Search code examples
c++linuxprocessptrace

Can two process attach to same PID via ptrace


So, the title says it all.

Is it possible that one process has two tracers?

I am playing around with ptrace, and I can see that whenever someone attaches to process, then in /proc//status under TracerPID will be PID of the tracer. However, is it possible to have two tracers?

I have two programs (tracer, and tracee). And I ran tracee in debug mode, and then I ran tracer, and got error Operation not permited (even with root permissions).

Regards, golobich


Solution

  • They can't. It is indirectly confirmed in ptrace man page:

       EPERM  The  specified  process cannot be traced.  This could be because
              the tracer has insufficient privileges (the required  capability
              is  CAP_SYS_PTRACE);  unprivileged  processes  cannot trace pro‐
              cesses that they cannot send signals to or  those  running  set-
              user-ID/set-group-ID  programs,  for  obvious reasons.  Alterna‐
              tively, the process may already be being traced, or (on  kernels
              before 2.6.26) be init(1) (PID 1).