kern_ktrace.c revision 1.45
1 /* $NetBSD: kern_ktrace.c,v 1.45 2000/05/29 22:29:01 sommerfeld Exp $ */ 2 3 /* 4 * Copyright (c) 1989, 1993 5 * The Regents of the University of California. All rights reserved. 6 * 7 * Redistribution and use in source and binary forms, with or without 8 * modification, are permitted provided that the following conditions 9 * are met: 10 * 1. Redistributions of source code must retain the above copyright 11 * notice, this list of conditions and the following disclaimer. 12 * 2. Redistributions in binary form must reproduce the above copyright 13 * notice, this list of conditions and the following disclaimer in the 14 * documentation and/or other materials provided with the distribution. 15 * 3. All advertising materials mentioning features or use of this software 16 * must display the following acknowledgement: 17 * This product includes software developed by the University of 18 * California, Berkeley and its contributors. 19 * 4. Neither the name of the University nor the names of its contributors 20 * may be used to endorse or promote products derived from this software 21 * without specific prior written permission. 22 * 23 * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND 24 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 25 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 26 * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE 27 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 28 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 29 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 30 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 31 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 32 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 33 * SUCH DAMAGE. 34 * 35 * @(#)kern_ktrace.c 8.5 (Berkeley) 5/14/95 36 */ 37 38 #include "opt_ktrace.h" 39 40 #ifdef KTRACE 41 42 #include <sys/param.h> 43 #include <sys/systm.h> 44 #include <sys/proc.h> 45 #include <sys/file.h> 46 #include <sys/namei.h> 47 #include <sys/vnode.h> 48 #include <sys/ktrace.h> 49 #include <sys/malloc.h> 50 #include <sys/syslog.h> 51 #include <sys/filedesc.h> 52 #include <sys/ioctl.h> 53 54 #include <sys/mount.h> 55 #include <sys/syscallargs.h> 56 57 int ktrace_common __P((struct proc *, int, int, int, struct file *)); 58 void ktrinitheader __P((struct ktr_header *, struct proc *, int)); 59 int ktrops __P((struct proc *, struct proc *, int, int, struct file *)); 60 int ktrsetchildren __P((struct proc *, struct proc *, int, int, 61 struct file *)); 62 int ktrwrite __P((struct proc *, struct ktr_header *)); 63 int ktrcanset __P((struct proc *, struct proc *)); 64 int ktrsamefile __P((struct file *, struct file *)); 65 66 /* 67 * "deep" compare of two files for the purposes of clearing a trace. 68 * Returns true if they're the same open file, or if they point at the 69 * same underlying vnode/socket. 70 */ 71 72 int 73 ktrsamefile (f1, f2) 74 struct file *f1, *f2; 75 { 76 return ((f1 == f2) || 77 ((f1 != NULL) && (f2 != NULL) && 78 (f1->f_type == f2->f_type) && 79 (f1->f_data == f2->f_data))); 80 } 81 82 void 83 ktrderef(p) 84 struct proc *p; 85 { 86 struct file *fp = p->p_tracep; 87 p->p_traceflag = 0; 88 if (fp == NULL) 89 return; 90 FILE_USE(fp); 91 closef(fp, NULL); 92 93 p->p_tracep = NULL; 94 } 95 96 void 97 ktradref(p) 98 struct proc *p; 99 { 100 struct file *fp = p->p_tracep; 101 102 fp->f_count++; 103 } 104 105 void 106 ktrinitheader(kth, p, type) 107 struct ktr_header *kth; 108 struct proc *p; 109 int type; 110 { 111 112 memset(kth, 0, sizeof(*kth)); 113 kth->ktr_type = type; 114 microtime(&kth->ktr_time); 115 kth->ktr_pid = p->p_pid; 116 memcpy(kth->ktr_comm, p->p_comm, MAXCOMLEN); 117 } 118 119 void 120 ktrsyscall(p, code, argsize, args) 121 struct proc *p; 122 register_t code; 123 size_t argsize; 124 register_t args[]; 125 { 126 struct ktr_header kth; 127 struct ktr_syscall *ktp; 128 register_t *argp; 129 size_t len = sizeof(struct ktr_syscall) + argsize; 130 int i; 131 132 p->p_traceflag |= KTRFAC_ACTIVE; 133 ktrinitheader(&kth, p, KTR_SYSCALL); 134 ktp = malloc(len, M_TEMP, M_WAITOK); 135 ktp->ktr_code = code; 136 ktp->ktr_argsize = argsize; 137 argp = (register_t *)((char *)ktp + sizeof(struct ktr_syscall)); 138 for (i = 0; i < (argsize / sizeof(*argp)); i++) 139 *argp++ = args[i]; 140 kth.ktr_buf = (caddr_t)ktp; 141 kth.ktr_len = len; 142 (void) ktrwrite(p, &kth); 143 free(ktp, M_TEMP); 144 p->p_traceflag &= ~KTRFAC_ACTIVE; 145 } 146 147 void 148 ktrsysret(p, code, error, retval) 149 struct proc *p; 150 register_t code; 151 int error; 152 register_t retval; 153 { 154 struct ktr_header kth; 155 struct ktr_sysret ktp; 156 157 p->p_traceflag |= KTRFAC_ACTIVE; 158 ktrinitheader(&kth, p, KTR_SYSRET); 159 ktp.ktr_code = code; 160 ktp.ktr_eosys = 0; /* XXX unused */ 161 ktp.ktr_error = error; 162 ktp.ktr_retval = retval; /* what about val2 ? */ 163 164 kth.ktr_buf = (caddr_t)&ktp; 165 kth.ktr_len = sizeof(struct ktr_sysret); 166 167 (void) ktrwrite(p, &kth); 168 p->p_traceflag &= ~KTRFAC_ACTIVE; 169 } 170 171 void 172 ktrnamei(p, path) 173 struct proc *p; 174 char *path; 175 { 176 struct ktr_header kth; 177 178 p->p_traceflag |= KTRFAC_ACTIVE; 179 ktrinitheader(&kth, p, KTR_NAMEI); 180 kth.ktr_len = strlen(path); 181 kth.ktr_buf = path; 182 183 (void) ktrwrite(p, &kth); 184 p->p_traceflag &= ~KTRFAC_ACTIVE; 185 } 186 187 void 188 ktremul(p) 189 struct proc *p; 190 { 191 struct ktr_header kth; 192 char *emul = p->p_emul->e_name; 193 194 p->p_traceflag |= KTRFAC_ACTIVE; 195 ktrinitheader(&kth, p, KTR_EMUL); 196 kth.ktr_len = strlen(emul); 197 kth.ktr_buf = emul; 198 199 (void) ktrwrite(p, &kth); 200 p->p_traceflag &= ~KTRFAC_ACTIVE; 201 } 202 203 void 204 ktrgenio(p, fd, rw, iov, len, error) 205 struct proc *p; 206 int fd; 207 enum uio_rw rw; 208 struct iovec *iov; 209 int len, error; 210 { 211 struct ktr_header kth; 212 struct ktr_genio *ktp; 213 caddr_t cp; 214 int resid = len, cnt; 215 int buflen; 216 217 if (error) 218 return; 219 220 p->p_traceflag |= KTRFAC_ACTIVE; 221 222 buflen = min(PAGE_SIZE, len + sizeof(struct ktr_genio)); 223 224 ktrinitheader(&kth, p, KTR_GENIO); 225 ktp = malloc(buflen, M_TEMP, M_WAITOK); 226 ktp->ktr_fd = fd; 227 ktp->ktr_rw = rw; 228 229 kth.ktr_buf = (caddr_t)ktp; 230 231 cp = (caddr_t)((char *)ktp + sizeof(struct ktr_genio)); 232 buflen -= sizeof(struct ktr_genio); 233 234 while (resid > 0) { 235 if (curcpu()->ci_schedstate.spc_flags & SPCF_SHOULDYIELD) 236 preempt(NULL); 237 238 cnt = min(iov->iov_len, buflen); 239 if (cnt > resid) 240 cnt = resid; 241 if (copyin(iov->iov_base, cp, cnt)) 242 break; 243 244 kth.ktr_len = cnt + sizeof(struct ktr_genio); 245 246 if (__predict_false(ktrwrite(p, &kth) != 0)) 247 break; 248 249 iov->iov_base = (caddr_t)iov->iov_base + cnt; 250 iov->iov_len -= cnt; 251 252 if (iov->iov_len == 0) 253 iov++; 254 255 resid -= cnt; 256 } 257 258 free(ktp, M_TEMP); 259 p->p_traceflag &= ~KTRFAC_ACTIVE; 260 } 261 262 void 263 ktrpsig(p, sig, action, mask, code) 264 struct proc *p; 265 int sig; 266 sig_t action; 267 sigset_t *mask; 268 int code; 269 { 270 struct ktr_header kth; 271 struct ktr_psig kp; 272 273 p->p_traceflag |= KTRFAC_ACTIVE; 274 ktrinitheader(&kth, p, KTR_PSIG); 275 kp.signo = (char)sig; 276 kp.action = action; 277 kp.mask = *mask; 278 kp.code = code; 279 kth.ktr_buf = (caddr_t)&kp; 280 kth.ktr_len = sizeof(struct ktr_psig); 281 282 (void) ktrwrite(p, &kth); 283 p->p_traceflag &= ~KTRFAC_ACTIVE; 284 } 285 286 void 287 ktrcsw(p, out, user) 288 struct proc *p; 289 int out, user; 290 { 291 struct ktr_header kth; 292 struct ktr_csw kc; 293 294 p->p_traceflag |= KTRFAC_ACTIVE; 295 ktrinitheader(&kth, p, KTR_CSW); 296 kc.out = out; 297 kc.user = user; 298 kth.ktr_buf = (caddr_t)&kc; 299 kth.ktr_len = sizeof(struct ktr_csw); 300 301 (void) ktrwrite(p, &kth); 302 p->p_traceflag &= ~KTRFAC_ACTIVE; 303 } 304 305 /* Interface and common routines */ 306 307 int 308 ktrace_common (curp, ops, facs, pid, fp) 309 struct proc *curp; 310 int ops, facs, pid; 311 struct file *fp; 312 { 313 int ret = 0; 314 int error = 0; 315 int one = 1; 316 int descend; 317 struct proc *p; 318 struct pgrp *pg; 319 320 curp->p_traceflag |= KTRFAC_ACTIVE; 321 descend = ops & KTRFLAG_DESCEND; 322 facs = facs & ~((unsigned) KTRFAC_ROOT); 323 324 /* 325 * Clear all uses of the tracefile 326 */ 327 if (KTROP(ops) == KTROP_CLEARFILE) { 328 proclist_lock_read(); 329 for (p = LIST_FIRST(&allproc); p != NULL; 330 p = LIST_NEXT(p, p_list)) { 331 if (ktrsamefile(p->p_tracep, fp)) { 332 if (ktrcanset(curp, p)) 333 ktrderef(p); 334 else 335 error = EPERM; 336 } 337 } 338 proclist_unlock_read(); 339 goto done; 340 } 341 342 /* 343 * Mark fp non-blocking, to avoid problems from possible deadlocks. 344 */ 345 346 if (fp != NULL) { 347 fp->f_flag |= FNONBLOCK; 348 (*fp->f_ops->fo_ioctl)(fp, FIONBIO, (caddr_t)&one, curp); 349 } 350 351 /* 352 * need something to (un)trace (XXX - why is this here?) 353 */ 354 if (!facs) { 355 error = EINVAL; 356 goto done; 357 } 358 /* 359 * do it 360 */ 361 if (pid < 0) { 362 /* 363 * by process group 364 */ 365 pg = pgfind(-pid); 366 if (pg == NULL) { 367 error = ESRCH; 368 goto done; 369 } 370 for (p = LIST_FIRST(&pg->pg_members); p != NULL; 371 p = LIST_NEXT(p, p_pglist)) { 372 if (descend) 373 ret |= ktrsetchildren(curp, p, ops, facs, fp); 374 else 375 ret |= ktrops(curp, p, ops, facs, fp); 376 } 377 378 } else { 379 /* 380 * by pid 381 */ 382 p = pfind(pid); 383 if (p == NULL) { 384 error = ESRCH; 385 goto done; 386 } 387 if (descend) 388 ret |= ktrsetchildren(curp, p, ops, facs, fp); 389 else 390 ret |= ktrops(curp, p, ops, facs, fp); 391 } 392 if (!ret) 393 error = EPERM; 394 done: 395 curp->p_traceflag &= ~KTRFAC_ACTIVE; 396 return (error); 397 } 398 399 /* 400 * ktrace system call 401 */ 402 /* ARGSUSED */ 403 int 404 sys_fktrace(curp, v, retval) 405 struct proc *curp; 406 void *v; 407 register_t *retval; 408 { 409 struct sys_fktrace_args /* { 410 syscallarg(int) fd; 411 syscallarg(int) ops; 412 syscallarg(int) facs; 413 syscallarg(int) pid; 414 } */ *uap = v; 415 struct file *fp = NULL; 416 struct filedesc *fdp = curp->p_fd; 417 418 if (((u_int)SCARG(uap, fd)) >= fdp->fd_nfiles || 419 (fp = fdp->fd_ofiles[SCARG(uap, fd)]) == NULL || 420 (fp->f_flag & FWRITE) == 0) 421 return (EBADF); 422 423 return ktrace_common(curp, SCARG(uap, ops), 424 SCARG(uap, facs), SCARG(uap, pid), fp); 425 } 426 427 /* 428 * ktrace system call 429 */ 430 /* ARGSUSED */ 431 int 432 sys_ktrace(curp, v, retval) 433 struct proc *curp; 434 void *v; 435 register_t *retval; 436 { 437 struct sys_ktrace_args /* { 438 syscallarg(const char *) fname; 439 syscallarg(int) ops; 440 syscallarg(int) facs; 441 syscallarg(int) pid; 442 } */ *uap = v; 443 struct vnode *vp = NULL; 444 struct file *fp = NULL; 445 int fd; 446 int ops = SCARG(uap, ops); 447 int error = 0; 448 struct nameidata nd; 449 450 ops = KTROP(ops) | (ops & KTRFLAG_DESCEND); 451 452 curp->p_traceflag |= KTRFAC_ACTIVE; 453 if (ops != KTROP_CLEAR) { 454 /* 455 * an operation which requires a file argument. 456 */ 457 NDINIT(&nd, LOOKUP, FOLLOW, UIO_USERSPACE, SCARG(uap, fname), 458 curp); 459 if ((error = vn_open(&nd, FREAD|FWRITE, 0)) != 0) { 460 curp->p_traceflag &= ~KTRFAC_ACTIVE; 461 return (error); 462 } 463 vp = nd.ni_vp; 464 VOP_UNLOCK(vp, 0); 465 if (vp->v_type != VREG) { 466 (void) vn_close(vp, FREAD|FWRITE, curp->p_ucred, curp); 467 curp->p_traceflag &= ~KTRFAC_ACTIVE; 468 return (EACCES); 469 } 470 /* 471 * XXX This uses up a file descriptor slot in the 472 * tracing process for the duration of this syscall. 473 * This is not expected to be a problem. If 474 * falloc(NULL, ...) DTRT we could skip that part, but 475 * that would require changing its interface to allow 476 * the caller to pass in a ucred.. 477 * 478 * This will FILE_USE the fp it returns, if any. 479 * Keep it in use until we return. 480 */ 481 if ((error = falloc(curp, &fp, &fd)) != 0) 482 goto done; 483 484 fp->f_flag = FWRITE|FAPPEND; 485 fp->f_type = DTYPE_VNODE; 486 fp->f_ops = &vnops; 487 fp->f_data = (caddr_t)vp; 488 vp = NULL; 489 } 490 error = ktrace_common(curp, SCARG(uap, ops), SCARG(uap, facs), 491 SCARG(uap, pid), fp); 492 done: 493 if (vp != NULL) 494 (void) vn_close(vp, FWRITE, curp->p_ucred, curp); 495 if (fp != NULL) { 496 FILE_UNUSE(fp, curp); /* release file */ 497 fdrelease(curp, fd); /* release fd table slot */ 498 } 499 return (error); 500 } 501 502 int 503 ktrops(curp, p, ops, facs, fp) 504 struct proc *p, *curp; 505 int ops, facs; 506 struct file *fp; 507 { 508 509 if (!ktrcanset(curp, p)) 510 return (0); 511 if (KTROP(ops) == KTROP_SET) { 512 if (p->p_tracep != fp) { 513 /* 514 * if trace file already in use, relinquish 515 */ 516 ktrderef(p); 517 p->p_tracep = fp; 518 ktradref(p); 519 } 520 p->p_traceflag |= facs; 521 if (curp->p_ucred->cr_uid == 0) 522 p->p_traceflag |= KTRFAC_ROOT; 523 } else { 524 /* KTROP_CLEAR */ 525 if (((p->p_traceflag &= ~facs) & KTRFAC_MASK) == 0) { 526 /* no more tracing */ 527 ktrderef(p); 528 } 529 } 530 531 /* 532 * Emit an emulation record, every time there is a ktrace 533 * change/attach request. 534 */ 535 if (KTRPOINT(p, KTR_EMUL)) 536 ktremul(p); 537 538 return (1); 539 } 540 541 int 542 ktrsetchildren(curp, top, ops, facs, fp) 543 struct proc *curp, *top; 544 int ops, facs; 545 struct file *fp; 546 { 547 struct proc *p; 548 int ret = 0; 549 550 p = top; 551 for (;;) { 552 ret |= ktrops(curp, p, ops, facs, fp); 553 /* 554 * If this process has children, descend to them next, 555 * otherwise do any siblings, and if done with this level, 556 * follow back up the tree (but not past top). 557 */ 558 if (LIST_FIRST(&p->p_children) != NULL) 559 p = LIST_FIRST(&p->p_children); 560 else for (;;) { 561 if (p == top) 562 return (ret); 563 if (LIST_NEXT(p, p_sibling) != NULL) { 564 p = LIST_NEXT(p, p_sibling); 565 break; 566 } 567 p = p->p_pptr; 568 } 569 } 570 /*NOTREACHED*/ 571 } 572 573 int 574 ktrwrite(p, kth) 575 struct proc *p; 576 struct ktr_header *kth; 577 { 578 struct uio auio; 579 struct iovec aiov[2]; 580 int error, tries; 581 struct file *fp = p->p_tracep; 582 583 if (fp == NULL) 584 return 0; 585 586 auio.uio_iov = &aiov[0]; 587 auio.uio_offset = 0; 588 auio.uio_segflg = UIO_SYSSPACE; 589 auio.uio_rw = UIO_WRITE; 590 aiov[0].iov_base = (caddr_t)kth; 591 aiov[0].iov_len = sizeof(struct ktr_header); 592 auio.uio_resid = sizeof(struct ktr_header); 593 auio.uio_iovcnt = 1; 594 auio.uio_procp = (struct proc *)0; 595 if (kth->ktr_len > 0) { 596 auio.uio_iovcnt++; 597 aiov[1].iov_base = kth->ktr_buf; 598 aiov[1].iov_len = kth->ktr_len; 599 auio.uio_resid += kth->ktr_len; 600 } 601 602 FILE_USE(fp); 603 604 tries = 0; 605 do { 606 error = (*fp->f_ops->fo_write)(fp, &fp->f_offset, &auio, 607 fp->f_cred, FOF_UPDATE_OFFSET); 608 tries++; 609 if (error == EWOULDBLOCK) 610 yield(); 611 } while ((error == EWOULDBLOCK) && (tries < 3)); 612 FILE_UNUSE(fp, NULL); 613 614 if (__predict_true(error == 0)) 615 return (0); 616 /* 617 * If error encountered, give up tracing on this vnode. Don't report 618 * EPIPE as this can easily happen with fktrace()/ktruss. 619 */ 620 if (error != EPIPE) 621 log(LOG_NOTICE, 622 "ktrace write failed, errno %d, tracing stopped\n", 623 error); 624 proclist_lock_read(); 625 for (p = LIST_FIRST(&allproc); p != NULL; p = LIST_NEXT(p, p_list)) { 626 if (ktrsamefile(p->p_tracep, fp)) 627 ktrderef(p); 628 } 629 proclist_unlock_read(); 630 631 return (error); 632 } 633 634 /* 635 * Return true if caller has permission to set the ktracing state 636 * of target. Essentially, the target can't possess any 637 * more permissions than the caller. KTRFAC_ROOT signifies that 638 * root previously set the tracing status on the target process, and 639 * so, only root may further change it. 640 * 641 * TODO: check groups. use caller effective gid. 642 */ 643 int 644 ktrcanset(callp, targetp) 645 struct proc *callp, *targetp; 646 { 647 struct pcred *caller = callp->p_cred; 648 struct pcred *target = targetp->p_cred; 649 650 if ((caller->pc_ucred->cr_uid == target->p_ruid && 651 target->p_ruid == target->p_svuid && 652 caller->p_rgid == target->p_rgid && /* XXX */ 653 target->p_rgid == target->p_svgid && 654 (targetp->p_traceflag & KTRFAC_ROOT) == 0) || 655 caller->pc_ucred->cr_uid == 0) 656 return (1); 657 658 return (0); 659 } 660 661 #endif 662
Indexes created Mon Sep 22 13:09:51 GMT 2025