* Set PR_SET_TRACER on ubuntu systems so child processes can ptrace() our process

autotools/configure.ac

@@ -79,7 +79,7 @@ AC_HEADER_STAT
 #checkpoint
 AC_CACHE_SAVE 
 AC_CHECK_HEADERS([stdarg.h std_arg.h arpa/inet.h fcntl.h limits.h locale.h netdb.h netinet/in.h])
-AC_CHECK_HEADERS([sys/file.h sys/ioctl.h sys/param.h sys/socket.h wchar.h sys/ptrace.h paths.h])
+AC_CHECK_HEADERS([sys/file.h sys/ioctl.h sys/param.h sys/socket.h wchar.h sys/ptrace.h paths.h sys/prctl.h])
 
 #checkpoint
 AC_CACHE_SAVE

config.h.in

@@ -189,6 +189,9 @@
 /* Define to 1 if you have the <sys/param.h> header file. */
 #undef HAVE_SYS_PARAM_H
 
+/* Define to 1 if you have the <sys/prctl.h> header file. */
+#undef HAVE_SYS_PRCTL_H
+
 /* Define to 1 if you have the <sys/ptrace.h> header file. */
 #undef HAVE_SYS_PTRACE_H
 

configure

@@ -5151,7 +5151,7 @@ fi
 
 done
 
-for ac_header in sys/file.h sys/ioctl.h sys/param.h sys/socket.h wchar.h sys/ptrace.h paths.h
+for ac_header in sys/file.h sys/ioctl.h sys/param.h sys/socket.h wchar.h sys/ptrace.h paths.h sys/prctl.h
 do :
   as_ac_Header=`$as_echo "ac_cv_header_$ac_header" | $as_tr_sh`
 ac_fn_cxx_check_header_mongrel "$LINENO" "$ac_header" "$as_ac_Header" "$ac_includes_default"

src/shell.c

@@ -54,6 +54,9 @@
 #include <sys/types.h>
 #include <pwd.h>
 #include <signal.h>
+#ifdef HAVE_SYS_PRCTL_H
+#include <sys/prctl.h>
+#endif
 #ifdef HAVE_SYS_PTRACE_H
 # include <sys/ptrace.h>
 #endif /* HAVE_SYS_PTRACE_H */
@@ -390,6 +393,12 @@ int shell_exec(char *cmdline, char *input, char **output, char **erroutput, bool
     int st = 0;
     size_t fs = 0;
 
+#ifdef PR_SET_PTRACER
+    // Allow the child to debug the parent on Ubuntu
+    // https://wiki.ubuntu.com/SecurityTeam/Roadmap/KernelHardening#ptrace
+    prctl(PR_SET_PTRACER, x, 0, 0, 0);
+#endif
+
     waitpid(x, &st, 0);
     /* child is now complete, read the files into buffers */
     delete in;