Error tracing process: ptrace(cmd=1, pid=31271, 140728292737024L, 0) error #5: Input/output error

[scalp42]

See log:

root@i-770a93ad # uname -a
Linux i-770a93ad 3.19.0-47-generic #53~14.04.1-Ubuntu SMP Mon Jan 18 16:09:14 UTC 2016 x86_64 x86_64 x86_64 GNU/Linux

root@i-770a93ad # maybe service nginx reload
Error tracing process: ptrace(cmd=1, pid=31271, 140728292737024L, 0) error #5: Input/output error.
WARNING:root:Terminate <PtraceProcess #31271>

root@i-770a93ad # maybe apt-get update
FATAL -> Could not set close on exec Bad file descriptor
maybe has not detected any file system operations from apt-get update.

[p-e-w]

Thank you for reporting this, can you reproduce either of these errors without running as a superuser (with different commands, probably, as these two require root)?

[Ruben62]

Have no idea what you guys are talking about

[scalp42]

@p-e-w indeed, it's working for non root commands.

[p-e-w]

Could you comment the exception handling around https://github.com/p-e-w/maybe/blob/master/maybe/maybe.py#L157 and then rerun so we can get the full stacktrace?

Be warned that this might allow blocked syscalls to execute (unless you keep the finally clause), so only do it if you are OK with the command running without maybe.

[scalp42]

@p-e-w sounds good, I'll try to get to it tomorrow.

[Ruben62]

Didn't work?
On Feb 28, 2016 12:14 PM, "Anthony Scalisi" [email protected]
wrote:

@p-e-w https://github.com/p-e-w sounds good, I'll try to get to it
tomorrow.

—
Reply to this email directly or view it on GitHub
#14 (comment).

[scalp42]

@p-e-w I tried removing begin/rescue and just leave operations = get_operations(debugger):

root@i-87bd135f # maybe apt-get update
FATAL -> Could not set close on exec Bad file descriptor
maybe has not detected any file system operations from apt-get update.

root@i-87bd135f # maybe service nginx reload
Traceback (most recent call last):
  File "/usr/local/bin/maybe", line 11, in <module>
    sys.exit(main())
  File "/usr/local/lib/python2.7/dist-packages/maybe/maybe.py", line 156, in main
    operations = get_operations(debugger)
  File "/usr/local/lib/python2.7/dist-packages/maybe/maybe.py", line 109, in get_operations
    arguments = [parse_argument(argument) for argument in syscall.arguments]
  File "/usr/local/lib/python2.7/dist-packages/maybe/maybe.py", line 58, in parse_argument
    argument = argument.createText()
  File "/usr/local/lib/python2.7/dist-packages/ptrace/syscall/syscall_argument.py", line 106, in createText
    return self.readCString(value)
  File "/usr/local/lib/python2.7/dist-packages/ptrace/syscall/syscall_argument.py", line 183, in readCString
    char, truncated = self.function.process.readCString(address, max_size)
  File "/usr/local/lib/python2.7/dist-packages/ptrace/debugger/process.py", line 648, in readCString
    data = self.readBytes(address, chunk_length)
  File "/usr/local/lib/python2.7/dist-packages/ptrace/debugger/process.py", line 516, in _readBytes
    word = self.readWord(address)
  File "/usr/local/lib/python2.7/dist-packages/ptrace/debugger/process.py", line 532, in readWord
    word = ptrace_peektext(self.pid, address)
  File "/usr/local/lib/python2.7/dist-packages/ptrace/binding/func.py", line 175, in ptrace_peektext
    return _peek(PTRACE_PEEKTEXT, pid, address)
  File "/usr/local/lib/python2.7/dist-packages/ptrace/binding/func.py", line 165, in _peek
    return ptrace(command, pid, address, check_errno=True)
  File "/usr/local/lib/python2.7/dist-packages/ptrace/binding/func.py", line 148, in ptrace
    raise PtraceError(message, errno=errno, pid=pid)
ptrace.error.PtraceError: ptrace(cmd=1, pid=14381, 140730257346560L, 0) error #5: Input/output error
root@i-87bd135f #  * Reloading nginx nginx                                                                      [ OK ]

[p-e-w]

So the problem is in formatting an argument. It's calling readCString so we might be reading out of bounds here.

Unfortunately, I cannot tell which syscall is the problem from the trace alone. To get closer to fixing this, could you add

print(syscall.name)
print(syscall.format())

right after https://github.com/p-e-w/maybe/blob/master/maybe/maybe.py#L107 and then post the full output? Note that while syscall.format() includes the name, it will also try to format the arguments so will likely fail on the crucial final syscall.