Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Document & improve backtracing under isolation #133

Open
LekKit opened this issue Sep 4, 2024 · 0 comments
Open

Document & improve backtracing under isolation #133

LekKit opened this issue Sep 4, 2024 · 0 comments

Comments

@LekKit
Copy link

LekKit commented Sep 4, 2024

What?

Some programs are enforcing runtime isolation upon themselves at some point in their runtime (Via seccomp, pledge, landlock, etc).
This usually involves preventing any access to the host filesystem, and some other elaborate ways to limit interaction with the rest of the system and contain any possible vulnerability.

Such programs may wish to still be able to perform symbolized backtraces after isolation has been enforced. My RVVM project is one example, but there are likely more.
This requires that no FS access is done when backtracing, and all debug/stack unwinding information is preloaded at initialization stage somewhere early before isolation is enforced.

Currently it is possible to work around this by issuing a dummy symbolized stacktrace at initialization stage, which doesn't need to be visible to the user. This at least works on Linux with seccomp:

https://github.com/LekKit/RVVM/blob/b87a8ab9052e2063297a1cd6aa1a981d5a56e90a/src/stacktrace.c#L126

However, I have not tested that it works under OpenBSD + pledge.

It would be nice if libbacktrace explicitly documented it's behavior in regard to filesystem access and potentially unavailable syscalls.
Additionally, it should explicitly preload all debug/unwind information on backtrace_create_state() call without need to perform dunny backtrace workaround, or introduce backtrace_preload_debug_info() call which should be called after all shared libraries of interest are loaded.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant