1 /* 2 * Copyright (c) 1989 The Regents of the University of California. 3 * All rights reserved. 4 * 5 * %sccs.include.redist.c% 6 * 7 * @(#)kern_ktrace.c 7.14 (Berkeley) 05/28/91 8 */ 9 10 #ifdef KTRACE 11 12 #include "param.h" 13 #include "proc.h" 14 #include "file.h" 15 #include "namei.h" 16 #include "vnode.h" 17 #include "ktrace.h" 18 #include "malloc.h" 19 #include "syslog.h" 20 21 struct ktr_header * 22 ktrgetheader(type) 23 { 24 register struct ktr_header *kth; 25 struct proc *p = curproc; /* XXX */ 26 27 MALLOC(kth, struct ktr_header *, sizeof (struct ktr_header), 28 M_TEMP, M_WAITOK); 29 kth->ktr_type = type; 30 microtime(&kth->ktr_time); 31 kth->ktr_pid = p->p_pid; 32 bcopy(p->p_comm, kth->ktr_comm, MAXCOMLEN); 33 return (kth); 34 } 35 36 ktrsyscall(vp, code, narg, args) 37 struct vnode *vp; 38 int code, narg, args[]; 39 { 40 struct ktr_header *kth = ktrgetheader(KTR_SYSCALL); 41 struct ktr_syscall *ktp; 42 register len = sizeof(struct ktr_syscall) + (narg * sizeof(int)); 43 int *argp, i; 44 45 MALLOC(ktp, struct ktr_syscall *, len, M_TEMP, M_WAITOK); 46 ktp->ktr_code = code; 47 ktp->ktr_narg = narg; 48 argp = (int *)((char *)ktp + sizeof(struct ktr_syscall)); 49 for (i = 0; i < narg; i++) 50 *argp++ = args[i]; 51 kth->ktr_buf = (caddr_t)ktp; 52 kth->ktr_len = len; 53 ktrwrite(vp, kth); 54 FREE(ktp, M_TEMP); 55 FREE(kth, M_TEMP); 56 } 57 58 ktrsysret(vp, code, error, retval) 59 struct vnode *vp; 60 int code, error, retval; 61 { 62 struct ktr_header *kth = ktrgetheader(KTR_SYSRET); 63 struct ktr_sysret ktp; 64 65 ktp.ktr_code = code; 66 ktp.ktr_error = error; 67 ktp.ktr_retval = retval; /* what about val2 ? */ 68 69 kth->ktr_buf = (caddr_t)&ktp; 70 kth->ktr_len = sizeof(struct ktr_sysret); 71 72 ktrwrite(vp, kth); 73 FREE(kth, M_TEMP); 74 } 75 76 ktrnamei(vp, path) 77 struct vnode *vp; 78 char *path; 79 { 80 struct ktr_header *kth = ktrgetheader(KTR_NAMEI); 81 82 kth->ktr_len = strlen(path); 83 kth->ktr_buf = path; 84 85 ktrwrite(vp, kth); 86 FREE(kth, M_TEMP); 87 } 88 89 ktrgenio(vp, fd, rw, iov, len, error) 90 struct vnode *vp; 91 int fd; 92 enum uio_rw rw; 93 register struct iovec *iov; 94 { 95 struct ktr_header *kth = ktrgetheader(KTR_GENIO); 96 register struct ktr_genio *ktp; 97 register caddr_t cp; 98 register int resid = len, cnt; 99 100 if (error) 101 return; 102 MALLOC(ktp, struct ktr_genio *, sizeof(struct ktr_genio) + len, 103 M_TEMP, M_WAITOK); 104 ktp->ktr_fd = fd; 105 ktp->ktr_rw = rw; 106 cp = (caddr_t)((char *)ktp + sizeof (struct ktr_genio)); 107 while (resid > 0) { 108 if ((cnt = iov->iov_len) > resid) 109 cnt = resid; 110 if (copyin(iov->iov_base, cp, (unsigned)cnt)) 111 goto done; 112 cp += cnt; 113 resid -= cnt; 114 iov++; 115 } 116 kth->ktr_buf = (caddr_t)ktp; 117 kth->ktr_len = sizeof (struct ktr_genio) + len; 118 119 ktrwrite(vp, kth); 120 done: 121 FREE(kth, M_TEMP); 122 FREE(ktp, M_TEMP); 123 } 124 125 ktrpsig(vp, sig, action, mask, code) 126 struct vnode *vp; 127 sig_t action; 128 { 129 struct ktr_header *kth = ktrgetheader(KTR_PSIG); 130 struct ktr_psig kp; 131 132 kp.signo = (char)sig; 133 kp.action = action; 134 kp.mask = mask; 135 kp.code = code; 136 kth->ktr_buf = (caddr_t)&kp; 137 kth->ktr_len = sizeof (struct ktr_psig); 138 139 ktrwrite(vp, kth); 140 FREE(kth, M_TEMP); 141 } 142 143 /* Interface and common routines */ 144 145 /* 146 * ktrace system call 147 */ 148 /* ARGSUSED */ 149 ktrace(curp, uap, retval) 150 struct proc *curp; 151 register struct args { 152 char *fname; 153 int ops; 154 int facs; 155 int pid; 156 } *uap; 157 int *retval; 158 { 159 register struct vnode *vp = NULL; 160 register struct proc *p; 161 struct pgrp *pg; 162 int facs = uap->facs & ~KTRFAC_ROOT; 163 int ops = KTROP(uap->ops); 164 int descend = uap->ops & KTRFLAG_DESCEND; 165 int ret = 0; 166 int error = 0; 167 struct nameidata nd; 168 169 if (ops != KTROP_CLEAR) { 170 /* 171 * an operation which requires a file argument. 172 */ 173 nd.ni_segflg = UIO_USERSPACE; 174 nd.ni_dirp = uap->fname; 175 if (error = vn_open(&nd, curp, FREAD|FWRITE, 0)) 176 return (error); 177 vp = nd.ni_vp; 178 VOP_UNLOCK(vp); 179 if (vp->v_type != VREG) { 180 vrele(vp); 181 return (EACCES); 182 } 183 } 184 /* 185 * Clear all uses of the tracefile 186 */ 187 if (ops == KTROP_CLEARFILE) { 188 for (p = allproc; p != NULL; p = p->p_nxt) { 189 if (p->p_tracep == vp) { 190 if (ktrcanset(curp, p)) { 191 p->p_tracep = NULL; 192 p->p_traceflag = 0; 193 vrele(vp); 194 } else 195 error = EPERM; 196 } 197 } 198 goto done; 199 } 200 /* 201 * need something to (un)trace (XXX - why is this here?) 202 */ 203 if (!facs) { 204 error = EINVAL; 205 goto done; 206 } 207 /* 208 * do it 209 */ 210 if (uap->pid < 0) { 211 /* 212 * by process group 213 */ 214 pg = pgfind(-uap->pid); 215 if (pg == NULL) { 216 error = ESRCH; 217 goto done; 218 } 219 for (p = pg->pg_mem; p != NULL; p = p->p_pgrpnxt) 220 if (descend) 221 ret |= ktrsetchildren(curp, p, ops, facs, vp); 222 else 223 ret |= ktrops(curp, p, ops, facs, vp); 224 225 } else { 226 /* 227 * by pid 228 */ 229 p = pfind(uap->pid); 230 if (p == NULL) { 231 error = ESRCH; 232 goto done; 233 } 234 if (descend) 235 ret |= ktrsetchildren(curp, p, ops, facs, vp); 236 else 237 ret |= ktrops(curp, p, ops, facs, vp); 238 } 239 if (!ret) 240 error = EPERM; 241 done: 242 if (vp != NULL) 243 vrele(vp); 244 return (error); 245 } 246 247 ktrops(curp, p, ops, facs, vp) 248 struct proc *curp, *p; 249 struct vnode *vp; 250 { 251 252 if (!ktrcanset(curp, p)) 253 return (0); 254 if (ops == KTROP_SET) { 255 if (p->p_tracep != vp) { 256 /* 257 * if trace file already in use, relinquish 258 */ 259 if (p->p_tracep != NULL) 260 vrele(p->p_tracep); 261 VREF(vp); 262 p->p_tracep = vp; 263 } 264 p->p_traceflag |= facs; 265 if (curp->p_ucred->cr_uid == 0) 266 p->p_traceflag |= KTRFAC_ROOT; 267 } else { 268 /* KTROP_CLEAR */ 269 if (((p->p_traceflag &= ~facs) & KTRFAC_MASK) == 0) { 270 /* no more tracing */ 271 p->p_traceflag = 0; 272 if (p->p_tracep != NULL) { 273 vrele(p->p_tracep); 274 p->p_tracep = NULL; 275 } 276 } 277 } 278 279 return (1); 280 } 281 282 ktrsetchildren(curp, top, ops, facs, vp) 283 struct proc *curp, *top; 284 struct vnode *vp; 285 { 286 register struct proc *p; 287 register int ret = 0; 288 289 p = top; 290 for (;;) { 291 ret |= ktrops(curp, p, ops, facs, vp); 292 /* 293 * If this process has children, descend to them next, 294 * otherwise do any siblings, and if done with this level, 295 * follow back up the tree (but not past top). 296 */ 297 if (p->p_cptr) 298 p = p->p_cptr; 299 else if (p == top) 300 return (ret); 301 else if (p->p_osptr) 302 p = p->p_osptr; 303 else for (;;) { 304 p = p->p_pptr; 305 if (p == top) 306 return (ret); 307 if (p->p_osptr) { 308 p = p->p_osptr; 309 break; 310 } 311 } 312 } 313 /*NOTREACHED*/ 314 } 315 316 ktrwrite(vp, kth) 317 struct vnode *vp; 318 register struct ktr_header *kth; 319 { 320 struct uio auio; 321 struct iovec aiov[2]; 322 register struct proc *p = curproc; /* XXX */ 323 int error; 324 325 if (vp == NULL) 326 return; 327 auio.uio_iov = &aiov[0]; 328 auio.uio_offset = 0; 329 auio.uio_segflg = UIO_SYSSPACE; 330 auio.uio_rw = UIO_WRITE; 331 aiov[0].iov_base = (caddr_t)kth; 332 aiov[0].iov_len = sizeof(struct ktr_header); 333 auio.uio_resid = sizeof(struct ktr_header); 334 auio.uio_iovcnt = 1; 335 auio.uio_procp = (struct proc *)0; 336 if (kth->ktr_len > 0) { 337 auio.uio_iovcnt++; 338 aiov[1].iov_base = kth->ktr_buf; 339 aiov[1].iov_len = kth->ktr_len; 340 auio.uio_resid += kth->ktr_len; 341 } 342 VOP_LOCK(vp); 343 error = VOP_WRITE(vp, &auio, IO_UNIT|IO_APPEND, p->p_ucred); 344 VOP_UNLOCK(vp); 345 if (!error) 346 return; 347 /* 348 * If error encountered, give up tracing on this vnode. 349 */ 350 log(LOG_NOTICE, "ktrace write failed, errno %d, tracing stopped\n", 351 error); 352 for (p = allproc; p != NULL; p = p->p_nxt) { 353 if (p->p_tracep == vp) { 354 p->p_tracep = NULL; 355 p->p_traceflag = 0; 356 vrele(vp); 357 } 358 } 359 } 360 361 /* 362 * Return true if caller has permission to set the ktracing state 363 * of target. Essentially, the target can't possess any 364 * more permissions than the caller. KTRFAC_ROOT signifies that 365 * root previously set the tracing status on the target process, and 366 * so, only root may further change it. 367 * 368 * TODO: check groups. use caller effective gid. 369 */ 370 ktrcanset(callp, targetp) 371 struct proc *callp, *targetp; 372 { 373 register struct pcred *caller = callp->p_cred; 374 register struct pcred *target = targetp->p_cred; 375 376 if ((caller->pc_ucred->cr_uid == target->p_ruid && 377 target->p_ruid == target->p_svuid && 378 caller->p_rgid == target->p_rgid && /* XXX */ 379 target->p_rgid == target->p_svgid && 380 (targetp->p_traceflag & KTRFAC_ROOT) == 0) || 381 caller->pc_ucred->cr_uid == 0) 382 return (1); 383 384 return (0); 385 } 386 387 #endif 388