1

So, the title says it all.

Is it possible that one process has two tracers?

I am playing around with ptrace, and I can see that whenever someone attaches to process, then in /proc//status under TracerPID will be PID of the tracer. However, is it possible to have two tracers?

I have two programs (tracer, and tracee). And I ran tracee in debug mode, and then I ran tracer, and got error Operation not permited (even with root permissions).

Regards, golobich

golobitch
  • 1,466
  • 3
  • 19
  • 38

1 Answers1

3

They can't. It is indirectly confirmed in ptrace man page:

   EPERM  The  specified  process cannot be traced.  This could be because
          the tracer has insufficient privileges (the required  capability
          is  CAP_SYS_PTRACE);  unprivileged  processes  cannot trace pro‐
          cesses that they cannot send signals to or  those  running  set-
          user-ID/set-group-ID  programs,  for  obvious reasons.  Alterna‐
          tively, the process may already be being traced, or (on  kernels
          before 2.6.26) be init(1) (PID 1).
grungegurunge
  • 841
  • 7
  • 13