kern_ktrace.c revision 1.33.8.1 1 /* $NetBSD: kern_ktrace.c,v 1.33.8.1 1999/06/21 01:24:01 thorpej Exp $ */
2
3 /*
4 * Copyright (c) 1989, 1993
5 * The Regents of the University of California. All rights reserved.
6 *
7 * Redistribution and use in source and binary forms, with or without
8 * modification, are permitted provided that the following conditions
9 * are met:
10 * 1. Redistributions of source code must retain the above copyright
11 * notice, this list of conditions and the following disclaimer.
12 * 2. Redistributions in binary form must reproduce the above copyright
13 * notice, this list of conditions and the following disclaimer in the
14 * documentation and/or other materials provided with the distribution.
15 * 3. All advertising materials mentioning features or use of this software
16 * must display the following acknowledgement:
17 * This product includes software developed by the University of
18 * California, Berkeley and its contributors.
19 * 4. Neither the name of the University nor the names of its contributors
20 * may be used to endorse or promote products derived from this software
21 * without specific prior written permission.
22 *
23 * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
24 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
25 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
26 * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
27 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
28 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
29 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
30 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
31 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
32 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
33 * SUCH DAMAGE.
34 *
35 * @(#)kern_ktrace.c 8.5 (Berkeley) 5/14/95
36 */
37
38 #include "opt_ktrace.h"
39
40 #ifdef KTRACE
41
42 #include <sys/param.h>
43 #include <sys/systm.h>
44 #include <sys/proc.h>
45 #include <sys/file.h>
46 #include <sys/namei.h>
47 #include <sys/vnode.h>
48 #include <sys/ktrace.h>
49 #include <sys/malloc.h>
50 #include <sys/syslog.h>
51 #include <sys/filedesc.h>
52
53 #include <sys/mount.h>
54 #include <sys/syscallargs.h>
55
56 struct ktr_header *ktrgetheader __P((int));
57 int ktrops __P((struct proc *, struct proc *, int, int, void *));
58 int ktrsetchildren __P((struct proc *, struct proc *, int, int, void *));
59 void ktrwrite __P((struct proc *, void *, struct ktr_header *));
60 int ktrcanset __P((struct proc *, struct proc *));
61
62 void
63 ktrderef(p)
64 struct proc *p;
65 {
66 if (p->p_tracep == NULL)
67 return;
68
69 if (p->p_traceflag & KTRFAC_FD) {
70 struct file *fp = p->p_tracep;
71
72 FILE_USE(fp);
73 closef(fp, NULL);
74 } else {
75 struct vnode *vp = p->p_tracep;
76
77 vrele(vp);
78 }
79 p->p_tracep = NULL;
80 p->p_traceflag = 0;
81 }
82
83 void
84 ktradref(p)
85 struct proc *p;
86 {
87 if (p->p_traceflag & KTRFAC_FD) {
88 struct file *fp = p->p_tracep;
89
90 fp->f_count++;
91 } else {
92 struct vnode *vp = p->p_tracep;
93
94 VREF(vp);
95 }
96 }
97
98 struct ktr_header *
99 ktrgetheader(type)
100 int type;
101 {
102 struct ktr_header *kth;
103 struct proc *p = curproc; /* XXX */
104
105 MALLOC(kth, struct ktr_header *, sizeof(struct ktr_header),
106 M_TEMP, M_WAITOK);
107 kth->ktr_type = type;
108 microtime(&kth->ktr_time);
109 kth->ktr_pid = p->p_pid;
110 memcpy(kth->ktr_comm, p->p_comm, MAXCOMLEN);
111 /* Note: ktr_len and ktr_buf are left to be filled in by the caller. */
112 return (kth);
113 }
114
115 void
116 ktrsyscall(v, code, argsize, args)
117 void *v;
118 register_t code;
119 size_t argsize;
120 register_t args[];
121 {
122 struct ktr_header *kth;
123 struct ktr_syscall *ktp;
124 struct proc *p = curproc; /* XXX */
125 register_t *argp;
126 int len = sizeof(struct ktr_syscall) + argsize;
127 int i;
128
129 p->p_traceflag |= KTRFAC_ACTIVE;
130 kth = ktrgetheader(KTR_SYSCALL);
131 MALLOC(ktp, struct ktr_syscall *, len, M_TEMP, M_WAITOK);
132 ktp->ktr_code = code;
133 ktp->ktr_argsize = argsize;
134 argp = (register_t *)((char *)ktp + sizeof(struct ktr_syscall));
135 for (i = 0; i < (argsize / sizeof(*argp)); i++)
136 *argp++ = args[i];
137 kth->ktr_buf = (caddr_t)ktp;
138 kth->ktr_len = len;
139 ktrwrite(p, v, kth);
140 FREE(ktp, M_TEMP);
141 FREE(kth, M_TEMP);
142 p->p_traceflag &= ~KTRFAC_ACTIVE;
143 }
144
145 void
146 ktrsysret(v, code, error, retval)
147 void *v;
148 register_t code;
149 int error;
150 register_t retval;
151 {
152 struct ktr_header *kth;
153 struct ktr_sysret ktp;
154 struct proc *p = curproc; /* XXX */
155
156 p->p_traceflag |= KTRFAC_ACTIVE;
157 kth = ktrgetheader(KTR_SYSRET);
158 ktp.ktr_code = code;
159 ktp.ktr_eosys = 0; /* XXX unused */
160 ktp.ktr_error = error;
161 ktp.ktr_retval = retval; /* what about val2 ? */
162
163 kth->ktr_buf = (caddr_t)&ktp;
164 kth->ktr_len = sizeof(struct ktr_sysret);
165
166 ktrwrite(p, v, kth);
167 FREE(kth, M_TEMP);
168 p->p_traceflag &= ~KTRFAC_ACTIVE;
169 }
170
171 void
172 ktrnamei(v, path)
173 void *v;
174 char *path;
175 {
176 struct ktr_header *kth;
177 struct proc *p = curproc; /* XXX */
178
179 p->p_traceflag |= KTRFAC_ACTIVE;
180 kth = ktrgetheader(KTR_NAMEI);
181 kth->ktr_len = strlen(path);
182 kth->ktr_buf = path;
183
184 ktrwrite(p, v, kth);
185 FREE(kth, M_TEMP);
186 p->p_traceflag &= ~KTRFAC_ACTIVE;
187 }
188
189 void
190 ktremul(v, p, emul)
191 void *v;
192 struct proc *p;
193 char *emul;
194 {
195 struct ktr_header *kth;
196
197 p->p_traceflag |= KTRFAC_ACTIVE;
198 kth = ktrgetheader(KTR_EMUL);
199 kth->ktr_len = strlen(emul);
200 kth->ktr_buf = emul;
201
202 ktrwrite(p, v, kth);
203 FREE(kth, M_TEMP);
204 p->p_traceflag &= ~KTRFAC_ACTIVE;
205 }
206
207 void
208 ktrgenio(v, fd, rw, iov, len, error)
209 void *v;
210 int fd;
211 enum uio_rw rw;
212 struct iovec *iov;
213 int len, error;
214 {
215 struct ktr_header *kth;
216 struct ktr_genio *ktp;
217 caddr_t cp;
218 int resid = len, cnt;
219 struct proc *p = curproc; /* XXX */
220
221 if (error)
222 return;
223 p->p_traceflag |= KTRFAC_ACTIVE;
224 kth = ktrgetheader(KTR_GENIO);
225 MALLOC(ktp, struct ktr_genio *, sizeof(struct ktr_genio) + len,
226 M_TEMP, M_WAITOK);
227 ktp->ktr_fd = fd;
228 ktp->ktr_rw = rw;
229 cp = (caddr_t)((char *)ktp + sizeof(struct ktr_genio));
230 while (resid > 0) {
231 if ((cnt = iov->iov_len) > resid)
232 cnt = resid;
233 if (copyin(iov->iov_base, cp, (unsigned)cnt))
234 goto done;
235 cp += cnt;
236 resid -= cnt;
237 iov++;
238 }
239 kth->ktr_buf = (caddr_t)ktp;
240 kth->ktr_len = sizeof(struct ktr_genio) + len;
241
242 ktrwrite(p, v, kth);
243 done:
244 FREE(kth, M_TEMP);
245 FREE(ktp, M_TEMP);
246 p->p_traceflag &= ~KTRFAC_ACTIVE;
247 }
248
249 void
250 ktrpsig(v, sig, action, mask, code)
251 void *v;
252 int sig;
253 sig_t action;
254 sigset_t *mask;
255 int code;
256 {
257 struct ktr_header *kth;
258 struct ktr_psig kp;
259 struct proc *p = curproc; /* XXX */
260
261 p->p_traceflag |= KTRFAC_ACTIVE;
262 kth = ktrgetheader(KTR_PSIG);
263 kp.signo = (char)sig;
264 kp.action = action;
265 kp.mask = *mask;
266 kp.code = code;
267 kth->ktr_buf = (caddr_t)&kp;
268 kth->ktr_len = sizeof(struct ktr_psig);
269
270 ktrwrite(p, v, kth);
271 FREE(kth, M_TEMP);
272 p->p_traceflag &= ~KTRFAC_ACTIVE;
273 }
274
275 void
276 ktrcsw(v, out, user)
277 void *v;
278 int out, user;
279 {
280 struct ktr_header *kth;
281 struct ktr_csw kc;
282 struct proc *p = curproc; /* XXX */
283
284 p->p_traceflag |= KTRFAC_ACTIVE;
285 kth = ktrgetheader(KTR_CSW);
286 kc.out = out;
287 kc.user = user;
288 kth->ktr_buf = (caddr_t)&kc;
289 kth->ktr_len = sizeof(struct ktr_csw);
290
291 ktrwrite(p, v, kth);
292 FREE(kth, M_TEMP);
293 p->p_traceflag &= ~KTRFAC_ACTIVE;
294 }
295
296 /* Interface and common routines */
297
298 /*
299 * ktrace system call
300 */
301 /* ARGSUSED */
302 int
303 sys_fktrace(curp, v, retval)
304 struct proc *curp;
305 void *v;
306 register_t *retval;
307 {
308 struct sys_fktrace_args /* {
309 syscallarg(int) fd;
310 syscallarg(int) ops;
311 syscallarg(int) facs;
312 syscallarg(int) pid;
313 } */ *uap = v;
314 struct file *fp = NULL;
315 struct proc *p;
316 struct filedesc *fdp = curp->p_fd;
317 struct pgrp *pg;
318 int facs;
319 int ops;
320 int descend;
321 int ret = 0;
322 int error = 0;
323
324 if (((u_int)SCARG(uap, fd)) >= fdp->fd_nfiles ||
325 (fp = fdp->fd_ofiles[SCARG(uap, fd)]) == NULL ||
326 (fp->f_flag & FWRITE) == 0)
327 return (EBADF);
328
329 ops = KTROP(SCARG(uap, ops)) | KTRFLAG_FD;
330 descend = SCARG(uap, ops) & KTRFLAG_DESCEND;
331 facs = SCARG(uap, facs) & ~((unsigned) KTRFAC_ROOT);
332 curp->p_traceflag |= KTRFAC_ACTIVE;
333
334 /*
335 * Clear all uses of the tracefile
336 */
337 if (KTROP(ops) == KTROP_CLEARFILE) {
338 for (p = allproc.lh_first; p != 0; p = p->p_list.le_next) {
339 if (p->p_tracep == fp) {
340 if (ktrcanset(curp, p))
341 ktrderef(p);
342 else
343 error = EPERM;
344 }
345 }
346 goto done;
347 }
348 /*
349 * need something to (un)trace (XXX - why is this here?)
350 */
351 if (!facs) {
352 error = EINVAL;
353 goto done;
354 }
355 /*
356 * do it
357 */
358 if (SCARG(uap, pid) < 0) {
359 /*
360 * by process group
361 */
362 pg = pgfind(-SCARG(uap, pid));
363 if (pg == NULL) {
364 error = ESRCH;
365 goto done;
366 }
367 for (p = pg->pg_members.lh_first; p != 0; p = p->p_pglist.le_next)
368 if (descend)
369 ret |= ktrsetchildren(curp, p, ops, facs, fp);
370 else
371 ret |= ktrops(curp, p, ops, facs, fp);
372
373 } else {
374 /*
375 * by pid
376 */
377 p = pfind(SCARG(uap, pid));
378 if (p == NULL) {
379 error = ESRCH;
380 goto done;
381 }
382 if (descend)
383 ret |= ktrsetchildren(curp, p, ops, facs, fp);
384 else
385 ret |= ktrops(curp, p, ops, facs, fp);
386 }
387 if (!ret)
388 error = EPERM;
389 done:
390 curp->p_traceflag &= ~KTRFAC_ACTIVE;
391 return (error);
392 }
393
394 /*
395 * ktrace system call
396 */
397 /* ARGSUSED */
398 int
399 sys_ktrace(curp, v, retval)
400 struct proc *curp;
401 void *v;
402 register_t *retval;
403 {
404 struct sys_ktrace_args /* {
405 syscallarg(const char *) fname;
406 syscallarg(int) ops;
407 syscallarg(int) facs;
408 syscallarg(int) pid;
409 } */ *uap = v;
410 struct vnode *vp = NULL;
411 struct proc *p;
412 struct pgrp *pg;
413 int facs = SCARG(uap, facs) & ~((unsigned) KTRFAC_ROOT);
414 int ops = KTROP(SCARG(uap, ops));
415 int descend = SCARG(uap, ops) & KTRFLAG_DESCEND;
416 int ret = 0;
417 int error = 0;
418 struct nameidata nd;
419
420 curp->p_traceflag |= KTRFAC_ACTIVE;
421 if (ops != KTROP_CLEAR) {
422 /*
423 * an operation which requires a file argument.
424 */
425 NDINIT(&nd, LOOKUP, FOLLOW, UIO_USERSPACE, SCARG(uap, fname),
426 curp);
427 if ((error = vn_open(&nd, FREAD|FWRITE, 0)) != 0) {
428 curp->p_traceflag &= ~KTRFAC_ACTIVE;
429 return (error);
430 }
431 vp = nd.ni_vp;
432 VOP_UNLOCK(vp, 0);
433 if (vp->v_type != VREG) {
434 (void) vn_close(vp, FREAD|FWRITE, curp->p_ucred, curp);
435 curp->p_traceflag &= ~KTRFAC_ACTIVE;
436 return (EACCES);
437 }
438 }
439 /*
440 * Clear all uses of the tracefile
441 */
442 if (KTROP(ops) == KTROP_CLEARFILE) {
443 for (p = allproc.lh_first; p != 0; p = p->p_list.le_next) {
444 if (p->p_tracep == vp &&
445 !ktrops(curp, p, KTROP_CLEAR, ~0, vp))
446 error = EPERM;
447 }
448 goto done;
449 }
450 /*
451 * need something to (un)trace (XXX - why is this here?)
452 */
453 if (!facs) {
454 error = EINVAL;
455 goto done;
456 }
457 /*
458 * do it
459 */
460 if (SCARG(uap, pid) < 0) {
461 /*
462 * by process group
463 */
464 pg = pgfind(-SCARG(uap, pid));
465 if (pg == NULL) {
466 error = ESRCH;
467 goto done;
468 }
469 for (p = pg->pg_members.lh_first; p != 0; p = p->p_pglist.le_next)
470 if (descend)
471 ret |= ktrsetchildren(curp, p, ops, facs, vp);
472 else
473 ret |= ktrops(curp, p, ops, facs, vp);
474
475 } else {
476 /*
477 * by pid
478 */
479 p = pfind(SCARG(uap, pid));
480 if (p == NULL) {
481 error = ESRCH;
482 goto done;
483 }
484 if (descend)
485 ret |= ktrsetchildren(curp, p, ops, facs, vp);
486 else
487 ret |= ktrops(curp, p, ops, facs, vp);
488 }
489 if (!ret)
490 error = EPERM;
491 done:
492 if (vp != NULL)
493 (void) vn_close(vp, FWRITE, curp->p_ucred, curp);
494 curp->p_traceflag &= ~KTRFAC_ACTIVE;
495 return (error);
496 }
497
498 int
499 ktrops(curp, p, ops, facs, v)
500 struct proc *p, *curp;
501 int ops, facs;
502 void *v;
503 {
504
505 if (!ktrcanset(curp, p))
506 return (0);
507 if (KTROP(ops) == KTROP_SET) {
508 if (p->p_tracep != v) {
509 /*
510 * if trace file already in use, relinquish
511 */
512 ktrderef(p);
513 if (ops & KTRFLAG_FD)
514 p->p_traceflag = KTRFAC_FD;
515 p->p_tracep = v;
516 ktradref(p);
517 }
518 p->p_traceflag |= facs;
519 if (curp->p_ucred->cr_uid == 0)
520 p->p_traceflag |= KTRFAC_ROOT;
521 } else {
522 /* KTROP_CLEAR */
523 if (((p->p_traceflag &= ~facs) & KTRFAC_MASK) == 0) {
524 /* no more tracing */
525 ktrderef(p);
526 }
527 }
528
529 /*
530 * Emit an emulation record, every time there is a ktrace
531 * change/attach request.
532 */
533 if (KTRPOINT(p, KTR_EMUL))
534 ktremul(p->p_tracep, p, p->p_emul->e_name);
535
536 return (1);
537 }
538
539 int
540 ktrsetchildren(curp, top, ops, facs, v)
541 struct proc *curp, *top;
542 int ops, facs;
543 void *v;
544 {
545 struct proc *p;
546 int ret = 0;
547
548 p = top;
549 for (;;) {
550 ret |= ktrops(curp, p, ops, facs, v);
551 /*
552 * If this process has children, descend to them next,
553 * otherwise do any siblings, and if done with this level,
554 * follow back up the tree (but not past top).
555 */
556 if (p->p_children.lh_first)
557 p = p->p_children.lh_first;
558 else for (;;) {
559 if (p == top)
560 return (ret);
561 if (p->p_sibling.le_next) {
562 p = p->p_sibling.le_next;
563 break;
564 }
565 p = p->p_pptr;
566 }
567 }
568 /*NOTREACHED*/
569 }
570
571 void
572 ktrwrite(p, v, kth)
573 struct proc *p;
574 void *v;
575 struct ktr_header *kth;
576 {
577 struct uio auio;
578 struct iovec aiov[2];
579 int error;
580
581 if (v == NULL)
582 return;
583 auio.uio_iov = &aiov[0];
584 auio.uio_offset = 0;
585 auio.uio_segflg = UIO_SYSSPACE;
586 auio.uio_rw = UIO_WRITE;
587 aiov[0].iov_base = (caddr_t)kth;
588 aiov[0].iov_len = sizeof(struct ktr_header);
589 auio.uio_resid = sizeof(struct ktr_header);
590 auio.uio_iovcnt = 1;
591 auio.uio_procp = (struct proc *)0;
592 if (kth->ktr_len > 0) {
593 auio.uio_iovcnt++;
594 aiov[1].iov_base = kth->ktr_buf;
595 aiov[1].iov_len = kth->ktr_len;
596 auio.uio_resid += kth->ktr_len;
597 }
598 if (p->p_traceflag & KTRFAC_FD) {
599 struct file *fp = v;
600
601 FILE_USE(fp);
602 error = (*fp->f_ops->fo_write)(fp, &fp->f_offset, &auio,
603 fp->f_cred, FOF_UPDATE_OFFSET);
604 FILE_UNUSE(fp, NULL);
605 }
606 else {
607 struct vnode *vp = v;
608
609 vn_lock(vp, LK_EXCLUSIVE | LK_RETRY);
610 error = VOP_WRITE(vp, &auio, IO_UNIT|IO_APPEND, p->p_ucred);
611 VOP_UNLOCK(vp, 0);
612 }
613 if (!error)
614 return;
615 /*
616 * If error encountered, give up tracing on this vnode.
617 */
618 log(LOG_NOTICE, "ktrace write failed, errno %d, tracing stopped\n",
619 error);
620 for (p = allproc.lh_first; p != 0; p = p->p_list.le_next) {
621 if (p->p_tracep == v)
622 ktrderef(p);
623 }
624 }
625
626 /*
627 * Return true if caller has permission to set the ktracing state
628 * of target. Essentially, the target can't possess any
629 * more permissions than the caller. KTRFAC_ROOT signifies that
630 * root previously set the tracing status on the target process, and
631 * so, only root may further change it.
632 *
633 * TODO: check groups. use caller effective gid.
634 */
635 int
636 ktrcanset(callp, targetp)
637 struct proc *callp, *targetp;
638 {
639 struct pcred *caller = callp->p_cred;
640 struct pcred *target = targetp->p_cred;
641
642 if ((caller->pc_ucred->cr_uid == target->p_ruid &&
643 target->p_ruid == target->p_svuid &&
644 caller->p_rgid == target->p_rgid && /* XXX */
645 target->p_rgid == target->p_svgid &&
646 (targetp->p_traceflag & KTRFAC_ROOT) == 0) ||
647 caller->pc_ucred->cr_uid == 0)
648 return (1);
649
650 return (0);
651 }
652
653 #endif
654