc.c		compat_freebsd
-file	compat/freebsd/freebsd_ptrace.c		compat_freebsd
+file	compat/freebsd/freebsd_ptrace.c		compat_freebsd & ptrace
 file	compat/freebsd/freebsd_signal.c		compat_freebsd
 file	compat/freebsd/freebsd_sysent.c		compat_freebsd
 file	compat/freebsd/freebsd_syscalls.c	compat_freebsd & syscall_debug
diff --git a/sys/compat/freebsd/syscalls.master b/sys/compat/freebsd/syscalls.master
index d85b265c851..141cb998d52 100644
--- a/sys/compat/freebsd/syscalls.master
+++ b/sys/compat/freebsd/syscalls.master
@@ -1,4 +1,4 @@
-	$OpenBSD: syscalls.master,v 1.16 2001/11/27 19:34:20 maja Exp $
+	$OpenBSD: syscalls.master,v 1.17 2002/03/14 00:42:25 miod Exp $
 ;	$NetBSD: syscalls.master,v 1.3 1995/10/10 18:28:40 mycroft Exp $
 
 ;	from: @(#)syscalls.master	8.2 (Berkeley) 1/13/94
@@ -82,8 +82,12 @@
 23	NOARGS		{ int sys_setuid(uid_t uid); }
 24	NOARGS		{ uid_t sys_getuid(void); }
 25	NOARGS		{ uid_t sys_geteuid(void); }
+#ifdef PTRACE
 26	STD		{ int freebsd_sys_ptrace(int req, pid_t pid, \
 			    caddr_t addr, int data); }
+#else
+26	UNIMPL		ptrace
+#endif
 27	NOARGS		{ int sys_recvmsg(int s, struct msghdr *msg, \
 			    int flags); }
 28	NOARGS		{ int sys_sendmsg(int s, caddr_t msg, int flags); }
diff --git a/sys/compat/hpux/hpux_compat.c b/sys/compat/hpux/hpux_compat.c
index 38ea2345357..62829642fd7 100644
--- a/sys/compat/hpux/hpux_compat.c
+++ b/sys/compat/hpux/hpux_compat.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: hpux_compat.c,v 1.16 2002/02/13 19:08:06 art Exp $	*/
+/*	$OpenBSD: hpux_compat.c,v 1.17 2002/03/14 00:42:25 miod Exp $	*/
 /*	$NetBSD: hpux_compat.c,v 1.35 1997/05/08 16:19:48 mycroft Exp $	*/
 
 /*
@@ -553,6 +553,8 @@ hpux_sys_rtprio(cp, v, retval)
 
 /* hpux_sys_advise() is found in hpux_machdep.c */
 
+#ifdef PTRACE
+
 int
 hpux_sys_ptrace(p, v, retval)
 	struct proc *p;
@@ -630,6 +632,8 @@ hpux_sys_ptrace(p, v, retval)
 	return (error);
 }
 
+#endif	/* PTRACE */
+
 #ifdef SYSVSHM
 #include <sys/shm.h>
 
diff --git a/sys/compat/hpux/syscalls.master b/sys/compat/hpux/syscalls.master
index cee4bdeb548..89c44c345b9 100644
--- a/sys/compat/hpux/syscalls.master
+++ b/sys/compat/hpux/syscalls.master
@@ -1,4 +1,4 @@
-	$OpenBSD: syscalls.master,v 1.7 2001/10/10 23:43:44 art Exp $
+	$OpenBSD: syscalls.master,v 1.8 2002/03/14 00:42:25 miod Exp $
 ;	$NetBSD: syscalls.master,v 1.13 1997/03/16 03:48:04 thorpej Exp $
 
 ;	@(#)syscalls.master	8.1 (Berkeley) 7/19/93
@@ -72,8 +72,12 @@
 23	NOARGS		{ int sys_setuid(uid_t uid); }
 24	NOARGS		{ uid_t sys_getuid(void); }
 25	STD		{ int hpux_sys_stime_6x(int time); }
+#ifdef PTRACE
 26	STD		{ int hpux_sys_ptrace(int req, int pid, int *addr, \
 			    int data); }
+#else
+26	UNIMPL		ptrace
+#endif
 27	STD		{ int hpux_sys_alarm_6x(int deltat); }
 28	STD		{ int hpux_sys_fstat_6x(int fd, \
 			    struct hpux_ostat *sb); }
diff --git a/sys/compat/linux/linux_dummy.c b/sys/compat/linux/linux_dummy.c
index 1e3d7c6247a..5f91d36b9c4 100644
--- a/sys/compat/linux/linux_dummy.c
+++ b/sys/compat/linux/linux_dummy.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: linux_dummy.c,v 1.6 2002/02/04 20:04:52 provos Exp $ */
+/*	$OpenBSD: linux_dummy.c,v 1.7 2002/03/14 00:42:25 miod Exp $ */
 
 /*-
  * Copyright (c) 1994-1995 Søren Schmidt
@@ -57,7 +57,9 @@ unsupported_msg(struct proc *p, const char *fname)
 }
 
 DUMMY(ostat);			/* #18 */
+#ifdef PTRACE
 DUMMY(ptrace);			/* #26 */
+#endif
 DUMMY(ofstat);			/* #28 */
 DUMMY(stty);			/* #31 */
 DUMMY(gtty);			/* #32 */
diff --git a/sys/compat/linux/syscalls.master b/sys/compat/linux/syscalls.master
index 4f82d6dffd6..14983087f82 100644
--- a/sys/compat/linux/syscalls.master
+++ b/sys/compat/linux/syscalls.master
@@ -1,4 +1,4 @@
-	$OpenBSD: syscalls.master,v 1.32 2002/02/04 20:04:52 provos Exp $
+	$OpenBSD: syscalls.master,v 1.33 2002/03/14 00:42:25 miod Exp $
 ;	$NetBSD: syscalls.master,v 1.15 1995/12/18 14:35:10 fvdl Exp $
 
 ;	@(#)syscalls.master	8.1 (Berkeley) 7/19/93
@@ -75,7 +75,11 @@
 23	NOARGS		linux_setuid16 { int sys_setuid(uid_t uid); }
 24	NOARGS		linux_getuid16 { uid_t sys_getuid(void); }
 25	STD		{ int linux_sys_stime(linux_time_t *t); }
+#ifdef PTRACE
 26	STD		{ int linux_sys_ptrace(void); }
+#else
+26	UNIMPL		ptrace
+#endif
 27	STD		{ int linux_sys_alarm(unsigned int secs); }
 28	STD		{ int linux_sys_ofstat(void); }
 29	STD		{ int linux_sys_pause(void); }
diff --git a/sys/compat/netbsd/syscalls.master b/sys/compat/netbsd/syscalls.master
index abcd8685088..23e58808cb2 100644
--- a/sys/compat/netbsd/syscalls.master
+++ b/sys/compat/netbsd/syscalls.master
@@ -1,4 +1,4 @@
-;	$OpenBSD: syscalls.master,v 1.15 2001/09/21 15:31:59 art Exp $
+;	$OpenBSD: syscalls.master,v 1.16 2002/03/14 00:42:25 miod Exp $
 
 ;	@(#)syscalls.master	8.2 (Berkeley) 1/13/94
 
@@ -92,8 +92,12 @@
 23	NOARGS		{ int sys_setuid(uid_t uid); }
 24	NOARGS		{ uid_t sys_getuid(void); }
 25	NOARGS		{ uid_t sys_geteuid(void); }
+#ifdef PTRACE
 26	NOARGS		{ int sys_ptrace(int req, pid_t pid, caddr_t addr, \
 			    int data); }
+#else
+26	UNIMPL		ptrace
+#endif
 27	NOARGS		{ ssize_t sys_recvmsg(int s, struct msghdr *msg, \
 			    int flags); }
 28	NOARGS		{ ssize_t sys_sendmsg(int s, \
diff --git a/sys/compat/sunos/sunos_misc.c b/sys/compat/sunos/sunos_misc.c
index 4efd5a60136..424802ab271 100644
--- a/sys/compat/sunos/sunos_misc.c
+++ b/sys/compat/sunos/sunos_misc.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: sunos_misc.c,v 1.34 2002/02/13 19:08:06 art Exp $	*/
+/*	$OpenBSD: sunos_misc.c,v 1.35 2002/03/14 00:42:25 miod Exp $	*/
 /*	$NetBSD: sunos_misc.c,v 1.65 1996/04/22 01:44:31 christos Exp $	*/
 
 /*
@@ -994,13 +994,7 @@ sunos_sys_setrlimit(p, v, retval)
 	return compat_43_sys_setrlimit(p, uap, retval);
 }
 
-/* for the m68k machines */
-#ifndef PT_GETFPREGS
-#define PT_GETFPREGS -1
-#endif
-#ifndef PT_SETFPREGS
-#define PT_SETFPREGS -1
-#endif
+#ifdef PTRACE
 
 static int sreq2breq[] = {
 	PT_TRACE_ME,    PT_READ_I,      PT_READ_D,      -1,
@@ -1037,6 +1031,8 @@ sunos_sys_ptrace(p, v, retval)
 	return sys_ptrace(p, &pa, retval);
 }
 
+#endif	/* PTRACE */
+
 /*
  * SunOS reboot system call (for compatibility).
  * Sun lets you pass in a boot string which the PROM
diff --git a/sys/compat/sunos/syscalls.master b/sys/compat/sunos/syscalls.master
index fe1fe06e37c..fa7f6bc731c 100644
--- a/sys/compat/sunos/syscalls.master
+++ b/sys/compat/sunos/syscalls.master
@@ -1,4 +1,4 @@
-	$OpenBSD: syscalls.master,v 1.11 1999/06/07 07:17:48 deraadt Exp $
+	$OpenBSD: syscalls.master,v 1.12 2002/03/14 00:42:25 miod Exp $
 ;	$NetBSD: syscalls.master,v 1.33 1996/02/28 16:05:43 pk Exp $
 
 ;	@(#)syscalls.master	8.1 (Berkeley) 7/19/93
@@ -69,8 +69,12 @@
 23	NOARGS		{ int sys_setuid(uid_t uid); }
 24	NOARGS		{ uid_t sys_getuid(void); }
 25	STD		{ int sunos_sys_ostime(int time); }
+#ifdef PTRACE
 26	STD		{ long sunos_sys_ptrace(int req, pid_t pid, \
 			    caddr_t addr, int data, char *addr2); }
+#else
+26	UNIMPL		sunos_ptrace
+#endif
 27	UNIMPL		sunos_alarm
 28	UNIMPL		sunos_fstat
 29	UNIMPL		sunos_pause