Can getauxval be used to determine whether or not you're being traced?

Question

Coming off of this question, I patched my kernel in a quest to get SQL Server 2017 on Linux to start up. Now I'm getting further but I'm being shut down,

strstr("TracerPid:\t0\n", "TracerPid:")                                                                 = "TracerPid:\t0\n"
strtol(0x7fe0cf01840b, 0x7ffd380d5eb0, 10, 0)                                                           = 0
free(0x7fe0cf018400)                                                                                    = <void>
fclose(0x7fe0cf011980)                                                                                  = 0
getpid()                                                                                                = 3474
getpid()                                                                                                = 3474
getauxval(31, 9, 5, 0x7fe0d034ea67)                                                                     = 0x7ffd380dcfe0
strncpy(0x7ffd380d5f00, "/opt/mssql/bin/sqlservr", 4095)                                                = 0x7ffd380d5f00
realpath(0x7ffd380d5f00, 0x7ffd380d6f00, 0, 0x7fe0d0323720)                                             = 0x7ffd380d6f00
getpid()                                                                                                = 3474
abort( <no return ...>
--- SIGABRT (Aborted) ---

I believe after having check proc, SQL Server does some other voodoo to do the same thing as a fall back, just to be "extra-safe" that no one is trying to make their software work.

Now, I'm wondering if getauxval(3) can be used to also determine if a process is being traced? It seems that the CAPABILITIES indicate this is possible in CAP_SYS_ADMIN and CAP_SYS_PTRACE

Answer 1

I believe the first argument to GETAUXVAL() says something,

getauxval(31, 9, 5, 0x7fe0d034ea67)

Opening up /usr/include/x86_64-linux-gnu/bits/auxv.h, I can see that

#define AT_EXECFN       31              /* Filename of executable.  */

So they're trying to get the filename of the executable -- actually the pathname per the docs and the example below. In this case that's the pathname of the tracer and not the target. They're then calling realpath to make sure the paths are the same. You can see what getauxval(),

$ LD_SHOW_AUXV=1 strace sleep 1
AT_SYSINFO_EHDR: 0x7ffd6d96f000
AT_HWCAP:        bfebfbff
AT_PAGESZ:       4096
AT_CLKTCK:       100
AT_PHDR:         0x5640b6cad040
AT_PHENT:        56
AT_PHNUM:        9
AT_BASE:         0x7fc9ce4fc000
AT_FLAGS:        0x0
AT_ENTRY:        0x5640b6d09440
AT_UID:          1000
AT_EUID:         1000
AT_GID:          1000
AT_EGID:         1000
AT_SECURE:       0
AT_RANDOM:       0x7ffd6d909669
AT_HWCAP2:       0x0
AT_EXECFN:       /usr/bin/strace
AT_PLATFORM:     x86_64