Bug#921404: gdb: can't debug kdesu (cannot find user-level thread ...)

[Bernhard Übelacker]

Hello Jiri Palecek,
I could reproduce this issue also on amd64.

It looks intentional and seems like a security consideration
to make no crash dumps and is caused by this line:

kdesu.cpp:83:  prctl(PR_SET_DUMPABLE, 0);

However, you may temporarily add SUID to gdb, then gdb
will run as root and, as far as I see, kdesu still as user.
And the desired breakpoint can be reached.
Attached file demonstrates this.

Kind regards,
Bernhard

# Buster i386 qemu VM 2019-02-07

apt update
apt dist-upgrade

apt install dpkg-dev devscripts xserver-xorg sddm plasma-desktop gdb 
kde-cli-tools kde-cli-tools-dbgsym

reboot



mkdir source/kde-cli-tools/orig -p
cdsource/kde-cli-tools/orig
apt source kde-cli-tools
cd


mkdir source/libc6/orig -p
cdsource/libc6/orig
apt source libc6
cd


export DISPLAY=:0
gdb -q \
-ex 'set width 0' \
-ex 'set pagination off' \
-ex 'directory 
/home/benutzer/source/kde-cli-tools/orig/kde-cli-tools-5.14.5/kdesu' \
-ex 'directory /home/benutzer/source/libc6/orig/glibc-2.28/sysdeps' \
-ex 'b main' \
-ex 'b SuProcess::exec' \
--args /usr/lib/i386-linux-gnu/libexec/kf5/kdesu ls


###



benutzer@debian:~$ gdb -q \
> -ex 'set width 0' \
> -ex 'set pagination off' \
> -ex 'directory 
> /home/benutzer/source/kde-cli-tools/orig/kde-cli-tools-5.14.5/kdesu' \
> -ex 'directory /home/benutzer/source/libc6/orig/glibc-2.28/sysdeps' \
> -ex 'b main' \
> -ex 'b SuProcess::exec' \
> --args /usr/lib/i386-linux-gnu/libexec/kf5/kdesu ls
Reading symbols from /usr/lib/i386-linux-gnu/libexec/kf5/kdesu...Reading 
symbols from 
/usr/lib/debug/.build-id/d8/59440907cb9b64a346797293b75d544beba51c.debug...done.
done.
Source directories searched: 
/home/benutzer/source/kde-cli-tools/orig/kde-cli-tools-5.14.5/kdesu:$cdir:$cwd
Source directories searched: 
/home/benutzer/source/libc6/orig/glibc-2.28/sysdeps:/home/benutzer/source/kde-cli-tools/orig/kde-cli-tools-5.14.5/kdesu:$cdir:$cwd
Breakpoint 1 at 0x4a70: file ./kdesu/kdesu.cpp, line 80.
Breakpoint 2 at 0x4540
(gdb) run
Starting program: /usr/lib/i386-linux-gnu/libexec/kf5/kdesu ls
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib/i386-linux-gnu/libthread_db.so.1".

Breakpoint 1, main (argc=2, argv=0xb654) at ./kdesu/kdesu.cpp:80
80  {
(gdb) next
83  prctl(PR_SET_DUMPABLE, 0);
(gdb) step
prctl () at ../sysdeps/unix/syscall-template.S:78
78  T_PSEUDO (SYSCALL_SYMBOL, SYSCALL_NAME, SYSCALL_NARGS)
(gdb) display/i $pc
1: x/i $pc
=> 0xb67d0e50 :  push   %edi
(gdb) stepi
0xb67d0e51  78  T_PSEUDO (SYSCALL_SYMBOL, SYSCALL_NAME, SYSCALL_NARGS)
1: x/i $pc
=> 0xb67d0e51 :push   %esi
(gdb) 
0xb67d0e52  78  T_PSEUDO (SYSCALL_SYMBOL, SYSCALL_NAME, SYSCALL_NARGS)
1: x/i $pc
=> 0xb67d0e52 :push   %ebx
(gdb) 
0xb67d0e53  78  T_PSEUDO (SYSCALL_SYMBOL, SYSCALL_NAME, SYSCALL_NARGS)
1: x/i $pc
=> 0xb67d0e53 :mov0x20(%esp),%edi
(gdb) 
0xb67d0e57  78  T_PSEUDO (SYSCALL_SYMBOL, SYSCALL_NAME, SYSCALL_NARGS)
1: x/i $pc
=> 0xb67d0e57 :mov0x1c(%esp),%esi
(gdb) 
0xb67d0e5b  78  T_PSEUDO (SYSCALL_SYMBOL, SYSCALL_NAME, SYSCALL_NARGS)
1: x/i $pc
=> 0xb67d0e5b :   mov0x18(%esp),%edx
(gdb) 
0xb67d0e5f  78  T_PSEUDO (SYSCALL_SYMBOL, SYSCALL_NAME, SYSCALL_NARGS)
1: x/i $pc
=> 0xb67d0e5f :   mov0x14(%esp),%ecx
(gdb) 
0xb67d0e63  78  T_PSEUDO (SYSCALL_SYMBOL, SYSCALL_NAME, SYSCALL_NARGS)
1: x/i $pc
=> 0xb67d0e63 :   mov0x10(%esp),%ebx
(gdb) 
0xb67d0e67  78  T_PSEUDO (SYSCALL_SYMBOL, SYSCALL_NAME, SYSCALL_NARGS)
1: x/i $pc
=> 0xb67d0e67 :   mov$0xac,%eax
(gdb) 
0xb67d0e6c  78  T_PSEUDO (SYSCALL_SYMBOL, SYSCALL_NAME, SYSCALL_NARGS)
1: x/i $pc
=> 0xb67d0e6c :   call   *%gs:0x10
(gdb) 
0xb7fd4d68 in __kernel_vsyscall ()
1: x/i $pc
=> 0xb7fd4d68 <__kernel_vsyscall>:  push   %ecx
(gdb) 
0xb7fd4d69 in __kernel_vsyscall ()
1: x/i $pc
=> 0xb7fd4d69 <__kernel_vsyscall+1>:push   %edx
(gdb) 
0xb7fd4d6a in __kernel_vsyscall ()
1: x/i $pc
=> 0xb7fd4d6a <__kernel_vsyscall+2>:push   %ebp
(gdb) 
0xb7fd4d6b in __kernel_vsyscall ()
1: x/i $pc
=> 0xb7fd4d6b <__kernel_vsyscall+3>:mov%esp,%ebp
(gdb) 
0xb7fd4d6d in __kernel_vsyscall ()
1: x/i $pc
=> 0xb7fd4d6d <__kernel_vsyscall+5>:sysenter 
(gdb) bt
#0  0xb7fd4d6d in __kernel_vsyscall ()
#1  0xb67d0e73 in prctl () at ../sysdeps/unix/syscall-template.S:78
#2  0x00404aab in main (argc=, argv=0xb654) at 
./kdesu/kdesu.cpp:83
(gdb) stepi

[1]+  Angehalten  gdb -q -ex 'set width 0' -ex 'set pagination off' 
-ex 'directory 
/home/benutzer/source/kde-cli-tools/orig/kde-cli-tools-5.14.5/kdesu' -ex 
'directory /home/benutzer/source/libc6/orig/glibc-2.28/sysdeps' -ex 'b main' 
-ex 'b SuProcess::exec' --args /usr/lib/i386-linux-gnu/libexec/kf5/kdesu ls



root@debian:~# ps aux | grep -E "gdb|kdesu"
benutzer 14748  1.1  2.7  94280 83116 pts/1T11:42   0:00 gdb -q -ex 

Bug#921404: gdb: can't debug kdesu (cannot find user-level thread ...)

[Jiri Palecek]

Package: gdb
Version: 8.0-1
Severity: normal

Dear Maintainer,

I have problems debugging kdesu with gdb. Debugging fails with this
message:

$ gdb /usr/lib/i386-linux-gnu/libexec/kf5/kdesu
GNU gdb (Debian 8.1-4+b1) 8.1
Copyright (C) 2018 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later 
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.  Type "show copying"
and "show warranty" for details.
This GDB was configured as "i686-linux-gnu".
Type "show configuration" for configuration details.
For bug reporting instructions, please see:
.
Find the GDB manual and other documentation resources online at:
.
For help, type "help".
Type "apropos word" to search for commands related to "word"...
Reading symbols from /usr/lib/i386-linux-gnu/libexec/kf5/kdesu...Reading 
symbols from 
/usr/lib/debug/.build-id/d8/59440907cb9b64a346797293b75d544beba51c.debug...done.
done.
(gdb) break SuProcess::exec
Breakpoint 1 at 0x4540
(gdb) run ls
Starting program: /usr/lib/i386-linux-gnu/libexec/kf5/kdesu ls
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib/i386-linux-gnu/libthread_db.so.1".
Cannot find user-level thread for LWP 7254: generic error

I have tried googling for some solutions, but found nothing that turned
out to be of value. Also, all reports of similar problems turned out to
be rather old.

Please note that kdesu is normal program, not suid or something.

Regards
Jiri Palecek

-- System Information:
Debian Release: buster/sid
  APT prefers testing
  APT policy: (990, 'testing'), (500, 'unstable-debug'), (500, 
'testing-debug'), (500, 'unstable'), (1, 'experimental-debug'), (1, 
'experimental')
Architecture: i386 (i686)

Kernel: Linux 4.20.0-trunk-686-pae (SMP w/2 CPU cores)
Locale: LANG=cs_CZ, LC_CTYPE=cs_CZ (charmap=ISO-8859-2), LANGUAGE=cs_CZ 
(charmap=ISO-8859-2)
Shell: /bin/sh linked to /bin/dash
Init: systemd (via /run/systemd/system)

Versions of packages gdb depends on:
pn  libbabeltrace-ctf1  
ii  libbabeltrace1  1.5.6-1
ii  libc6   2.28-4
ii  libexpat1   2.2.6-1
ii  liblzma55.2.2-1.3
pn  libncurses5 
pn  libpython3.5
ii  libreadline77.0-5
pn  libtinfo5   
ii  zlib1g  1:1.2.11.dfsg-1

Versions of packages gdb recommends:
ii  libc6-dbg [libc-dbg]  2.28-4

Versions of packages gdb suggests:
ii  gdb-doc8.2-1
pn  gdbserver