kern_ktrace.c revision 1.32
1 /* $NetBSD: kern_ktrace.c,v 1.32 1998/08/04 04:03:12 perry Exp $ */ 2 3 /* 4 * Copyright (c) 1989, 1993 5 * The Regents of the University of California. All rights reserved. 6 * 7 * Redistribution and use in source and binary forms, with or without 8 * modification, are permitted provided that the following conditions 9 * are met: 10 * 1. Redistributions of source code must retain the above copyright 11 * notice, this list of conditions and the following disclaimer. 12 * 2. Redistributions in binary form must reproduce the above copyright 13 * notice, this list of conditions and the following disclaimer in the 14 * documentation and/or other materials provided with the distribution. 15 * 3. All advertising materials mentioning features or use of this software 16 * must display the following acknowledgement: 17 * This product includes software developed by the University of 18 * California, Berkeley and its contributors. 19 * 4. Neither the name of the University nor the names of its contributors 20 * may be used to endorse or promote products derived from this software 21 * without specific prior written permission. 22 * 23 * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND 24 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 25 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 26 * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE 27 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 28 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 29 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 30 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 31 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 32 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 33 * SUCH DAMAGE. 34 * 35 * @(#)kern_ktrace.c 8.5 (Berkeley) 5/14/95 36 */ 37 38 #include "opt_ktrace.h" 39 40 #ifdef KTRACE 41 42 #include <sys/param.h> 43 #include <sys/systm.h> 44 #include <sys/proc.h> 45 #include <sys/file.h> 46 #include <sys/namei.h> 47 #include <sys/vnode.h> 48 #include <sys/ktrace.h> 49 #include <sys/malloc.h> 50 #include <sys/syslog.h> 51 #include <sys/filedesc.h> 52 53 #include <sys/mount.h> 54 #include <sys/syscallargs.h> 55 56 struct ktr_header *ktrgetheader __P((int)); 57 int ktrops __P((struct proc *, struct proc *, int, int, void *)); 58 int ktrsetchildren __P((struct proc *, struct proc *, int, int, void *)); 59 void ktrwrite __P((struct proc *, void *, struct ktr_header *)); 60 int ktrcanset __P((struct proc *, struct proc *)); 61 62 void 63 ktrderef(p) 64 struct proc *p; 65 { 66 if (p->p_tracep == NULL) 67 return; 68 69 if (p->p_traceflag & KTRFAC_FD) { 70 struct file *fp = p->p_tracep; 71 72 closef(fp, NULL); 73 } else { 74 struct vnode *vp = p->p_tracep; 75 76 vrele(vp); 77 } 78 p->p_tracep = NULL; 79 p->p_traceflag = 0; 80 } 81 82 void 83 ktradref(p) 84 struct proc *p; 85 { 86 if (p->p_traceflag & KTRFAC_FD) { 87 struct file *fp = p->p_tracep; 88 89 fp->f_count++; 90 } else { 91 struct vnode *vp = p->p_tracep; 92 93 VREF(vp); 94 } 95 } 96 97 struct ktr_header * 98 ktrgetheader(type) 99 int type; 100 { 101 struct ktr_header *kth; 102 struct proc *p = curproc; /* XXX */ 103 104 MALLOC(kth, struct ktr_header *, sizeof(struct ktr_header), 105 M_TEMP, M_WAITOK); 106 kth->ktr_type = type; 107 microtime(&kth->ktr_time); 108 kth->ktr_pid = p->p_pid; 109 memcpy(kth->ktr_comm, p->p_comm, MAXCOMLEN); 110 return (kth); 111 } 112 113 void 114 ktrsyscall(v, code, argsize, args) 115 void *v; 116 register_t code; 117 size_t argsize; 118 register_t args[]; 119 { 120 struct ktr_header *kth; 121 struct ktr_syscall *ktp; 122 struct proc *p = curproc; /* XXX */ 123 register_t *argp; 124 int len = sizeof(struct ktr_syscall) + argsize; 125 int i; 126 127 p->p_traceflag |= KTRFAC_ACTIVE; 128 kth = ktrgetheader(KTR_SYSCALL); 129 MALLOC(ktp, struct ktr_syscall *, len, M_TEMP, M_WAITOK); 130 ktp->ktr_code = code; 131 ktp->ktr_argsize = argsize; 132 argp = (register_t *)((char *)ktp + sizeof(struct ktr_syscall)); 133 for (i = 0; i < (argsize / sizeof(*argp)); i++) 134 *argp++ = args[i]; 135 kth->ktr_buf = (caddr_t)ktp; 136 kth->ktr_len = len; 137 ktrwrite(p, v, kth); 138 FREE(ktp, M_TEMP); 139 FREE(kth, M_TEMP); 140 p->p_traceflag &= ~KTRFAC_ACTIVE; 141 } 142 143 void 144 ktrsysret(v, code, error, retval) 145 void *v; 146 register_t code; 147 int error; 148 register_t retval; 149 { 150 struct ktr_header *kth; 151 struct ktr_sysret ktp; 152 struct proc *p = curproc; /* XXX */ 153 154 p->p_traceflag |= KTRFAC_ACTIVE; 155 kth = ktrgetheader(KTR_SYSRET); 156 ktp.ktr_code = code; 157 ktp.ktr_error = error; 158 ktp.ktr_retval = retval; /* what about val2 ? */ 159 160 kth->ktr_buf = (caddr_t)&ktp; 161 kth->ktr_len = sizeof(struct ktr_sysret); 162 163 ktrwrite(p, v, kth); 164 FREE(kth, M_TEMP); 165 p->p_traceflag &= ~KTRFAC_ACTIVE; 166 } 167 168 void 169 ktrnamei(v, path) 170 void *v; 171 char *path; 172 { 173 struct ktr_header *kth; 174 struct proc *p = curproc; /* XXX */ 175 176 p->p_traceflag |= KTRFAC_ACTIVE; 177 kth = ktrgetheader(KTR_NAMEI); 178 kth->ktr_len = strlen(path); 179 kth->ktr_buf = path; 180 181 ktrwrite(p, v, kth); 182 FREE(kth, M_TEMP); 183 p->p_traceflag &= ~KTRFAC_ACTIVE; 184 } 185 186 void 187 ktremul(v, p, emul) 188 void *v; 189 struct proc *p; 190 char *emul; 191 { 192 struct ktr_header *kth; 193 194 p->p_traceflag |= KTRFAC_ACTIVE; 195 kth = ktrgetheader(KTR_EMUL); 196 kth->ktr_len = strlen(emul); 197 kth->ktr_buf = emul; 198 199 ktrwrite(p, v, kth); 200 FREE(kth, M_TEMP); 201 p->p_traceflag &= ~KTRFAC_ACTIVE; 202 } 203 204 void 205 ktrgenio(v, fd, rw, iov, len, error) 206 void *v; 207 int fd; 208 enum uio_rw rw; 209 struct iovec *iov; 210 int len, error; 211 { 212 struct ktr_header *kth; 213 struct ktr_genio *ktp; 214 caddr_t cp; 215 int resid = len, cnt; 216 struct proc *p = curproc; /* XXX */ 217 218 if (error) 219 return; 220 p->p_traceflag |= KTRFAC_ACTIVE; 221 kth = ktrgetheader(KTR_GENIO); 222 MALLOC(ktp, struct ktr_genio *, sizeof(struct ktr_genio) + len, 223 M_TEMP, M_WAITOK); 224 ktp->ktr_fd = fd; 225 ktp->ktr_rw = rw; 226 cp = (caddr_t)((char *)ktp + sizeof(struct ktr_genio)); 227 while (resid > 0) { 228 if ((cnt = iov->iov_len) > resid) 229 cnt = resid; 230 if (copyin(iov->iov_base, cp, (unsigned)cnt)) 231 goto done; 232 cp += cnt; 233 resid -= cnt; 234 iov++; 235 } 236 kth->ktr_buf = (caddr_t)ktp; 237 kth->ktr_len = sizeof(struct ktr_genio) + len; 238 239 ktrwrite(p, v, kth); 240 done: 241 FREE(kth, M_TEMP); 242 FREE(ktp, M_TEMP); 243 p->p_traceflag &= ~KTRFAC_ACTIVE; 244 } 245 246 void 247 ktrpsig(v, sig, action, mask, code) 248 void *v; 249 int sig; 250 sig_t action; 251 int mask, code; 252 { 253 struct ktr_header *kth; 254 struct ktr_psig kp; 255 struct proc *p = curproc; /* XXX */ 256 257 p->p_traceflag |= KTRFAC_ACTIVE; 258 kth = ktrgetheader(KTR_PSIG); 259 kp.signo = (char)sig; 260 kp.action = action; 261 kp.mask = mask; 262 kp.code = code; 263 kth->ktr_buf = (caddr_t)&kp; 264 kth->ktr_len = sizeof(struct ktr_psig); 265 266 ktrwrite(p, v, kth); 267 FREE(kth, M_TEMP); 268 p->p_traceflag &= ~KTRFAC_ACTIVE; 269 } 270 271 void 272 ktrcsw(v, out, user) 273 void *v; 274 int out, user; 275 { 276 struct ktr_header *kth; 277 struct ktr_csw kc; 278 struct proc *p = curproc; /* XXX */ 279 280 p->p_traceflag |= KTRFAC_ACTIVE; 281 kth = ktrgetheader(KTR_CSW); 282 kc.out = out; 283 kc.user = user; 284 kth->ktr_buf = (caddr_t)&kc; 285 kth->ktr_len = sizeof(struct ktr_csw); 286 287 ktrwrite(p, v, kth); 288 FREE(kth, M_TEMP); 289 p->p_traceflag &= ~KTRFAC_ACTIVE; 290 } 291 292 /* Interface and common routines */ 293 294 /* 295 * ktrace system call 296 */ 297 /* ARGSUSED */ 298 int 299 sys_fktrace(curp, v, retval) 300 struct proc *curp; 301 void *v; 302 register_t *retval; 303 { 304 struct sys_fktrace_args /* { 305 syscallarg(int) fd; 306 syscallarg(int) ops; 307 syscallarg(int) facs; 308 syscallarg(int) pid; 309 } */ *uap = v; 310 struct file *fp = NULL; 311 struct proc *p; 312 struct filedesc *fdp = curp->p_fd; 313 struct pgrp *pg; 314 int facs; 315 int ops; 316 int descend; 317 int ret = 0; 318 int error = 0; 319 320 if (((u_int)SCARG(uap, fd)) >= fdp->fd_nfiles || 321 (fp = fdp->fd_ofiles[SCARG(uap, fd)]) == NULL || 322 (fp->f_flag & FWRITE) == 0) 323 return (EBADF); 324 325 ops = KTROP(SCARG(uap, ops)) | KTRFLAG_FD; 326 descend = SCARG(uap, ops) & KTRFLAG_DESCEND; 327 facs = SCARG(uap, facs) & ~((unsigned) KTRFAC_ROOT); 328 curp->p_traceflag |= KTRFAC_ACTIVE; 329 330 /* 331 * Clear all uses of the tracefile 332 */ 333 if (KTROP(ops) == KTROP_CLEARFILE) { 334 for (p = allproc.lh_first; p != 0; p = p->p_list.le_next) { 335 if (p->p_tracep == fp) { 336 if (ktrcanset(curp, p)) 337 ktrderef(p); 338 else 339 error = EPERM; 340 } 341 } 342 goto done; 343 } 344 /* 345 * need something to (un)trace (XXX - why is this here?) 346 */ 347 if (!facs) { 348 error = EINVAL; 349 goto done; 350 } 351 /* 352 * do it 353 */ 354 if (SCARG(uap, pid) < 0) { 355 /* 356 * by process group 357 */ 358 pg = pgfind(-SCARG(uap, pid)); 359 if (pg == NULL) { 360 error = ESRCH; 361 goto done; 362 } 363 for (p = pg->pg_members.lh_first; p != 0; p = p->p_pglist.le_next) 364 if (descend) 365 ret |= ktrsetchildren(curp, p, ops, facs, fp); 366 else 367 ret |= ktrops(curp, p, ops, facs, fp); 368 369 } else { 370 /* 371 * by pid 372 */ 373 p = pfind(SCARG(uap, pid)); 374 if (p == NULL) { 375 error = ESRCH; 376 goto done; 377 } 378 if (descend) 379 ret |= ktrsetchildren(curp, p, ops, facs, fp); 380 else 381 ret |= ktrops(curp, p, ops, facs, fp); 382 } 383 if (!ret) 384 error = EPERM; 385 done: 386 curp->p_traceflag &= ~KTRFAC_ACTIVE; 387 return (error); 388 } 389 390 /* 391 * ktrace system call 392 */ 393 /* ARGSUSED */ 394 int 395 sys_ktrace(curp, v, retval) 396 struct proc *curp; 397 void *v; 398 register_t *retval; 399 { 400 struct sys_ktrace_args /* { 401 syscallarg(const char *) fname; 402 syscallarg(int) ops; 403 syscallarg(int) facs; 404 syscallarg(int) pid; 405 } */ *uap = v; 406 struct vnode *vp = NULL; 407 struct proc *p; 408 struct pgrp *pg; 409 int facs = SCARG(uap, facs) & ~((unsigned) KTRFAC_ROOT); 410 int ops = KTROP(SCARG(uap, ops)); 411 int descend = SCARG(uap, ops) & KTRFLAG_DESCEND; 412 int ret = 0; 413 int error = 0; 414 struct nameidata nd; 415 416 curp->p_traceflag |= KTRFAC_ACTIVE; 417 if (ops != KTROP_CLEAR) { 418 /* 419 * an operation which requires a file argument. 420 */ 421 NDINIT(&nd, LOOKUP, FOLLOW, UIO_USERSPACE, SCARG(uap, fname), 422 curp); 423 if ((error = vn_open(&nd, FREAD|FWRITE, 0)) != 0) { 424 curp->p_traceflag &= ~KTRFAC_ACTIVE; 425 return (error); 426 } 427 vp = nd.ni_vp; 428 VOP_UNLOCK(vp, 0); 429 if (vp->v_type != VREG) { 430 (void) vn_close(vp, FREAD|FWRITE, curp->p_ucred, curp); 431 curp->p_traceflag &= ~KTRFAC_ACTIVE; 432 return (EACCES); 433 } 434 } 435 /* 436 * Clear all uses of the tracefile 437 */ 438 if (KTROP(ops) == KTROP_CLEARFILE) { 439 for (p = allproc.lh_first; p != 0; p = p->p_list.le_next) { 440 if (p->p_tracep == vp && 441 !ktrops(curp, p, KTROP_CLEAR, ~0, vp)) 442 error = EPERM; 443 } 444 goto done; 445 } 446 /* 447 * need something to (un)trace (XXX - why is this here?) 448 */ 449 if (!facs) { 450 error = EINVAL; 451 goto done; 452 } 453 /* 454 * do it 455 */ 456 if (SCARG(uap, pid) < 0) { 457 /* 458 * by process group 459 */ 460 pg = pgfind(-SCARG(uap, pid)); 461 if (pg == NULL) { 462 error = ESRCH; 463 goto done; 464 } 465 for (p = pg->pg_members.lh_first; p != 0; p = p->p_pglist.le_next) 466 if (descend) 467 ret |= ktrsetchildren(curp, p, ops, facs, vp); 468 else 469 ret |= ktrops(curp, p, ops, facs, vp); 470 471 } else { 472 /* 473 * by pid 474 */ 475 p = pfind(SCARG(uap, pid)); 476 if (p == NULL) { 477 error = ESRCH; 478 goto done; 479 } 480 if (descend) 481 ret |= ktrsetchildren(curp, p, ops, facs, vp); 482 else 483 ret |= ktrops(curp, p, ops, facs, vp); 484 } 485 if (!ret) 486 error = EPERM; 487 done: 488 if (vp != NULL) 489 (void) vn_close(vp, FWRITE, curp->p_ucred, curp); 490 curp->p_traceflag &= ~KTRFAC_ACTIVE; 491 return (error); 492 } 493 494 int 495 ktrops(curp, p, ops, facs, v) 496 struct proc *p, *curp; 497 int ops, facs; 498 void *v; 499 { 500 501 if (!ktrcanset(curp, p)) 502 return (0); 503 if (KTROP(ops) == KTROP_SET) { 504 if (p->p_tracep != v) { 505 /* 506 * if trace file already in use, relinquish 507 */ 508 ktrderef(p); 509 if (ops & KTRFLAG_FD) 510 p->p_traceflag = KTRFAC_FD; 511 p->p_tracep = v; 512 ktradref(p); 513 } 514 p->p_traceflag |= facs; 515 if (curp->p_ucred->cr_uid == 0) 516 p->p_traceflag |= KTRFAC_ROOT; 517 } else { 518 /* KTROP_CLEAR */ 519 if (((p->p_traceflag &= ~facs) & KTRFAC_MASK) == 0) { 520 /* no more tracing */ 521 ktrderef(p); 522 } 523 } 524 525 /* 526 * Emit an emulation record, every time there is a ktrace 527 * change/attach request. 528 */ 529 if (KTRPOINT(p, KTR_EMUL)) 530 ktremul(p->p_tracep, p, p->p_emul->e_name); 531 532 return (1); 533 } 534 535 int 536 ktrsetchildren(curp, top, ops, facs, v) 537 struct proc *curp, *top; 538 int ops, facs; 539 void *v; 540 { 541 struct proc *p; 542 int ret = 0; 543 544 p = top; 545 for (;;) { 546 ret |= ktrops(curp, p, ops, facs, v); 547 /* 548 * If this process has children, descend to them next, 549 * otherwise do any siblings, and if done with this level, 550 * follow back up the tree (but not past top). 551 */ 552 if (p->p_children.lh_first) 553 p = p->p_children.lh_first; 554 else for (;;) { 555 if (p == top) 556 return (ret); 557 if (p->p_sibling.le_next) { 558 p = p->p_sibling.le_next; 559 break; 560 } 561 p = p->p_pptr; 562 } 563 } 564 /*NOTREACHED*/ 565 } 566 567 void 568 ktrwrite(p, v, kth) 569 struct proc *p; 570 void *v; 571 struct ktr_header *kth; 572 { 573 struct uio auio; 574 struct iovec aiov[2]; 575 int error; 576 577 if (v == NULL) 578 return; 579 auio.uio_iov = &aiov[0]; 580 auio.uio_offset = 0; 581 auio.uio_segflg = UIO_SYSSPACE; 582 auio.uio_rw = UIO_WRITE; 583 aiov[0].iov_base = (caddr_t)kth; 584 aiov[0].iov_len = sizeof(struct ktr_header); 585 auio.uio_resid = sizeof(struct ktr_header); 586 auio.uio_iovcnt = 1; 587 auio.uio_procp = (struct proc *)0; 588 if (kth->ktr_len > 0) { 589 auio.uio_iovcnt++; 590 aiov[1].iov_base = kth->ktr_buf; 591 aiov[1].iov_len = kth->ktr_len; 592 auio.uio_resid += kth->ktr_len; 593 } 594 if (p->p_traceflag & KTRFAC_FD) { 595 struct file *fp = v; 596 597 error = (*fp->f_ops->fo_write)(fp, &fp->f_offset, &auio, 598 fp->f_cred, FOF_UPDATE_OFFSET); 599 } 600 else { 601 struct vnode *vp = v; 602 603 vn_lock(vp, LK_EXCLUSIVE | LK_RETRY); 604 error = VOP_WRITE(vp, &auio, IO_UNIT|IO_APPEND, p->p_ucred); 605 VOP_UNLOCK(vp, 0); 606 } 607 if (!error) 608 return; 609 /* 610 * If error encountered, give up tracing on this vnode. 611 */ 612 log(LOG_NOTICE, "ktrace write failed, errno %d, tracing stopped\n", 613 error); 614 for (p = allproc.lh_first; p != 0; p = p->p_list.le_next) { 615 if (p->p_tracep == v) 616 ktrderef(p); 617 } 618 } 619 620 /* 621 * Return true if caller has permission to set the ktracing state 622 * of target. Essentially, the target can't possess any 623 * more permissions than the caller. KTRFAC_ROOT signifies that 624 * root previously set the tracing status on the target process, and 625 * so, only root may further change it. 626 * 627 * TODO: check groups. use caller effective gid. 628 */ 629 int 630 ktrcanset(callp, targetp) 631 struct proc *callp, *targetp; 632 { 633 struct pcred *caller = callp->p_cred; 634 struct pcred *target = targetp->p_cred; 635 636 if ((caller->pc_ucred->cr_uid == target->p_ruid && 637 target->p_ruid == target->p_svuid && 638 caller->p_rgid == target->p_rgid && /* XXX */ 639 target->p_rgid == target->p_svgid && 640 (targetp->p_traceflag & KTRFAC_ROOT) == 0) || 641 caller->pc_ucred->cr_uid == 0) 642 return (1); 643 644 return (0); 645 } 646 647 #endif 648
Indexes created Sun Sep 21 14:09:52 GMT 2025