Since version 11.04 Ubuntu is affected by "security hard lining"
(for example see 
https://wiki.ubuntu.com/SecurityTeam/Roadmap/KernelHardening#ptrace%20Protection)
which results in a buggy system. Some functions which worked on 
earlier versions (and should work further on like on other Unix systems)
do not work on this system. One of these things is the handling of
sub-processes, which in general do not work in a reliable way since
Ubuntu 11.10. This security nonsense affects many applications, Scidb
is one of these. One solution is that the user works with superuser
rights, but normally you don't like this because with superuser rights
you'll loose all security you want. Another solution is to fix the
security problems (for Ubuntu 11.10, taken from
http://blog.mellenthin.de/archives/2010/10/18/gdb-attach-fails-with-ptrace-operation-not-permitted/#comment-141535):


  And the solution is just either do this (as root):

  $ echo 0 > /proc/sys/kernel/yama/ptrace_scope
  (after every system start)

  …or make it permanent by setting ptrace_scope to 0 in
  /etc/sysctl.d/10-ptrace.conf


With this fix Scidb should work as expected. There exists no real way
for a developer to work around this problem.

For people with technical interest: Scidb is internally calling gdb
for stack back-tracing in case of an internal error. gdb tries to attach
to Scidb's process, but fails due to the call of ptrace(); this function
does not work anymore without superuser rights, this means that the
call of gdb is not working anymore without superuser rights, even for
its own process - obviously this is nonsense. The fix above gives
ptrace() normal user rights.

By the way: Since Ubuntu 11.04 it isn't possible for developers to build
applications in a normal way on this system. The configure script of
Scidb is full of hacks only for Ubuntu >= 11.04.

In my opinion it is a good choice to look for a serious distributor,
since version 11.04 Ubuntu isn't a serious distributor anymore.
(It seems that the whole Debian line is affected; Debian is calling this
"Kernel Hardening"; I think this nonsense is only satisfying paranoid
people.)
-- 
Gregor Cramer
email: <[email protected]>


Reply via email to