kern_ktrace.c revision 1.39
1 /* $NetBSD: kern_ktrace.c,v 1.39 2000/04/19 19:14:17 thorpej Exp $ */ 2 3 /* 4 * Copyright (c) 1989, 1993 5 * The Regents of the University of California. All rights reserved. 6 * 7 * Redistribution and use in source and binary forms, with or without 8 * modification, are permitted provided that the following conditions 9 * are met: 10 * 1. Redistributions of source code must retain the above copyright 11 * notice, this list of conditions and the following disclaimer. 12 * 2. Redistributions in binary form must reproduce the above copyright 13 * notice, this list of conditions and the following disclaimer in the 14 * documentation and/or other materials provided with the distribution. 15 * 3. All advertising materials mentioning features or use of this software 16 * must display the following acknowledgement: 17 * This product includes software developed by the University of 18 * California, Berkeley and its contributors. 19 * 4. Neither the name of the University nor the names of its contributors 20 * may be used to endorse or promote products derived from this software 21 * without specific prior written permission. 22 * 23 * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND 24 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 25 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 26 * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE 27 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 28 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 29 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 30 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 31 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 32 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 33 * SUCH DAMAGE. 34 * 35 * @(#)kern_ktrace.c 8.5 (Berkeley) 5/14/95 36 */ 37 38 #include "opt_ktrace.h" 39 40 #ifdef KTRACE 41 42 #include <sys/param.h> 43 #include <sys/systm.h> 44 #include <sys/proc.h> 45 #include <sys/file.h> 46 #include <sys/namei.h> 47 #include <sys/vnode.h> 48 #include <sys/ktrace.h> 49 #include <sys/malloc.h> 50 #include <sys/syslog.h> 51 #include <sys/filedesc.h> 52 53 #include <sys/mount.h> 54 #include <sys/syscallargs.h> 55 56 void ktrinitheader __P((struct ktr_header *, struct proc *, int)); 57 int ktrops __P((struct proc *, struct proc *, int, int, void *)); 58 int ktrsetchildren __P((struct proc *, struct proc *, int, int, void *)); 59 int ktrwrite __P((struct proc *, void *, struct ktr_header *)); 60 int ktrcanset __P((struct proc *, struct proc *)); 61 62 void 63 ktrderef(p) 64 struct proc *p; 65 { 66 if (p->p_tracep == NULL) 67 return; 68 69 if (p->p_traceflag & KTRFAC_FD) { 70 struct file *fp = p->p_tracep; 71 72 FILE_USE(fp); 73 closef(fp, NULL); 74 } else { 75 struct vnode *vp = p->p_tracep; 76 77 vrele(vp); 78 } 79 p->p_tracep = NULL; 80 p->p_traceflag = 0; 81 } 82 83 void 84 ktradref(p) 85 struct proc *p; 86 { 87 if (p->p_traceflag & KTRFAC_FD) { 88 struct file *fp = p->p_tracep; 89 90 fp->f_count++; 91 } else { 92 struct vnode *vp = p->p_tracep; 93 94 VREF(vp); 95 } 96 } 97 98 void 99 ktrinitheader(kth, p, type) 100 struct ktr_header *kth; 101 struct proc *p; 102 int type; 103 { 104 105 memset(kth, 0, sizeof(*kth)); 106 kth->ktr_type = type; 107 microtime(&kth->ktr_time); 108 kth->ktr_pid = p->p_pid; 109 memcpy(kth->ktr_comm, p->p_comm, MAXCOMLEN); 110 } 111 112 void 113 ktrsyscall(v, code, argsize, args) 114 void *v; 115 register_t code; 116 size_t argsize; 117 register_t args[]; 118 { 119 struct ktr_header kth; 120 struct ktr_syscall *ktp; 121 struct proc *p = curproc; /* XXX */ 122 register_t *argp; 123 size_t len = sizeof(struct ktr_syscall) + argsize; 124 int i; 125 126 p->p_traceflag |= KTRFAC_ACTIVE; 127 ktrinitheader(&kth, p, KTR_SYSCALL); 128 ktp = malloc(len, M_TEMP, M_WAITOK); 129 ktp->ktr_code = code; 130 ktp->ktr_argsize = argsize; 131 argp = (register_t *)((char *)ktp + sizeof(struct ktr_syscall)); 132 for (i = 0; i < (argsize / sizeof(*argp)); i++) 133 *argp++ = args[i]; 134 kth.ktr_buf = (caddr_t)ktp; 135 kth.ktr_len = len; 136 (void) ktrwrite(p, v, &kth); 137 free(ktp, M_TEMP); 138 p->p_traceflag &= ~KTRFAC_ACTIVE; 139 } 140 141 void 142 ktrsysret(v, code, error, retval) 143 void *v; 144 register_t code; 145 int error; 146 register_t retval; 147 { 148 struct ktr_header kth; 149 struct ktr_sysret ktp; 150 struct proc *p = curproc; /* XXX */ 151 152 p->p_traceflag |= KTRFAC_ACTIVE; 153 ktrinitheader(&kth, p, KTR_SYSRET); 154 ktp.ktr_code = code; 155 ktp.ktr_eosys = 0; /* XXX unused */ 156 ktp.ktr_error = error; 157 ktp.ktr_retval = retval; /* what about val2 ? */ 158 159 kth.ktr_buf = (caddr_t)&ktp; 160 kth.ktr_len = sizeof(struct ktr_sysret); 161 162 (void) ktrwrite(p, v, &kth); 163 p->p_traceflag &= ~KTRFAC_ACTIVE; 164 } 165 166 void 167 ktrnamei(v, path) 168 void *v; 169 char *path; 170 { 171 struct ktr_header kth; 172 struct proc *p = curproc; /* XXX */ 173 174 p->p_traceflag |= KTRFAC_ACTIVE; 175 ktrinitheader(&kth, p, KTR_NAMEI); 176 kth.ktr_len = strlen(path); 177 kth.ktr_buf = path; 178 179 (void) ktrwrite(p, v, &kth); 180 p->p_traceflag &= ~KTRFAC_ACTIVE; 181 } 182 183 void 184 ktremul(v, p, emul) 185 void *v; 186 struct proc *p; 187 char *emul; 188 { 189 struct ktr_header kth; 190 191 p->p_traceflag |= KTRFAC_ACTIVE; 192 ktrinitheader(&kth, p, KTR_EMUL); 193 kth.ktr_len = strlen(emul); 194 kth.ktr_buf = emul; 195 196 (void) ktrwrite(p, v, &kth); 197 p->p_traceflag &= ~KTRFAC_ACTIVE; 198 } 199 200 void 201 ktrgenio(v, fd, rw, iov, len, error) 202 void *v; 203 int fd; 204 enum uio_rw rw; 205 struct iovec *iov; 206 int len, error; 207 { 208 struct ktr_header kth; 209 struct ktr_genio *ktp; 210 caddr_t cp; 211 int resid = len, cnt; 212 struct proc *p = curproc; /* XXX */ 213 int buflen; 214 215 if (error) 216 return; 217 218 p->p_traceflag |= KTRFAC_ACTIVE; 219 220 buflen = min(PAGE_SIZE, len + sizeof(struct ktr_genio)); 221 222 ktrinitheader(&kth, p, KTR_GENIO); 223 ktp = malloc(buflen, M_TEMP, M_WAITOK); 224 ktp->ktr_fd = fd; 225 ktp->ktr_rw = rw; 226 227 kth.ktr_buf = (caddr_t)ktp; 228 229 cp = (caddr_t)((char *)ktp + sizeof(struct ktr_genio)); 230 buflen -= sizeof(struct ktr_genio); 231 232 while (resid > 0) { 233 if (p->p_schedflags & PSCHED_SHOULDYIELD) 234 preempt(NULL); 235 236 cnt = min(iov->iov_len, buflen); 237 if (cnt > resid) 238 cnt = resid; 239 if (copyin(iov->iov_base, cp, cnt)) 240 break; 241 242 kth.ktr_len = cnt + sizeof(struct ktr_genio); 243 244 if (ktrwrite(p, v, &kth) != 0) 245 break; 246 247 iov->iov_base = (caddr_t)iov->iov_base + cnt; 248 iov->iov_len -= cnt; 249 250 if (iov->iov_len == 0) 251 iov++; 252 253 resid -= cnt; 254 } 255 256 free(ktp, M_TEMP); 257 p->p_traceflag &= ~KTRFAC_ACTIVE; 258 } 259 260 void 261 ktrpsig(v, sig, action, mask, code) 262 void *v; 263 int sig; 264 sig_t action; 265 sigset_t *mask; 266 int code; 267 { 268 struct ktr_header kth; 269 struct ktr_psig kp; 270 struct proc *p = curproc; /* XXX */ 271 272 p->p_traceflag |= KTRFAC_ACTIVE; 273 ktrinitheader(&kth, p, KTR_PSIG); 274 kp.signo = (char)sig; 275 kp.action = action; 276 kp.mask = *mask; 277 kp.code = code; 278 kth.ktr_buf = (caddr_t)&kp; 279 kth.ktr_len = sizeof(struct ktr_psig); 280 281 (void) ktrwrite(p, v, &kth); 282 p->p_traceflag &= ~KTRFAC_ACTIVE; 283 } 284 285 void 286 ktrcsw(v, out, user) 287 void *v; 288 int out, user; 289 { 290 struct ktr_header kth; 291 struct ktr_csw kc; 292 struct proc *p = curproc; /* XXX */ 293 294 p->p_traceflag |= KTRFAC_ACTIVE; 295 ktrinitheader(&kth, p, KTR_CSW); 296 kc.out = out; 297 kc.user = user; 298 kth.ktr_buf = (caddr_t)&kc; 299 kth.ktr_len = sizeof(struct ktr_csw); 300 301 (void) ktrwrite(p, v, &kth); 302 p->p_traceflag &= ~KTRFAC_ACTIVE; 303 } 304 305 /* Interface and common routines */ 306 307 /* 308 * ktrace system call 309 */ 310 /* ARGSUSED */ 311 int 312 sys_fktrace(curp, v, retval) 313 struct proc *curp; 314 void *v; 315 register_t *retval; 316 { 317 struct sys_fktrace_args /* { 318 syscallarg(int) fd; 319 syscallarg(int) ops; 320 syscallarg(int) facs; 321 syscallarg(int) pid; 322 } */ *uap = v; 323 struct file *fp = NULL; 324 struct proc *p; 325 struct filedesc *fdp = curp->p_fd; 326 struct pgrp *pg; 327 int facs; 328 int ops; 329 int descend; 330 int ret = 0; 331 int error = 0; 332 333 if (((u_int)SCARG(uap, fd)) >= fdp->fd_nfiles || 334 (fp = fdp->fd_ofiles[SCARG(uap, fd)]) == NULL || 335 (fp->f_flag & FWRITE) == 0) 336 return (EBADF); 337 338 ops = KTROP(SCARG(uap, ops)) | KTRFLAG_FD; 339 descend = SCARG(uap, ops) & KTRFLAG_DESCEND; 340 facs = SCARG(uap, facs) & ~((unsigned) KTRFAC_ROOT); 341 curp->p_traceflag |= KTRFAC_ACTIVE; 342 343 /* 344 * Clear all uses of the tracefile 345 */ 346 if (KTROP(ops) == KTROP_CLEARFILE) { 347 proclist_lock_read(); 348 for (p = LIST_FIRST(&allproc); p != NULL; 349 p = LIST_NEXT(p, p_list)) { 350 if (p->p_tracep == fp) { 351 if (ktrcanset(curp, p)) 352 ktrderef(p); 353 else 354 error = EPERM; 355 } 356 } 357 proclist_unlock_read(); 358 goto done; 359 } 360 /* 361 * need something to (un)trace (XXX - why is this here?) 362 */ 363 if (!facs) { 364 error = EINVAL; 365 goto done; 366 } 367 /* 368 * do it 369 */ 370 if (SCARG(uap, pid) < 0) { 371 /* 372 * by process group 373 */ 374 pg = pgfind(-SCARG(uap, pid)); 375 if (pg == NULL) { 376 error = ESRCH; 377 goto done; 378 } 379 for (p = LIST_FIRST(&pg->pg_members); p != NULL; 380 p = LIST_NEXT(p, p_pglist)) { 381 if (descend) 382 ret |= ktrsetchildren(curp, p, ops, facs, fp); 383 else 384 ret |= ktrops(curp, p, ops, facs, fp); 385 } 386 387 } else { 388 /* 389 * by pid 390 */ 391 p = pfind(SCARG(uap, pid)); 392 if (p == NULL) { 393 error = ESRCH; 394 goto done; 395 } 396 if (descend) 397 ret |= ktrsetchildren(curp, p, ops, facs, fp); 398 else 399 ret |= ktrops(curp, p, ops, facs, fp); 400 } 401 if (!ret) 402 error = EPERM; 403 done: 404 curp->p_traceflag &= ~KTRFAC_ACTIVE; 405 return (error); 406 } 407 408 /* 409 * ktrace system call 410 */ 411 /* ARGSUSED */ 412 int 413 sys_ktrace(curp, v, retval) 414 struct proc *curp; 415 void *v; 416 register_t *retval; 417 { 418 struct sys_ktrace_args /* { 419 syscallarg(const char *) fname; 420 syscallarg(int) ops; 421 syscallarg(int) facs; 422 syscallarg(int) pid; 423 } */ *uap = v; 424 struct vnode *vp = NULL; 425 struct proc *p; 426 struct pgrp *pg; 427 int facs = SCARG(uap, facs) & ~((unsigned) KTRFAC_ROOT); 428 int ops = KTROP(SCARG(uap, ops)); 429 int descend = SCARG(uap, ops) & KTRFLAG_DESCEND; 430 int ret = 0; 431 int error = 0; 432 struct nameidata nd; 433 434 curp->p_traceflag |= KTRFAC_ACTIVE; 435 if (ops != KTROP_CLEAR) { 436 /* 437 * an operation which requires a file argument. 438 */ 439 NDINIT(&nd, LOOKUP, FOLLOW, UIO_USERSPACE, SCARG(uap, fname), 440 curp); 441 if ((error = vn_open(&nd, FREAD|FWRITE, 0)) != 0) { 442 curp->p_traceflag &= ~KTRFAC_ACTIVE; 443 return (error); 444 } 445 vp = nd.ni_vp; 446 VOP_UNLOCK(vp, 0); 447 if (vp->v_type != VREG) { 448 (void) vn_close(vp, FREAD|FWRITE, curp->p_ucred, curp); 449 curp->p_traceflag &= ~KTRFAC_ACTIVE; 450 return (EACCES); 451 } 452 } 453 /* 454 * Clear all uses of the tracefile 455 */ 456 if (KTROP(ops) == KTROP_CLEARFILE) { 457 proclist_lock_read(); 458 for (p = LIST_FIRST(&allproc); p != NULL; 459 p = LIST_NEXT(p, p_list)) { 460 if (p->p_tracep == vp && 461 !ktrops(curp, p, KTROP_CLEAR, ~0, vp)) 462 error = EPERM; 463 } 464 proclist_unlock_read(); 465 goto done; 466 } 467 /* 468 * need something to (un)trace (XXX - why is this here?) 469 */ 470 if (!facs) { 471 error = EINVAL; 472 goto done; 473 } 474 /* 475 * do it 476 */ 477 if (SCARG(uap, pid) < 0) { 478 /* 479 * by process group 480 */ 481 pg = pgfind(-SCARG(uap, pid)); 482 if (pg == NULL) { 483 error = ESRCH; 484 goto done; 485 } 486 for (p = LIST_FIRST(&pg->pg_members); p != NULL; 487 p = LIST_NEXT(p, p_pglist)) { 488 if (descend) 489 ret |= ktrsetchildren(curp, p, ops, facs, vp); 490 else 491 ret |= ktrops(curp, p, ops, facs, vp); 492 } 493 494 } else { 495 /* 496 * by pid 497 */ 498 p = pfind(SCARG(uap, pid)); 499 if (p == NULL) { 500 error = ESRCH; 501 goto done; 502 } 503 if (descend) 504 ret |= ktrsetchildren(curp, p, ops, facs, vp); 505 else 506 ret |= ktrops(curp, p, ops, facs, vp); 507 } 508 if (!ret) 509 error = EPERM; 510 done: 511 if (vp != NULL) 512 (void) vn_close(vp, FWRITE, curp->p_ucred, curp); 513 curp->p_traceflag &= ~KTRFAC_ACTIVE; 514 return (error); 515 } 516 517 int 518 ktrops(curp, p, ops, facs, v) 519 struct proc *p, *curp; 520 int ops, facs; 521 void *v; 522 { 523 524 if (!ktrcanset(curp, p)) 525 return (0); 526 if (KTROP(ops) == KTROP_SET) { 527 if (p->p_tracep != v) { 528 /* 529 * if trace file already in use, relinquish 530 */ 531 ktrderef(p); 532 if (ops & KTRFLAG_FD) 533 p->p_traceflag = KTRFAC_FD; 534 p->p_tracep = v; 535 ktradref(p); 536 } 537 p->p_traceflag |= facs; 538 if (curp->p_ucred->cr_uid == 0) 539 p->p_traceflag |= KTRFAC_ROOT; 540 } else { 541 /* KTROP_CLEAR */ 542 if (((p->p_traceflag &= ~facs) & KTRFAC_MASK) == 0) { 543 /* no more tracing */ 544 ktrderef(p); 545 } 546 } 547 548 /* 549 * Emit an emulation record, every time there is a ktrace 550 * change/attach request. 551 */ 552 if (KTRPOINT(p, KTR_EMUL)) 553 ktremul(p->p_tracep, p, p->p_emul->e_name); 554 555 return (1); 556 } 557 558 int 559 ktrsetchildren(curp, top, ops, facs, v) 560 struct proc *curp, *top; 561 int ops, facs; 562 void *v; 563 { 564 struct proc *p; 565 int ret = 0; 566 567 p = top; 568 for (;;) { 569 ret |= ktrops(curp, p, ops, facs, v); 570 /* 571 * If this process has children, descend to them next, 572 * otherwise do any siblings, and if done with this level, 573 * follow back up the tree (but not past top). 574 */ 575 if (LIST_FIRST(&p->p_children) != NULL) 576 p = LIST_FIRST(&p->p_children); 577 else for (;;) { 578 if (p == top) 579 return (ret); 580 if (LIST_NEXT(p, p_sibling) != NULL) { 581 p = LIST_NEXT(p, p_sibling); 582 break; 583 } 584 p = p->p_pptr; 585 } 586 } 587 /*NOTREACHED*/ 588 } 589 590 int 591 ktrwrite(p, v, kth) 592 struct proc *p; 593 void *v; 594 struct ktr_header *kth; 595 { 596 struct uio auio; 597 struct iovec aiov[2]; 598 int error; 599 600 if (v == NULL) 601 return (0); 602 auio.uio_iov = &aiov[0]; 603 auio.uio_offset = 0; 604 auio.uio_segflg = UIO_SYSSPACE; 605 auio.uio_rw = UIO_WRITE; 606 aiov[0].iov_base = (caddr_t)kth; 607 aiov[0].iov_len = sizeof(struct ktr_header); 608 auio.uio_resid = sizeof(struct ktr_header); 609 auio.uio_iovcnt = 1; 610 auio.uio_procp = (struct proc *)0; 611 if (kth->ktr_len > 0) { 612 auio.uio_iovcnt++; 613 aiov[1].iov_base = kth->ktr_buf; 614 aiov[1].iov_len = kth->ktr_len; 615 auio.uio_resid += kth->ktr_len; 616 } 617 if (p->p_traceflag & KTRFAC_FD) { 618 struct file *fp = v; 619 620 FILE_USE(fp); 621 error = (*fp->f_ops->fo_write)(fp, &fp->f_offset, &auio, 622 fp->f_cred, FOF_UPDATE_OFFSET); 623 FILE_UNUSE(fp, NULL); 624 } 625 else { 626 struct vnode *vp = v; 627 628 vn_lock(vp, LK_EXCLUSIVE | LK_RETRY); 629 error = VOP_WRITE(vp, &auio, IO_UNIT|IO_APPEND, p->p_ucred); 630 VOP_UNLOCK(vp, 0); 631 } 632 if (error == 0) 633 return (0); 634 /* 635 * If error encountered, give up tracing on this vnode. Don't report 636 * EPIPE as this can easily happen with fktrace()/ktruss. 637 */ 638 if (error != EPIPE) 639 log(LOG_NOTICE, 640 "ktrace write failed, errno %d, tracing stopped\n", 641 error); 642 proclist_lock_read(); 643 for (p = LIST_FIRST(&allproc); p != NULL; p = LIST_NEXT(p, p_list)) { 644 if (p->p_tracep == v) 645 ktrderef(p); 646 } 647 proclist_unlock_read(); 648 649 return (error); 650 } 651 652 /* 653 * Return true if caller has permission to set the ktracing state 654 * of target. Essentially, the target can't possess any 655 * more permissions than the caller. KTRFAC_ROOT signifies that 656 * root previously set the tracing status on the target process, and 657 * so, only root may further change it. 658 * 659 * TODO: check groups. use caller effective gid. 660 */ 661 int 662 ktrcanset(callp, targetp) 663 struct proc *callp, *targetp; 664 { 665 struct pcred *caller = callp->p_cred; 666 struct pcred *target = targetp->p_cred; 667 668 if ((caller->pc_ucred->cr_uid == target->p_ruid && 669 target->p_ruid == target->p_svuid && 670 caller->p_rgid == target->p_rgid && /* XXX */ 671 target->p_rgid == target->p_svgid && 672 (targetp->p_traceflag & KTRFAC_ROOT) == 0) || 673 caller->pc_ucred->cr_uid == 0) 674 return (1); 675 676 return (0); 677 } 678 679 #endif 680
Indexes created Sat Sep 20 22:09:52 GMT 2025