2 files changed, 60 insertions, 0 deletions

diff --git a/src/common/compat.c b/src/common/compat.c
index 9a2c9d764b..ea95f9f085 100644
--- a/src/common/compat.c
+++ b/src/common/compat.c
@@ -58,6 +58,14 @@
 #endif
 #endif
 
+/* Includes for the process attaching prevention */
+#if defined(HAVE_SYS_PRCTL_H) && defined(__linux__)
+#include <sys/prctl.h>
+#elif defined(__APPLE__)
+#include <sys/types.h>
+#include <sys/ptrace.h>
+#endif
+
 #ifdef HAVE_NETDB_H
 #include <netdb.h>
 #endif
@@ -1519,6 +1527,57 @@ switch_id(const char *user)
 #endif
 }
 
+/* We only use the linux prctl for now. There is no Win32 support; this may
+ * also work on various BSD systems and Mac OS X - send testing feedback!
+ *
+ * On recent Gnu/Linux kernels it is possible to create a system-wide policy
+ * that will prevent non-root processes from attaching to other processes
+ * unless they are the parent process; thus gdb can attach to programs that
+ * they execute but they cannot attach to other processes running as the same
+ * user. The system wide policy may be set with the sysctl
+ * kernel.yama.ptrace_scope or by inspecting
+ * /proc/sys/kernel/yama/ptrace_scope and it is 1 by default on Ubuntu 11.04.
+ *
+ * This ptrace scope will be ignored on Gnu/Linux for users with
+ * CAP_SYS_PTRACE and so it is very likely that root will still be able to
+ * attach to the Tor process.
+ */
+/** Attempt to disable debugger attachment: return 0 on success, -1 on
+ * failure. */
+int
+tor_disable_debugger_attach(void)
+{
+  int r, attempted;
+  r = -1;
+  attempted = 0;
+  log_debug(LD_CONFIG,
+            "Attemping to disable debugger attachment to Tor for "
+            "unprivileged users.");
+#if defined(__linux__) && defined(HAVE_SYS_PRCTL_H) && defined(HAVE_PRCTL)
+#ifdef PR_SET_DUMPABLE
+  attempted = 1;
+  r = prctl(PR_SET_DUMPABLE, 0);
+#endif
+#endif
+#if defined(__APPLE__) && defined(PT_DENY_ATTACH)
+  if (r < 0) {
+    attempted = 1;
+    r = ptrace(PT_DENY_ATTACH, 0, 0, 0);
+  }
+#endif
+
+  // XXX: TODO - Mac OS X has dtrace and this may be disabled.
+  // XXX: TODO - Windows probably has something similar
+  if (r == 0) {
+    log_debug(LD_CONFIG,"Debugger attachment disabled for "
+              "unprivileged users.");
+  } else if (attempted) {
+    log_warn(LD_CONFIG, "Unable to disable ptrace attach: %s",
+             strerror(errno));
+  }
+  return r;
+}
+
 #ifdef HAVE_PWD_H
 /** Allocate and return a string containing the home directory for the
  * user <b>username</b>. Only works on posix-like systems. */
diff --git a/src/common/compat.h b/src/common/compat.h
index b005dd2974..f73e433f0e 100644
--- a/src/common/compat.h
+++ b/src/common/compat.h
@@ -566,6 +566,7 @@ set_uint8(void *cp, uint8_t v)
 typedef unsigned long rlim_t;
 #endif
 int set_max_file_descriptors(rlim_t limit, int *max);
+int tor_disable_debugger_attach(void);
 int switch_id(const char *user);
 #ifdef HAVE_PWD_H
 char *get_user_homedir(const char *username);