kern_ktrace.c revision 1.28
1 /* $NetBSD: kern_ktrace.c,v 1.28 1998/05/02 18:33:20 christos Exp $ */ 2 3 /* 4 * Copyright (c) 1989, 1993 5 * The Regents of the University of California. All rights reserved. 6 * 7 * Redistribution and use in source and binary forms, with or without 8 * modification, are permitted provided that the following conditions 9 * are met: 10 * 1. Redistributions of source code must retain the above copyright 11 * notice, this list of conditions and the following disclaimer. 12 * 2. Redistributions in binary form must reproduce the above copyright 13 * notice, this list of conditions and the following disclaimer in the 14 * documentation and/or other materials provided with the distribution. 15 * 3. All advertising materials mentioning features or use of this software 16 * must display the following acknowledgement: 17 * This product includes software developed by the University of 18 * California, Berkeley and its contributors. 19 * 4. Neither the name of the University nor the names of its contributors 20 * may be used to endorse or promote products derived from this software 21 * without specific prior written permission. 22 * 23 * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND 24 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 25 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 26 * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE 27 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 28 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 29 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 30 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 31 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 32 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 33 * SUCH DAMAGE. 34 * 35 * @(#)kern_ktrace.c 8.5 (Berkeley) 5/14/95 36 */ 37 38 #ifdef KTRACE 39 40 #include <sys/param.h> 41 #include <sys/systm.h> 42 #include <sys/proc.h> 43 #include <sys/file.h> 44 #include <sys/namei.h> 45 #include <sys/vnode.h> 46 #include <sys/ktrace.h> 47 #include <sys/malloc.h> 48 #include <sys/syslog.h> 49 #include <sys/filedesc.h> 50 51 #include <sys/mount.h> 52 #include <sys/syscallargs.h> 53 54 struct ktr_header *ktrgetheader __P((int)); 55 int ktrops __P((struct proc *, struct proc *, int, int, void *)); 56 int ktrsetchildren __P((struct proc *, struct proc *, int, int, void *)); 57 void ktrwrite __P((struct proc *, void *, struct ktr_header *)); 58 int ktrcanset __P((struct proc *, struct proc *)); 59 60 void 61 ktrderef(p) 62 struct proc *p; 63 { 64 if (p->p_tracep == NULL) 65 return; 66 67 if (p->p_traceflag & KTRFAC_FD) { 68 struct file *fp = p->p_tracep; 69 70 closef(fp, NULL); 71 } else { 72 struct vnode *vp = p->p_tracep; 73 74 vrele(vp); 75 } 76 p->p_tracep = NULL; 77 p->p_traceflag = 0; 78 } 79 80 void 81 ktradref(p) 82 struct proc *p; 83 { 84 if (p->p_traceflag & KTRFAC_FD) { 85 struct file *fp = p->p_tracep; 86 87 fp->f_count++; 88 } else { 89 struct vnode *vp = p->p_tracep; 90 91 VREF(vp); 92 } 93 } 94 95 struct ktr_header * 96 ktrgetheader(type) 97 int type; 98 { 99 struct ktr_header *kth; 100 struct proc *p = curproc; /* XXX */ 101 102 MALLOC(kth, struct ktr_header *, sizeof (struct ktr_header), 103 M_TEMP, M_WAITOK); 104 kth->ktr_type = type; 105 microtime(&kth->ktr_time); 106 kth->ktr_pid = p->p_pid; 107 bcopy(p->p_comm, kth->ktr_comm, MAXCOMLEN); 108 return (kth); 109 } 110 111 void 112 ktrsyscall(v, code, argsize, args) 113 void *v; 114 register_t code; 115 size_t argsize; 116 register_t args[]; 117 { 118 struct ktr_header *kth; 119 struct ktr_syscall *ktp; 120 struct proc *p = curproc; /* XXX */ 121 register_t *argp; 122 int len = sizeof(struct ktr_syscall) + argsize; 123 int i; 124 125 p->p_traceflag |= KTRFAC_ACTIVE; 126 kth = ktrgetheader(KTR_SYSCALL); 127 MALLOC(ktp, struct ktr_syscall *, len, M_TEMP, M_WAITOK); 128 ktp->ktr_code = code; 129 ktp->ktr_argsize = argsize; 130 argp = (register_t *)((char *)ktp + sizeof(struct ktr_syscall)); 131 for (i = 0; i < (argsize / sizeof *argp); i++) 132 *argp++ = args[i]; 133 kth->ktr_buf = (caddr_t)ktp; 134 kth->ktr_len = len; 135 ktrwrite(p, v, kth); 136 FREE(ktp, M_TEMP); 137 FREE(kth, M_TEMP); 138 p->p_traceflag &= ~KTRFAC_ACTIVE; 139 } 140 141 void 142 ktrsysret(v, code, error, retval) 143 void *v; 144 register_t code; 145 int error; 146 register_t retval; 147 { 148 struct ktr_header *kth; 149 struct ktr_sysret ktp; 150 struct proc *p = curproc; /* XXX */ 151 152 p->p_traceflag |= KTRFAC_ACTIVE; 153 kth = ktrgetheader(KTR_SYSRET); 154 ktp.ktr_code = code; 155 ktp.ktr_error = error; 156 ktp.ktr_retval = retval; /* what about val2 ? */ 157 158 kth->ktr_buf = (caddr_t)&ktp; 159 kth->ktr_len = sizeof(struct ktr_sysret); 160 161 ktrwrite(p, v, kth); 162 FREE(kth, M_TEMP); 163 p->p_traceflag &= ~KTRFAC_ACTIVE; 164 } 165 166 void 167 ktrnamei(v, path) 168 void *v; 169 char *path; 170 { 171 struct ktr_header *kth; 172 struct proc *p = curproc; /* XXX */ 173 174 p->p_traceflag |= KTRFAC_ACTIVE; 175 kth = ktrgetheader(KTR_NAMEI); 176 kth->ktr_len = strlen(path); 177 kth->ktr_buf = path; 178 179 ktrwrite(p, v, kth); 180 FREE(kth, M_TEMP); 181 p->p_traceflag &= ~KTRFAC_ACTIVE; 182 } 183 184 void 185 ktremul(v, p, emul) 186 void *v; 187 struct proc *p; 188 char *emul; 189 { 190 struct ktr_header *kth; 191 192 p->p_traceflag |= KTRFAC_ACTIVE; 193 kth = ktrgetheader(KTR_EMUL); 194 kth->ktr_len = strlen(emul); 195 kth->ktr_buf = emul; 196 197 ktrwrite(p, v, kth); 198 FREE(kth, M_TEMP); 199 p->p_traceflag &= ~KTRFAC_ACTIVE; 200 } 201 202 void 203 ktrgenio(v, fd, rw, iov, len, error) 204 void *v; 205 int fd; 206 enum uio_rw rw; 207 struct iovec *iov; 208 int len, error; 209 { 210 struct ktr_header *kth; 211 struct ktr_genio *ktp; 212 caddr_t cp; 213 int resid = len, cnt; 214 struct proc *p = curproc; /* XXX */ 215 216 if (error) 217 return; 218 p->p_traceflag |= KTRFAC_ACTIVE; 219 kth = ktrgetheader(KTR_GENIO); 220 MALLOC(ktp, struct ktr_genio *, sizeof(struct ktr_genio) + len, 221 M_TEMP, M_WAITOK); 222 ktp->ktr_fd = fd; 223 ktp->ktr_rw = rw; 224 cp = (caddr_t)((char *)ktp + sizeof (struct ktr_genio)); 225 while (resid > 0) { 226 if ((cnt = iov->iov_len) > resid) 227 cnt = resid; 228 if (copyin(iov->iov_base, cp, (unsigned)cnt)) 229 goto done; 230 cp += cnt; 231 resid -= cnt; 232 iov++; 233 } 234 kth->ktr_buf = (caddr_t)ktp; 235 kth->ktr_len = sizeof (struct ktr_genio) + len; 236 237 ktrwrite(p, v, kth); 238 done: 239 FREE(kth, M_TEMP); 240 FREE(ktp, M_TEMP); 241 p->p_traceflag &= ~KTRFAC_ACTIVE; 242 } 243 244 void 245 ktrpsig(v, sig, action, mask, code) 246 void *v; 247 int sig; 248 sig_t action; 249 int mask, code; 250 { 251 struct ktr_header *kth; 252 struct ktr_psig kp; 253 struct proc *p = curproc; /* XXX */ 254 255 p->p_traceflag |= KTRFAC_ACTIVE; 256 kth = ktrgetheader(KTR_PSIG); 257 kp.signo = (char)sig; 258 kp.action = action; 259 kp.mask = mask; 260 kp.code = code; 261 kth->ktr_buf = (caddr_t)&kp; 262 kth->ktr_len = sizeof (struct ktr_psig); 263 264 ktrwrite(p, v, kth); 265 FREE(kth, M_TEMP); 266 p->p_traceflag &= ~KTRFAC_ACTIVE; 267 } 268 269 void 270 ktrcsw(v, out, user) 271 void *v; 272 int out, user; 273 { 274 struct ktr_header *kth; 275 struct ktr_csw kc; 276 struct proc *p = curproc; /* XXX */ 277 278 p->p_traceflag |= KTRFAC_ACTIVE; 279 kth = ktrgetheader(KTR_CSW); 280 kc.out = out; 281 kc.user = user; 282 kth->ktr_buf = (caddr_t)&kc; 283 kth->ktr_len = sizeof (struct ktr_csw); 284 285 ktrwrite(p, v, kth); 286 FREE(kth, M_TEMP); 287 p->p_traceflag &= ~KTRFAC_ACTIVE; 288 } 289 290 /* Interface and common routines */ 291 292 /* 293 * ktrace system call 294 */ 295 /* ARGSUSED */ 296 int 297 sys_fktrace(curp, v, retval) 298 struct proc *curp; 299 void *v; 300 register_t *retval; 301 { 302 struct sys_fktrace_args /* { 303 syscallarg(int) fd; 304 syscallarg(int) ops; 305 syscallarg(int) facs; 306 syscallarg(int) pid; 307 } */ *uap = v; 308 struct file *fp = NULL; 309 struct proc *p; 310 struct filedesc *fdp = curp->p_fd; 311 struct pgrp *pg; 312 int facs; 313 int ops; 314 int descend; 315 int ret = 0; 316 int error = 0; 317 318 if (((u_int)SCARG(uap, fd)) >= fdp->fd_nfiles || 319 (fp = fdp->fd_ofiles[SCARG(uap, fd)]) == NULL || 320 (fp->f_flag & FWRITE) == 0) 321 return (EBADF); 322 323 ops = KTROP(SCARG(uap, ops)) | KTRFLAG_FD; 324 descend = SCARG(uap, ops) & KTRFLAG_DESCEND; 325 facs = SCARG(uap, facs) & ~((unsigned) KTRFAC_ROOT); 326 curp->p_traceflag |= KTRFAC_ACTIVE; 327 328 /* 329 * Clear all uses of the tracefile 330 */ 331 if (KTROP(ops) == KTROP_CLEARFILE) { 332 for (p = allproc.lh_first; p != 0; p = p->p_list.le_next) { 333 if (p->p_tracep == fp) { 334 if (ktrcanset(curp, p)) 335 ktrderef(p); 336 else 337 error = EPERM; 338 } 339 } 340 goto done; 341 } 342 /* 343 * need something to (un)trace (XXX - why is this here?) 344 */ 345 if (!facs) { 346 error = EINVAL; 347 goto done; 348 } 349 /* 350 * do it 351 */ 352 if (SCARG(uap, pid) < 0) { 353 /* 354 * by process group 355 */ 356 pg = pgfind(-SCARG(uap, pid)); 357 if (pg == NULL) { 358 error = ESRCH; 359 goto done; 360 } 361 for (p = pg->pg_members.lh_first; p != 0; p = p->p_pglist.le_next) 362 if (descend) 363 ret |= ktrsetchildren(curp, p, ops, facs, fp); 364 else 365 ret |= ktrops(curp, p, ops, facs, fp); 366 367 } else { 368 /* 369 * by pid 370 */ 371 p = pfind(SCARG(uap, pid)); 372 if (p == NULL) { 373 error = ESRCH; 374 goto done; 375 } 376 if (descend) 377 ret |= ktrsetchildren(curp, p, ops, facs, fp); 378 else 379 ret |= ktrops(curp, p, ops, facs, fp); 380 } 381 if (!ret) 382 error = EPERM; 383 done: 384 curp->p_traceflag &= ~KTRFAC_ACTIVE; 385 return (error); 386 } 387 388 /* 389 * ktrace system call 390 */ 391 /* ARGSUSED */ 392 int 393 sys_ktrace(curp, v, retval) 394 struct proc *curp; 395 void *v; 396 register_t *retval; 397 { 398 struct sys_ktrace_args /* { 399 syscallarg(const char *) fname; 400 syscallarg(int) ops; 401 syscallarg(int) facs; 402 syscallarg(int) pid; 403 } */ *uap = v; 404 struct vnode *vp = NULL; 405 struct proc *p; 406 struct pgrp *pg; 407 int facs = SCARG(uap, facs) & ~((unsigned) KTRFAC_ROOT); 408 int ops = KTROP(SCARG(uap, ops)); 409 int descend = SCARG(uap, ops) & KTRFLAG_DESCEND; 410 int ret = 0; 411 int error = 0; 412 struct nameidata nd; 413 414 curp->p_traceflag |= KTRFAC_ACTIVE; 415 if (ops != KTROP_CLEAR) { 416 /* 417 * an operation which requires a file argument. 418 */ 419 NDINIT(&nd, LOOKUP, FOLLOW, UIO_USERSPACE, SCARG(uap, fname), 420 curp); 421 if ((error = vn_open(&nd, FREAD|FWRITE, 0)) != 0) { 422 curp->p_traceflag &= ~KTRFAC_ACTIVE; 423 return (error); 424 } 425 vp = nd.ni_vp; 426 VOP_UNLOCK(vp, 0); 427 if (vp->v_type != VREG) { 428 (void) vn_close(vp, FREAD|FWRITE, curp->p_ucred, curp); 429 curp->p_traceflag &= ~KTRFAC_ACTIVE; 430 return (EACCES); 431 } 432 } 433 /* 434 * Clear all uses of the tracefile 435 */ 436 if (KTROP(ops) == KTROP_CLEARFILE) { 437 for (p = allproc.lh_first; p != 0; p = p->p_list.le_next) { 438 if (p->p_tracep == vp && 439 !ktrops(curp, p, KTROP_CLEAR, ~0, vp)) 440 error = EPERM; 441 } 442 goto done; 443 } 444 /* 445 * need something to (un)trace (XXX - why is this here?) 446 */ 447 if (!facs) { 448 error = EINVAL; 449 goto done; 450 } 451 /* 452 * do it 453 */ 454 if (SCARG(uap, pid) < 0) { 455 /* 456 * by process group 457 */ 458 pg = pgfind(-SCARG(uap, pid)); 459 if (pg == NULL) { 460 error = ESRCH; 461 goto done; 462 } 463 for (p = pg->pg_members.lh_first; p != 0; p = p->p_pglist.le_next) 464 if (descend) 465 ret |= ktrsetchildren(curp, p, ops, facs, vp); 466 else 467 ret |= ktrops(curp, p, ops, facs, vp); 468 469 } else { 470 /* 471 * by pid 472 */ 473 p = pfind(SCARG(uap, pid)); 474 if (p == NULL) { 475 error = ESRCH; 476 goto done; 477 } 478 if (descend) 479 ret |= ktrsetchildren(curp, p, ops, facs, vp); 480 else 481 ret |= ktrops(curp, p, ops, facs, vp); 482 } 483 if (!ret) 484 error = EPERM; 485 done: 486 if (vp != NULL) 487 (void) vn_close(vp, FWRITE, curp->p_ucred, curp); 488 curp->p_traceflag &= ~KTRFAC_ACTIVE; 489 return (error); 490 } 491 492 int 493 ktrops(curp, p, ops, facs, v) 494 struct proc *p, *curp; 495 int ops, facs; 496 void *v; 497 { 498 499 if (!ktrcanset(curp, p)) 500 return (0); 501 if (KTROP(ops) == KTROP_SET) { 502 if (p->p_tracep != v) { 503 /* 504 * if trace file already in use, relinquish 505 */ 506 ktrderef(p); 507 if (ops & KTRFLAG_FD) 508 p->p_traceflag = KTRFAC_FD; 509 p->p_tracep = v; 510 ktradref(p); 511 } 512 p->p_traceflag |= facs; 513 if (curp->p_ucred->cr_uid == 0) 514 p->p_traceflag |= KTRFAC_ROOT; 515 } else { 516 /* KTROP_CLEAR */ 517 if (((p->p_traceflag &= ~facs) & KTRFAC_MASK) == 0) { 518 /* no more tracing */ 519 ktrderef(p); 520 } 521 } 522 523 /* 524 * Emit an emulation record, every time there is a ktrace 525 * change/attach request. 526 */ 527 if (KTRPOINT(p, KTR_EMUL)) 528 ktremul(p->p_tracep, p, p->p_emul->e_name); 529 530 return (1); 531 } 532 533 int 534 ktrsetchildren(curp, top, ops, facs, v) 535 struct proc *curp, *top; 536 int ops, facs; 537 void *v; 538 { 539 struct proc *p; 540 int ret = 0; 541 542 p = top; 543 for (;;) { 544 ret |= ktrops(curp, p, ops, facs, v); 545 /* 546 * If this process has children, descend to them next, 547 * otherwise do any siblings, and if done with this level, 548 * follow back up the tree (but not past top). 549 */ 550 if (p->p_children.lh_first) 551 p = p->p_children.lh_first; 552 else for (;;) { 553 if (p == top) 554 return (ret); 555 if (p->p_sibling.le_next) { 556 p = p->p_sibling.le_next; 557 break; 558 } 559 p = p->p_pptr; 560 } 561 } 562 /*NOTREACHED*/ 563 } 564 565 void 566 ktrwrite(p, v, kth) 567 struct proc *p; 568 void *v; 569 struct ktr_header *kth; 570 { 571 struct uio auio; 572 struct iovec aiov[2]; 573 int error; 574 575 if (v == NULL) 576 return; 577 auio.uio_iov = &aiov[0]; 578 auio.uio_offset = 0; 579 auio.uio_segflg = UIO_SYSSPACE; 580 auio.uio_rw = UIO_WRITE; 581 aiov[0].iov_base = (caddr_t)kth; 582 aiov[0].iov_len = sizeof(struct ktr_header); 583 auio.uio_resid = sizeof(struct ktr_header); 584 auio.uio_iovcnt = 1; 585 auio.uio_procp = (struct proc *)0; 586 if (kth->ktr_len > 0) { 587 auio.uio_iovcnt++; 588 aiov[1].iov_base = kth->ktr_buf; 589 aiov[1].iov_len = kth->ktr_len; 590 auio.uio_resid += kth->ktr_len; 591 } 592 if (p->p_traceflag & KTRFAC_FD) { 593 struct file *fp = v; 594 595 error = (*fp->f_ops->fo_write)(fp, &auio, fp->f_cred); 596 } 597 else { 598 struct vnode *vp = v; 599 600 vn_lock(vp, LK_EXCLUSIVE | LK_RETRY); 601 error = VOP_WRITE(vp, &auio, IO_UNIT|IO_APPEND, p->p_ucred); 602 VOP_UNLOCK(vp, 0); 603 } 604 if (!error) 605 return; 606 /* 607 * If error encountered, give up tracing on this vnode. 608 */ 609 log(LOG_NOTICE, "ktrace write failed, errno %d, tracing stopped\n", 610 error); 611 for (p = allproc.lh_first; p != 0; p = p->p_list.le_next) { 612 if (p->p_tracep == v) 613 ktrderef(p); 614 } 615 } 616 617 /* 618 * Return true if caller has permission to set the ktracing state 619 * of target. Essentially, the target can't possess any 620 * more permissions than the caller. KTRFAC_ROOT signifies that 621 * root previously set the tracing status on the target process, and 622 * so, only root may further change it. 623 * 624 * TODO: check groups. use caller effective gid. 625 */ 626 int 627 ktrcanset(callp, targetp) 628 struct proc *callp, *targetp; 629 { 630 struct pcred *caller = callp->p_cred; 631 struct pcred *target = targetp->p_cred; 632 633 if ((caller->pc_ucred->cr_uid == target->p_ruid && 634 target->p_ruid == target->p_svuid && 635 caller->p_rgid == target->p_rgid && /* XXX */ 636 target->p_rgid == target->p_svgid && 637 (targetp->p_traceflag & KTRFAC_ROOT) == 0) || 638 caller->pc_ucred->cr_uid == 0) 639 return (1); 640 641 return (0); 642 } 643 644 #endif 645
Indexes created Sat Sep 20 22:09:52 GMT 2025