1 /* 2 * Copyright (c) 1989 The Regents of the University of California. 3 * All rights reserved. 4 * 5 * Redistribution and use in source and binary forms, with or without 6 * modification, are permitted provided that the following conditions 7 * are met: 8 * 1. Redistributions of source code must retain the above copyright 9 * notice, this list of conditions and the following disclaimer. 10 * 2. Redistributions in binary form must reproduce the above copyright 11 * notice, this list of conditions and the following disclaimer in the 12 * documentation and/or other materials provided with the distribution. 13 * 3. All advertising materials mentioning features or use of this software 14 * must display the following acknowledgement: 15 * This product includes software developed by the University of 16 * California, Berkeley and its contributors. 17 * 4. Neither the name of the University nor the names of its contributors 18 * may be used to endorse or promote products derived from this software 19 * without specific prior written permission. 20 * 21 * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND 22 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 23 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 24 * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE 25 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 26 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 27 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 28 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 29 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 30 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 31 * SUCH DAMAGE. 32 * 33 * from: @(#)kern_ktrace.c 7.15 (Berkeley) 6/21/91 34 * $Id: kern_ktrace.c,v 1.3 1993/05/20 02:54:26 cgd Exp $ 35 */ 36 37 #include "param.h" 38 #include "proc.h" 39 #include "file.h" 40 #include "namei.h" 41 #include "vnode.h" 42 #include "ktrace.h" 43 #include "malloc.h" 44 #include "syslog.h" 45 46 struct ktr_header * 47 ktrgetheader(type) 48 { 49 register struct ktr_header *kth; 50 struct proc *p = curproc; /* XXX */ 51 52 MALLOC(kth, struct ktr_header *, sizeof (struct ktr_header), 53 M_TEMP, M_WAITOK); 54 kth->ktr_type = type; 55 microtime(&kth->ktr_time); 56 kth->ktr_pid = p->p_pid; 57 bcopy(p->p_comm, kth->ktr_comm, MAXCOMLEN); 58 return (kth); 59 } 60 61 ktrsyscall(vp, code, narg, args) 62 struct vnode *vp; 63 int code, narg, args[]; 64 { 65 struct ktr_header *kth = ktrgetheader(KTR_SYSCALL); 66 struct ktr_syscall *ktp; 67 register len = sizeof(struct ktr_syscall) + (narg * sizeof(int)); 68 int *argp, i; 69 70 MALLOC(ktp, struct ktr_syscall *, len, M_TEMP, M_WAITOK); 71 ktp->ktr_code = code; 72 ktp->ktr_narg = narg; 73 argp = (int *)((char *)ktp + sizeof(struct ktr_syscall)); 74 for (i = 0; i < narg; i++) 75 *argp++ = args[i]; 76 kth->ktr_buf = (caddr_t)ktp; 77 kth->ktr_len = len; 78 ktrwrite(vp, kth); 79 FREE(ktp, M_TEMP); 80 FREE(kth, M_TEMP); 81 } 82 83 ktrsysret(vp, code, error, retval) 84 struct vnode *vp; 85 int code, error, retval; 86 { 87 struct ktr_header *kth = ktrgetheader(KTR_SYSRET); 88 struct ktr_sysret ktp; 89 90 ktp.ktr_code = code; 91 ktp.ktr_error = error; 92 ktp.ktr_retval = retval; /* what about val2 ? */ 93 94 kth->ktr_buf = (caddr_t)&ktp; 95 kth->ktr_len = sizeof(struct ktr_sysret); 96 97 ktrwrite(vp, kth); 98 FREE(kth, M_TEMP); 99 } 100 101 ktrnamei(vp, path) 102 struct vnode *vp; 103 char *path; 104 { 105 struct ktr_header *kth = ktrgetheader(KTR_NAMEI); 106 107 kth->ktr_len = strlen(path); 108 kth->ktr_buf = path; 109 110 ktrwrite(vp, kth); 111 FREE(kth, M_TEMP); 112 } 113 114 ktrgenio(vp, fd, rw, iov, len, error) 115 struct vnode *vp; 116 int fd; 117 enum uio_rw rw; 118 register struct iovec *iov; 119 { 120 struct ktr_header *kth = ktrgetheader(KTR_GENIO); 121 register struct ktr_genio *ktp; 122 register caddr_t cp; 123 register int resid = len, cnt; 124 125 if (error) 126 return; 127 MALLOC(ktp, struct ktr_genio *, sizeof(struct ktr_genio) + len, 128 M_TEMP, M_WAITOK); 129 ktp->ktr_fd = fd; 130 ktp->ktr_rw = rw; 131 cp = (caddr_t)((char *)ktp + sizeof (struct ktr_genio)); 132 while (resid > 0) { 133 if ((cnt = iov->iov_len) > resid) 134 cnt = resid; 135 if (copyin(iov->iov_base, cp, (unsigned)cnt)) 136 goto done; 137 cp += cnt; 138 resid -= cnt; 139 iov++; 140 } 141 kth->ktr_buf = (caddr_t)ktp; 142 kth->ktr_len = sizeof (struct ktr_genio) + len; 143 144 ktrwrite(vp, kth); 145 done: 146 FREE(kth, M_TEMP); 147 FREE(ktp, M_TEMP); 148 } 149 150 ktrpsig(vp, sig, action, mask, code) 151 struct vnode *vp; 152 sig_t action; 153 { 154 struct ktr_header *kth = ktrgetheader(KTR_PSIG); 155 struct ktr_psig kp; 156 157 kp.signo = (char)sig; 158 kp.action = action; 159 kp.mask = mask; 160 kp.code = code; 161 kth->ktr_buf = (caddr_t)&kp; 162 kth->ktr_len = sizeof (struct ktr_psig); 163 164 ktrwrite(vp, kth); 165 FREE(kth, M_TEMP); 166 } 167 168 /* Interface and common routines */ 169 170 /* 171 * ktrace system call 172 */ 173 /* ARGSUSED */ 174 ktrace(curp, uap, retval) 175 struct proc *curp; 176 register struct args { 177 char *fname; 178 int ops; 179 int facs; 180 int pid; 181 } *uap; 182 int *retval; 183 { 184 register struct vnode *vp = NULL; 185 register struct proc *p; 186 struct pgrp *pg; 187 int facs = uap->facs & ~KTRFAC_ROOT; 188 int ops = KTROP(uap->ops); 189 int descend = uap->ops & KTRFLAG_DESCEND; 190 int ret = 0; 191 int error = 0; 192 struct nameidata nd; 193 194 if (ops != KTROP_CLEAR) { 195 /* 196 * an operation which requires a file argument. 197 */ 198 nd.ni_segflg = UIO_USERSPACE; 199 nd.ni_dirp = uap->fname; 200 if (error = vn_open(&nd, curp, FREAD|FWRITE, 0)) 201 return (error); 202 vp = nd.ni_vp; 203 VOP_UNLOCK(vp); 204 if (vp->v_type != VREG) { 205 (void) vn_close(vp, FREAD|FWRITE, curp->p_ucred, curp); 206 return (EACCES); 207 } 208 } 209 /* 210 * Clear all uses of the tracefile 211 */ 212 if (ops == KTROP_CLEARFILE) { 213 for (p = allproc; p != NULL; p = p->p_nxt) { 214 if (p->p_tracep == vp) { 215 if (ktrcanset(curp, p)) { 216 p->p_tracep = NULL; 217 p->p_traceflag = 0; 218 (void) vn_close(vp, FREAD|FWRITE, 219 p->p_ucred, p); 220 } else 221 error = EPERM; 222 } 223 } 224 goto done; 225 } 226 /* 227 * need something to (un)trace (XXX - why is this here?) 228 */ 229 if (!facs) { 230 error = EINVAL; 231 goto done; 232 } 233 /* 234 * do it 235 */ 236 if (uap->pid < 0) { 237 /* 238 * by process group 239 */ 240 pg = pgfind(-uap->pid); 241 if (pg == NULL) { 242 error = ESRCH; 243 goto done; 244 } 245 for (p = pg->pg_mem; p != NULL; p = p->p_pgrpnxt) 246 if (descend) 247 ret |= ktrsetchildren(curp, p, ops, facs, vp); 248 else 249 ret |= ktrops(curp, p, ops, facs, vp); 250 251 } else { 252 /* 253 * by pid 254 */ 255 p = pfind(uap->pid); 256 if (p == NULL) { 257 error = ESRCH; 258 goto done; 259 } 260 if (descend) 261 ret |= ktrsetchildren(curp, p, ops, facs, vp); 262 else 263 ret |= ktrops(curp, p, ops, facs, vp); 264 } 265 if (!ret) 266 error = EPERM; 267 done: 268 if (vp != NULL) 269 (void) vn_close(vp, FWRITE, curp->p_ucred, curp); 270 return (error); 271 } 272 273 ktrops(curp, p, ops, facs, vp) 274 struct proc *curp, *p; 275 struct vnode *vp; 276 { 277 278 if (!ktrcanset(curp, p)) 279 return (0); 280 if (ops == KTROP_SET) { 281 if (p->p_tracep != vp) { 282 /* 283 * if trace file already in use, relinquish 284 */ 285 if (p->p_tracep != NULL) 286 vrele(p->p_tracep); 287 VREF(vp); 288 p->p_tracep = vp; 289 } 290 p->p_traceflag |= facs; 291 if (curp->p_ucred->cr_uid == 0) 292 p->p_traceflag |= KTRFAC_ROOT; 293 } else { 294 /* KTROP_CLEAR */ 295 if (((p->p_traceflag &= ~facs) & KTRFAC_MASK) == 0) { 296 /* no more tracing */ 297 p->p_traceflag = 0; 298 if (p->p_tracep != NULL) { 299 vrele(p->p_tracep); 300 p->p_tracep = NULL; 301 } 302 } 303 } 304 305 return (1); 306 } 307 308 ktrsetchildren(curp, top, ops, facs, vp) 309 struct proc *curp, *top; 310 struct vnode *vp; 311 { 312 register struct proc *p; 313 register int ret = 0; 314 315 p = top; 316 for (;;) { 317 ret |= ktrops(curp, p, ops, facs, vp); 318 /* 319 * If this process has children, descend to them next, 320 * otherwise do any siblings, and if done with this level, 321 * follow back up the tree (but not past top). 322 */ 323 if (p->p_cptr) 324 p = p->p_cptr; 325 else if (p == top) 326 return (ret); 327 else if (p->p_osptr) 328 p = p->p_osptr; 329 else for (;;) { 330 p = p->p_pptr; 331 if (p == top) 332 return (ret); 333 if (p->p_osptr) { 334 p = p->p_osptr; 335 break; 336 } 337 } 338 } 339 /*NOTREACHED*/ 340 } 341 342 ktrwrite(vp, kth) 343 struct vnode *vp; 344 register struct ktr_header *kth; 345 { 346 struct uio auio; 347 struct iovec aiov[2]; 348 register struct proc *p = curproc; /* XXX */ 349 int error; 350 351 if (vp == NULL) 352 return; 353 auio.uio_iov = &aiov[0]; 354 auio.uio_offset = 0; 355 auio.uio_segflg = UIO_SYSSPACE; 356 auio.uio_rw = UIO_WRITE; 357 aiov[0].iov_base = (caddr_t)kth; 358 aiov[0].iov_len = sizeof(struct ktr_header); 359 auio.uio_resid = sizeof(struct ktr_header); 360 auio.uio_iovcnt = 1; 361 auio.uio_procp = (struct proc *)0; 362 if (kth->ktr_len > 0) { 363 auio.uio_iovcnt++; 364 aiov[1].iov_base = kth->ktr_buf; 365 aiov[1].iov_len = kth->ktr_len; 366 auio.uio_resid += kth->ktr_len; 367 } 368 VOP_LOCK(vp); 369 error = VOP_WRITE(vp, &auio, IO_UNIT|IO_APPEND, p->p_ucred); 370 VOP_UNLOCK(vp); 371 if (!error) 372 return; 373 /* 374 * If error encountered, give up tracing on this vnode. 375 */ 376 log(LOG_NOTICE, "ktrace write failed, errno %d, tracing stopped\n", 377 error); 378 for (p = allproc; p != NULL; p = p->p_nxt) { 379 if (p->p_tracep == vp) { 380 p->p_tracep = NULL; 381 p->p_traceflag = 0; 382 vrele(vp); 383 } 384 } 385 } 386 387 /* 388 * Return true if caller has permission to set the ktracing state 389 * of target. Essentially, the target can't possess any 390 * more permissions than the caller. KTRFAC_ROOT signifies that 391 * root previously set the tracing status on the target process, and 392 * so, only root may further change it. 393 * 394 * TODO: check groups. use caller effective gid. 395 */ 396 ktrcanset(callp, targetp) 397 struct proc *callp, *targetp; 398 { 399 register struct pcred *caller = callp->p_cred; 400 register struct pcred *target = targetp->p_cred; 401 402 if ((caller->pc_ucred->cr_uid == target->p_ruid && 403 target->p_ruid == target->p_svuid && 404 caller->p_rgid == target->p_rgid && /* XXX */ 405 target->p_rgid == target->p_svgid && 406 (targetp->p_traceflag & KTRFAC_ROOT) == 0) || 407 caller->pc_ucred->cr_uid == 0) 408 return (1); 409 410 return (0); 411 } 412