/* $OpenBSD: kern_ktrace.c,v 1.22 2000/11/10 18:15:46 art Exp $ */ /* $NetBSD: kern_ktrace.c,v 1.23 1996/02/09 18:59:36 christos Exp $ */ /* * Copyright (c) 1989, 1993 * The Regents of the University of California. All rights reserved. * * Redistribution and use in source and binary forms, with or without * modification, are permitted provided that the following conditions * are met: * 1. Redistributions of source code must retain the above copyright * notice, this list of conditions and the following disclaimer. * 2. Redistributions in binary form must reproduce the above copyright * notice, this list of conditions and the following disclaimer in the * documentation and/or other materials provided with the distribution. * 3. All advertising materials mentioning features or use of this software * must display the following acknowledgement: * This product includes software developed by the University of * California, Berkeley and its contributors. * 4. Neither the name of the University nor the names of its contributors * may be used to endorse or promote products derived from this software * without specific prior written permission. * * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF * SUCH DAMAGE. * * @(#)kern_ktrace.c 8.2 (Berkeley) 9/23/93 */ #ifdef KTRACE #include <sys/param.h> #include <sys/systm.h> #include <sys/proc.h> #include <sys/file.h> #include <sys/namei.h> #include <sys/vnode.h> #include <sys/ktrace.h> #include <sys/malloc.h> #include <sys/syslog.h> #include <sys/mount.h> #include <sys/syscallargs.h> #include <vm/vm.h> void ktrinitheader __P((struct ktr_header *, struct proc *, int)); int ktrops __P((struct proc *, struct proc *, int, int, struct vnode *)); int ktrsetchildren __P((struct proc *, struct proc *, int, int, struct vnode *)); int ktrwrite __P((struct proc *, struct ktr_header *)); int ktrcanset __P((struct proc *, struct proc *)); /* * Change the trace vnode in a correct way (to avoid races). */ void ktrsettracevnode(p, newvp) struct proc *p; struct vnode *newvp; { struct vnode *vp; if (p->p_tracep == newvp) /* avoid work */ return; if (newvp != NULL) VREF(newvp); vp = p->p_tracep; p->p_tracep = newvp; if (vp != NULL) vrele(vp); } void ktrinitheader(kth, p, type) struct ktr_header *kth; struct proc *p; int type; { bzero(kth, sizeof (struct ktr_header)); kth->ktr_type = type; microtime(&kth->ktr_time); kth->ktr_pid = p->p_pid; bcopy(p->p_comm, kth->ktr_comm, MAXCOMLEN); } void ktrsyscall(p, code, argsize, args) struct proc *p; register_t code; size_t argsize; register_t args[]; { struct ktr_header kth; struct ktr_syscall *ktp; unsigned int len = sizeof(struct ktr_syscall) + argsize; register_t *argp; int i; p->p_traceflag |= KTRFAC_ACTIVE; ktrinitheader(&kth, p, KTR_SYSCALL); ktp = malloc(len, M_TEMP, M_WAITOK); ktp->ktr_code = code; ktp->ktr_argsize = argsize; argp = (register_t *)((char *)ktp + sizeof(struct ktr_syscall)); for (i = 0; i < (argsize / sizeof *argp); i++) *argp++ = args[i]; kth.ktr_buf = (caddr_t)ktp; kth.ktr_len = len; ktrwrite(p, &kth); free(ktp, M_TEMP); p->p_traceflag &= ~KTRFAC_ACTIVE; } void ktrsysret(p, code, error, retval) struct proc *p; register_t code; int error; register_t retval; { struct ktr_header kth; struct ktr_sysret ktp; p->p_traceflag |= KTRFAC_ACTIVE; ktrinitheader(&kth, p, KTR_SYSRET); ktp.ktr_code = code; ktp.ktr_error = error; ktp.ktr_retval = retval; /* what about val2 ? */ kth.ktr_buf = (caddr_t)&ktp; kth.ktr_len = sizeof(struct ktr_sysret); ktrwrite(p, &kth); p->p_traceflag &= ~KTRFAC_ACTIVE; } void ktrnamei(p, path) struct proc *p; char *path; { struct ktr_header kth; p->p_traceflag |= KTRFAC_ACTIVE; ktrinitheader(&kth, p, KTR_NAMEI); kth.ktr_len = strlen(path); kth.ktr_buf = path; ktrwrite(p, &kth); p->p_traceflag &= ~KTRFAC_ACTIVE; } void ktremul(p, emul) struct proc *p; char *emul; { struct ktr_header kth; p->p_traceflag |= KTRFAC_ACTIVE; ktrinitheader(&kth, p, KTR_EMUL); kth.ktr_len = strlen(emul); kth.ktr_buf = emul; ktrwrite(p, &kth); p->p_traceflag &= ~KTRFAC_ACTIVE; } void ktrgenio(p, fd, rw, iov, len, error) struct proc *p; int fd; enum uio_rw rw; struct iovec *iov; int len, error; { struct ktr_header kth; struct ktr_genio *ktp; caddr_t cp; int resid = len, count; int buflen; if (error) return; p->p_traceflag |= KTRFAC_ACTIVE; buflen = min(PAGE_SIZE, len + sizeof(struct ktr_genio)); ktrinitheader(&kth, p, KTR_GENIO); ktp = malloc(buflen, M_TEMP, M_WAITOK); ktp->ktr_fd = fd; ktp->ktr_rw = rw; kth.ktr_buf = (caddr_t)ktp; cp = (caddr_t)((char *)ktp + sizeof (struct ktr_genio)); buflen -= sizeof(struct ktr_genio); while (resid > 0) { /* * Don't allow this process to hog the cpu when doing * huge I/O. */ if (p->p_schedflags & PSCHED_SHOULDYIELD) preempt(NULL); count = min(iov->iov_len, buflen); if (count > resid) count = resid; if (copyin(iov->iov_base, cp, count)) break; kth.ktr_len = count + sizeof(struct ktr_genio); if (ktrwrite(p, &kth) != 0) break; iov->iov_len -= count; iov->iov_base += count; if (iov->iov_len == 0) iov++; resid -= count; } free(ktp, M_TEMP); p->p_traceflag &= ~KTRFAC_ACTIVE; } void ktrpsig(p, sig, action, mask, code) struct proc *p; int sig; sig_t action; int mask, code; { struct ktr_header kth; struct ktr_psig kp; p->p_traceflag |= KTRFAC_ACTIVE; ktrinitheader(&kth, p, KTR_PSIG); kp.signo = (char)sig; kp.action = action; kp.mask = mask; kp.code = code; kth.ktr_buf = (caddr_t)&kp; kth.ktr_len = sizeof (struct ktr_psig); ktrwrite(p, &kth); p->p_traceflag &= ~KTRFAC_ACTIVE; } void ktrcsw(p, out, user) struct proc *p; int out, user; { struct ktr_header kth; struct ktr_csw kc; p->p_traceflag |= KTRFAC_ACTIVE; ktrinitheader(&kth, p, KTR_CSW); kc.out = out; kc.user = user; kth.ktr_buf = (caddr_t)&kc; kth.ktr_len = sizeof (struct ktr_csw); ktrwrite(p, &kth); p->p_traceflag &= ~KTRFAC_ACTIVE; } /* Interface and common routines */ /* * ktrace system call */ /* ARGSUSED */ int sys_ktrace(curp, v, retval) struct proc *curp; void *v; register_t *retval; { struct sys_ktrace_args /* { syscallarg(char *) fname; syscallarg(int) ops; syscallarg(int) facs; syscallarg(int) pid; } */ *uap = v; struct vnode *vp = NULL; struct proc *p = NULL; struct pgrp *pg; int facs = SCARG(uap, facs) & ~((unsigned) KTRFAC_ROOT); int ops = KTROP(SCARG(uap, ops)); int descend = SCARG(uap, ops) & KTRFLAG_DESCEND; int ret = 0; int error = 0; struct nameidata nd; curp->p_traceflag |= KTRFAC_ACTIVE; if (ops != KTROP_CLEAR) { /* * an operation which requires a file argument. */ NDINIT(&nd, LOOKUP, FOLLOW, UIO_USERSPACE, SCARG(uap, fname), curp); if ((error = vn_open(&nd, FREAD|FWRITE|O_NOFOLLOW, 0)) != 0) { curp->p_traceflag &= ~KTRFAC_ACTIVE; return (error); } vp = nd.ni_vp; VOP_UNLOCK(vp, 0, curp); if (vp->v_type != VREG) { (void) vn_close(vp, FREAD|FWRITE, curp->p_ucred, curp); curp->p_traceflag &= ~KTRFAC_ACTIVE; return (EACCES); } } /* * Clear all uses of the tracefile */ if (ops == KTROP_CLEARFILE) { for (p = LIST_FIRST(&allproc); p; p = LIST_NEXT(p, p_list)) { if (p->p_tracep == vp) { if (ktrcanset(curp, p)) { p->p_traceflag = 0; ktrsettracevnode(p, NULL); } else error = EPERM; } } goto done; } /* * need something to (un)trace (XXX - why is this here?) */ if (!facs) { error = EINVAL; goto done; } /* * do it */ if (SCARG(uap, pid) < 0) { /* * by process group */ pg = pgfind(-SCARG(uap, pid)); if (pg == NULL) { error = ESRCH; goto done; } for (p = pg->pg_members.lh_first; p != 0; p = p->p_pglist.le_next) if (descend) ret |= ktrsetchildren(curp, p, ops, facs, vp); else ret |= ktrops(curp, p, ops, facs, vp); } else { /* * by pid */ p = pfind(SCARG(uap, pid)); if (p == NULL) { error = ESRCH; goto done; } if (descend) ret |= ktrsetchildren(curp, p, ops, facs, vp); else ret |= ktrops(curp, p, ops, facs, vp); } if (!ret) error = EPERM; done: if (vp != NULL) (void) vn_close(vp, FWRITE, curp->p_ucred, curp); curp->p_traceflag &= ~KTRFAC_ACTIVE; return (error); } int ktrops(curp, p, ops, facs, vp) struct proc *p, *curp; int ops, facs; struct vnode *vp; { if (!ktrcanset(curp, p)) return (0); if (ops == KTROP_SET) { ktrsettracevnode(p, vp); p->p_traceflag |= facs; if (curp->p_ucred->cr_uid == 0) p->p_traceflag |= KTRFAC_ROOT; } else { /* KTROP_CLEAR */ if (((p->p_traceflag &= ~facs) & KTRFAC_MASK) == 0) { /* no more tracing */ p->p_traceflag = 0; ktrsettracevnode(p, NULL); } } /* * Emit an emulation record, every time there is a ktrace * change/attach request. */ if (KTRPOINT(p, KTR_EMUL)) ktremul(p, p->p_emul->e_name); return (1); } int ktrsetchildren(curp, top, ops, facs, vp) struct proc *curp, *top; int ops, facs; struct vnode *vp; { struct proc *p; int ret = 0; p = top; for (;;) { ret |= ktrops(curp, p, ops, facs, vp); /* * If this process has children, descend to them next, * otherwise do any siblings, and if done with this level, * follow back up the tree (but not past top). */ if (p->p_children.lh_first) p = p->p_children.lh_first; else for (;;) { if (p == top) return (ret); if (p->p_sibling.le_next) { p = p->p_sibling.le_next; break; } p = p->p_pptr; } } /*NOTREACHED*/ } int ktrwrite(p, kth) struct proc *p; struct ktr_header *kth; { struct uio auio; struct iovec aiov[2]; int error; struct vnode *vp = p->p_tracep; if (vp == NULL) return 0; auio.uio_iov = &aiov[0]; auio.uio_offset = 0; auio.uio_segflg = UIO_SYSSPACE; auio.uio_rw = UIO_WRITE; aiov[0].iov_base = (caddr_t)kth; aiov[0].iov_len = sizeof(struct ktr_header); auio.uio_resid = sizeof(struct ktr_header); auio.uio_iovcnt = 1; auio.uio_procp = (struct proc *)0; if (kth->ktr_len > 0) { auio.uio_iovcnt++; aiov[1].iov_base = kth->ktr_buf; aiov[1].iov_len = kth->ktr_len; auio.uio_resid += kth->ktr_len; } vn_lock(vp, LK_EXCLUSIVE | LK_RETRY, p); error = VOP_WRITE(vp, &auio, IO_UNIT|IO_APPEND, p->p_ucred); VOP_UNLOCK(vp, 0, p); if (!error) return 0; /* * If error encountered, give up tracing on this vnode. */ log(LOG_NOTICE, "ktrace write failed, errno %d, tracing stopped\n", error); for (p = LIST_FIRST(&allproc); p != NULL; p = LIST_NEXT(p, p_list)) { if (p->p_tracep == vp) { p->p_traceflag = 0; ktrsettracevnode(p, NULL); } } return error; } /* * Return true if caller has permission to set the ktracing state * of target. Essentially, the target can't possess any * more permissions than the caller. KTRFAC_ROOT signifies that * root previously set the tracing status on the target process, and * so, only root may further change it. * * TODO: check groups. use caller effective gid. */ int ktrcanset(callp, targetp) struct proc *callp, *targetp; { struct pcred *caller = callp->p_cred; struct pcred *target = targetp->p_cred; if ((caller->pc_ucred->cr_uid == target->p_ruid && target->p_ruid == target->p_svuid && caller->p_rgid == target->p_rgid && /* XXX */ target->p_rgid == target->p_svgid && (targetp->p_traceflag & KTRFAC_ROOT) == 0) || caller->pc_ucred->cr_uid == 0) return (1); return (0); } #endif