1 /* $NetBSD: kern_ktrace.c,v 1.24 1997/10/19 02:00:28 mycroft Exp $ */ 2 3 /* 4 * Copyright (c) 1989, 1993 5 * The Regents of the University of California. All rights reserved. 6 * 7 * Redistribution and use in source and binary forms, with or without 8 * modification, are permitted provided that the following conditions 9 * are met: 10 * 1. Redistributions of source code must retain the above copyright 11 * notice, this list of conditions and the following disclaimer. 12 * 2. Redistributions in binary form must reproduce the above copyright 13 * notice, this list of conditions and the following disclaimer in the 14 * documentation and/or other materials provided with the distribution. 15 * 3. All advertising materials mentioning features or use of this software 16 * must display the following acknowledgement: 17 * This product includes software developed by the University of 18 * California, Berkeley and its contributors. 19 * 4. Neither the name of the University nor the names of its contributors 20 * may be used to endorse or promote products derived from this software 21 * without specific prior written permission. 22 * 23 * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND 24 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 25 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 26 * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE 27 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 28 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 29 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 30 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 31 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 32 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 33 * SUCH DAMAGE. 34 * 35 * @(#)kern_ktrace.c 8.2 (Berkeley) 9/23/93 36 */ 37 38 #ifdef KTRACE 39 40 #include <sys/param.h> 41 #include <sys/systm.h> 42 #include <sys/proc.h> 43 #include <sys/file.h> 44 #include <sys/namei.h> 45 #include <sys/vnode.h> 46 #include <sys/ktrace.h> 47 #include <sys/malloc.h> 48 #include <sys/syslog.h> 49 50 #include <sys/mount.h> 51 #include <sys/syscallargs.h> 52 53 struct ktr_header *ktrgetheader __P((int)); 54 int ktrops __P((struct proc *, struct proc *, int, int, struct vnode *)); 55 int ktrsetchildren __P((struct proc *, struct proc *, int, int, 56 struct vnode *)); 57 void ktrwrite __P((struct vnode *, struct ktr_header *)); 58 int ktrcanset __P((struct proc *, struct proc *)); 59 60 struct ktr_header * 61 ktrgetheader(type) 62 int type; 63 { 64 register struct ktr_header *kth; 65 struct proc *p = curproc; /* XXX */ 66 67 MALLOC(kth, struct ktr_header *, sizeof (struct ktr_header), 68 M_TEMP, M_WAITOK); 69 kth->ktr_type = type; 70 microtime(&kth->ktr_time); 71 kth->ktr_pid = p->p_pid; 72 bcopy(p->p_comm, kth->ktr_comm, MAXCOMLEN); 73 return (kth); 74 } 75 76 void 77 ktrsyscall(vp, code, argsize, args) 78 struct vnode *vp; 79 register_t code; 80 size_t argsize; 81 register_t args[]; 82 { 83 struct ktr_header *kth; 84 struct ktr_syscall *ktp; 85 register len = sizeof(struct ktr_syscall) + argsize; 86 struct proc *p = curproc; /* XXX */ 87 register_t *argp; 88 int i; 89 90 p->p_traceflag |= KTRFAC_ACTIVE; 91 kth = ktrgetheader(KTR_SYSCALL); 92 MALLOC(ktp, struct ktr_syscall *, len, M_TEMP, M_WAITOK); 93 ktp->ktr_code = code; 94 ktp->ktr_argsize = argsize; 95 argp = (register_t *)((char *)ktp + sizeof(struct ktr_syscall)); 96 for (i = 0; i < (argsize / sizeof *argp); i++) 97 *argp++ = args[i]; 98 kth->ktr_buf = (caddr_t)ktp; 99 kth->ktr_len = len; 100 ktrwrite(vp, kth); 101 FREE(ktp, M_TEMP); 102 FREE(kth, M_TEMP); 103 p->p_traceflag &= ~KTRFAC_ACTIVE; 104 } 105 106 void 107 ktrsysret(vp, code, error, retval) 108 struct vnode *vp; 109 register_t code; 110 int error; 111 register_t retval; 112 { 113 struct ktr_header *kth; 114 struct ktr_sysret ktp; 115 struct proc *p = curproc; /* XXX */ 116 117 p->p_traceflag |= KTRFAC_ACTIVE; 118 kth = ktrgetheader(KTR_SYSRET); 119 ktp.ktr_code = code; 120 ktp.ktr_error = error; 121 ktp.ktr_retval = retval; /* what about val2 ? */ 122 123 kth->ktr_buf = (caddr_t)&ktp; 124 kth->ktr_len = sizeof(struct ktr_sysret); 125 126 ktrwrite(vp, kth); 127 FREE(kth, M_TEMP); 128 p->p_traceflag &= ~KTRFAC_ACTIVE; 129 } 130 131 void 132 ktrnamei(vp, path) 133 struct vnode *vp; 134 char *path; 135 { 136 struct ktr_header *kth; 137 struct proc *p = curproc; /* XXX */ 138 139 p->p_traceflag |= KTRFAC_ACTIVE; 140 kth = ktrgetheader(KTR_NAMEI); 141 kth->ktr_len = strlen(path); 142 kth->ktr_buf = path; 143 144 ktrwrite(vp, kth); 145 FREE(kth, M_TEMP); 146 p->p_traceflag &= ~KTRFAC_ACTIVE; 147 } 148 149 void 150 ktremul(vp, emul) 151 struct vnode *vp; 152 char *emul; 153 { 154 struct ktr_header *kth; 155 struct proc *p = curproc; /* XXX */ 156 157 p->p_traceflag |= KTRFAC_ACTIVE; 158 kth = ktrgetheader(KTR_EMUL); 159 kth->ktr_len = strlen(emul); 160 kth->ktr_buf = emul; 161 162 ktrwrite(vp, kth); 163 FREE(kth, M_TEMP); 164 p->p_traceflag &= ~KTRFAC_ACTIVE; 165 } 166 167 void 168 ktrgenio(vp, fd, rw, iov, len, error) 169 struct vnode *vp; 170 int fd; 171 enum uio_rw rw; 172 register struct iovec *iov; 173 int len, error; 174 { 175 struct ktr_header *kth; 176 register struct ktr_genio *ktp; 177 register caddr_t cp; 178 register int resid = len, cnt; 179 struct proc *p = curproc; /* XXX */ 180 181 if (error) 182 return; 183 p->p_traceflag |= KTRFAC_ACTIVE; 184 kth = ktrgetheader(KTR_GENIO); 185 MALLOC(ktp, struct ktr_genio *, sizeof(struct ktr_genio) + len, 186 M_TEMP, M_WAITOK); 187 ktp->ktr_fd = fd; 188 ktp->ktr_rw = rw; 189 cp = (caddr_t)((char *)ktp + sizeof (struct ktr_genio)); 190 while (resid > 0) { 191 if ((cnt = iov->iov_len) > resid) 192 cnt = resid; 193 if (copyin(iov->iov_base, cp, (unsigned)cnt)) 194 goto done; 195 cp += cnt; 196 resid -= cnt; 197 iov++; 198 } 199 kth->ktr_buf = (caddr_t)ktp; 200 kth->ktr_len = sizeof (struct ktr_genio) + len; 201 202 ktrwrite(vp, kth); 203 done: 204 FREE(kth, M_TEMP); 205 FREE(ktp, M_TEMP); 206 p->p_traceflag &= ~KTRFAC_ACTIVE; 207 } 208 209 void 210 ktrpsig(vp, sig, action, mask, code) 211 struct vnode *vp; 212 int sig; 213 sig_t action; 214 int mask, code; 215 { 216 struct ktr_header *kth; 217 struct ktr_psig kp; 218 struct proc *p = curproc; /* XXX */ 219 220 p->p_traceflag |= KTRFAC_ACTIVE; 221 kth = ktrgetheader(KTR_PSIG); 222 kp.signo = (char)sig; 223 kp.action = action; 224 kp.mask = mask; 225 kp.code = code; 226 kth->ktr_buf = (caddr_t)&kp; 227 kth->ktr_len = sizeof (struct ktr_psig); 228 229 ktrwrite(vp, kth); 230 FREE(kth, M_TEMP); 231 p->p_traceflag &= ~KTRFAC_ACTIVE; 232 } 233 234 void 235 ktrcsw(vp, out, user) 236 struct vnode *vp; 237 int out, user; 238 { 239 struct ktr_header *kth; 240 struct ktr_csw kc; 241 struct proc *p = curproc; /* XXX */ 242 243 p->p_traceflag |= KTRFAC_ACTIVE; 244 kth = ktrgetheader(KTR_CSW); 245 kc.out = out; 246 kc.user = user; 247 kth->ktr_buf = (caddr_t)&kc; 248 kth->ktr_len = sizeof (struct ktr_csw); 249 250 ktrwrite(vp, kth); 251 FREE(kth, M_TEMP); 252 p->p_traceflag &= ~KTRFAC_ACTIVE; 253 } 254 255 /* Interface and common routines */ 256 257 /* 258 * ktrace system call 259 */ 260 /* ARGSUSED */ 261 int 262 sys_ktrace(curp, v, retval) 263 struct proc *curp; 264 void *v; 265 register_t *retval; 266 { 267 register struct sys_ktrace_args /* { 268 syscallarg(const char *) fname; 269 syscallarg(int) ops; 270 syscallarg(int) facs; 271 syscallarg(int) pid; 272 } */ *uap = v; 273 register struct vnode *vp = NULL; 274 register struct proc *p; 275 struct pgrp *pg; 276 int facs = SCARG(uap, facs) & ~((unsigned) KTRFAC_ROOT); 277 int ops = KTROP(SCARG(uap, ops)); 278 int descend = SCARG(uap, ops) & KTRFLAG_DESCEND; 279 int ret = 0; 280 int error = 0; 281 struct nameidata nd; 282 283 curp->p_traceflag |= KTRFAC_ACTIVE; 284 if (ops != KTROP_CLEAR) { 285 /* 286 * an operation which requires a file argument. 287 */ 288 NDINIT(&nd, LOOKUP, FOLLOW, UIO_USERSPACE, SCARG(uap, fname), 289 curp); 290 if ((error = vn_open(&nd, FREAD|FWRITE, 0)) != 0) { 291 curp->p_traceflag &= ~KTRFAC_ACTIVE; 292 return (error); 293 } 294 vp = nd.ni_vp; 295 VOP_UNLOCK(vp); 296 if (vp->v_type != VREG) { 297 (void) vn_close(vp, FREAD|FWRITE, curp->p_ucred, curp); 298 curp->p_traceflag &= ~KTRFAC_ACTIVE; 299 return (EACCES); 300 } 301 } 302 /* 303 * Clear all uses of the tracefile 304 */ 305 if (ops == KTROP_CLEARFILE) { 306 for (p = allproc.lh_first; p != 0; p = p->p_list.le_next) { 307 if (p->p_tracep == vp) { 308 if (ktrcanset(curp, p)) { 309 p->p_tracep = NULL; 310 p->p_traceflag = 0; 311 (void) vn_close(vp, FREAD|FWRITE, 312 p->p_ucred, p); 313 } else 314 error = EPERM; 315 } 316 } 317 goto done; 318 } 319 /* 320 * need something to (un)trace (XXX - why is this here?) 321 */ 322 if (!facs) { 323 error = EINVAL; 324 goto done; 325 } 326 /* 327 * do it 328 */ 329 if (SCARG(uap, pid) < 0) { 330 /* 331 * by process group 332 */ 333 pg = pgfind(-SCARG(uap, pid)); 334 if (pg == NULL) { 335 error = ESRCH; 336 goto done; 337 } 338 for (p = pg->pg_members.lh_first; p != 0; p = p->p_pglist.le_next) 339 if (descend) 340 ret |= ktrsetchildren(curp, p, ops, facs, vp); 341 else 342 ret |= ktrops(curp, p, ops, facs, vp); 343 344 } else { 345 /* 346 * by pid 347 */ 348 p = pfind(SCARG(uap, pid)); 349 if (p == NULL) { 350 error = ESRCH; 351 goto done; 352 } 353 if (descend) 354 ret |= ktrsetchildren(curp, p, ops, facs, vp); 355 else 356 ret |= ktrops(curp, p, ops, facs, vp); 357 } 358 if (!ret) 359 error = EPERM; 360 done: 361 if (vp != NULL) 362 (void) vn_close(vp, FWRITE, curp->p_ucred, curp); 363 curp->p_traceflag &= ~KTRFAC_ACTIVE; 364 return (error); 365 } 366 367 int 368 ktrops(curp, p, ops, facs, vp) 369 struct proc *p, *curp; 370 int ops, facs; 371 struct vnode *vp; 372 { 373 374 if (!ktrcanset(curp, p)) 375 return (0); 376 if (ops == KTROP_SET) { 377 if (p->p_tracep != vp) { 378 /* 379 * if trace file already in use, relinquish 380 */ 381 if (p->p_tracep != NULL) 382 vrele(p->p_tracep); 383 VREF(vp); 384 p->p_tracep = vp; 385 } 386 p->p_traceflag |= facs; 387 if (curp->p_ucred->cr_uid == 0) 388 p->p_traceflag |= KTRFAC_ROOT; 389 } else { 390 /* KTROP_CLEAR */ 391 if (((p->p_traceflag &= ~facs) & KTRFAC_MASK) == 0) { 392 /* no more tracing */ 393 p->p_traceflag = 0; 394 if (p->p_tracep != NULL) { 395 vrele(p->p_tracep); 396 p->p_tracep = NULL; 397 } 398 } 399 } 400 401 /* 402 * Emit an emulation record, every time there is a ktrace 403 * change/attach request. 404 */ 405 if (KTRPOINT(p, KTR_EMUL)) 406 ktremul(p->p_tracep, p->p_emul->e_name); 407 408 return (1); 409 } 410 411 int 412 ktrsetchildren(curp, top, ops, facs, vp) 413 struct proc *curp, *top; 414 int ops, facs; 415 struct vnode *vp; 416 { 417 register struct proc *p; 418 register int ret = 0; 419 420 p = top; 421 for (;;) { 422 ret |= ktrops(curp, p, ops, facs, vp); 423 /* 424 * If this process has children, descend to them next, 425 * otherwise do any siblings, and if done with this level, 426 * follow back up the tree (but not past top). 427 */ 428 if (p->p_children.lh_first) 429 p = p->p_children.lh_first; 430 else for (;;) { 431 if (p == top) 432 return (ret); 433 if (p->p_sibling.le_next) { 434 p = p->p_sibling.le_next; 435 break; 436 } 437 p = p->p_pptr; 438 } 439 } 440 /*NOTREACHED*/ 441 } 442 443 void 444 ktrwrite(vp, kth) 445 struct vnode *vp; 446 register struct ktr_header *kth; 447 { 448 struct uio auio; 449 struct iovec aiov[2]; 450 register struct proc *p = curproc; /* XXX */ 451 int error; 452 453 if (vp == NULL) 454 return; 455 auio.uio_iov = &aiov[0]; 456 auio.uio_offset = 0; 457 auio.uio_segflg = UIO_SYSSPACE; 458 auio.uio_rw = UIO_WRITE; 459 aiov[0].iov_base = (caddr_t)kth; 460 aiov[0].iov_len = sizeof(struct ktr_header); 461 auio.uio_resid = sizeof(struct ktr_header); 462 auio.uio_iovcnt = 1; 463 auio.uio_procp = (struct proc *)0; 464 if (kth->ktr_len > 0) { 465 auio.uio_iovcnt++; 466 aiov[1].iov_base = kth->ktr_buf; 467 aiov[1].iov_len = kth->ktr_len; 468 auio.uio_resid += kth->ktr_len; 469 } 470 VOP_LOCK(vp); 471 error = VOP_WRITE(vp, &auio, IO_UNIT|IO_APPEND, p->p_ucred); 472 VOP_UNLOCK(vp); 473 if (!error) 474 return; 475 /* 476 * If error encountered, give up tracing on this vnode. 477 */ 478 log(LOG_NOTICE, "ktrace write failed, errno %d, tracing stopped\n", 479 error); 480 for (p = allproc.lh_first; p != 0; p = p->p_list.le_next) { 481 if (p->p_tracep == vp) { 482 p->p_tracep = NULL; 483 p->p_traceflag = 0; 484 vrele(vp); 485 } 486 } 487 } 488 489 /* 490 * Return true if caller has permission to set the ktracing state 491 * of target. Essentially, the target can't possess any 492 * more permissions than the caller. KTRFAC_ROOT signifies that 493 * root previously set the tracing status on the target process, and 494 * so, only root may further change it. 495 * 496 * TODO: check groups. use caller effective gid. 497 */ 498 int 499 ktrcanset(callp, targetp) 500 struct proc *callp, *targetp; 501 { 502 register struct pcred *caller = callp->p_cred; 503 register struct pcred *target = targetp->p_cred; 504 505 if ((caller->pc_ucred->cr_uid == target->p_ruid && 506 target->p_ruid == target->p_svuid && 507 caller->p_rgid == target->p_rgid && /* XXX */ 508 target->p_rgid == target->p_svgid && 509 (targetp->p_traceflag & KTRFAC_ROOT) == 0) || 510 caller->pc_ucred->cr_uid == 0) 511 return (1); 512 513 return (0); 514 } 515 516 #endif 517