Problem solved...
You are deluding yourself if you think that merely attaching the parent will prevent a determined hacker from debugging your program.
Your protection will work only against the least sophisticated attacker. A more sophisticated one can:
- kill your child process and attach your parent, or
- build a custom
libc.so
that implements ptrace
which doesn't actually attach the target, or
- use
LD_PRELOAD
to inject a ptrace
that does what he wants, or
- run with a custom kernel that allows debugger to attach to an already attached process, or
- a few dozen other ways
For an attacker that can modify the OS kernel, there is really very little you could do to protect your program.
As for "how to attach any newly-created thread", you can catch the sys_clone
with PTRACE_SYSCALL
, and attach the cloned process immediately on return. See also PTRACE_O_TRACECLONE
in the ptrace man page.
Are there best practices for securing code?
This question has quite a few suggestions.