1 /* 2 * Copyright (c) 1989, 1993 3 * The Regents of the University of California. All rights reserved. 4 * 5 * Redistribution and use in source and binary forms, with or without 6 * modification, are permitted provided that the following conditions 7 * are met: 8 * 1. Redistributions of source code must retain the above copyright 9 * notice, this list of conditions and the following disclaimer. 10 * 2. Redistributions in binary form must reproduce the above copyright 11 * notice, this list of conditions and the following disclaimer in the 12 * documentation and/or other materials provided with the distribution. 13 * 3. All advertising materials mentioning features or use of this software 14 * must display the following acknowledgement: 15 * This product includes software developed by the University of 16 * California, Berkeley and its contributors. 17 * 4. Neither the name of the University nor the names of its contributors 18 * may be used to endorse or promote products derived from this software 19 * without specific prior written permission. 20 * 21 * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND 22 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 23 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 24 * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE 25 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 26 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 27 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 28 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 29 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 30 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 31 * SUCH DAMAGE. 32 * 33 * from: @(#)kern_ktrace.c 8.2 (Berkeley) 9/23/93 34 * $Id: kern_ktrace.c,v 1.10 1994/06/08 11:28:37 mycroft Exp $ 35 */ 36 37 #ifdef KTRACE 38 39 #include <sys/param.h> 40 #include <sys/proc.h> 41 #include <sys/file.h> 42 #include <sys/namei.h> 43 #include <sys/vnode.h> 44 #include <sys/ktrace.h> 45 #include <sys/malloc.h> 46 #include <sys/syslog.h> 47 48 struct ktr_header * 49 ktrgetheader(type) 50 int type; 51 { 52 register struct ktr_header *kth; 53 struct proc *p = curproc; /* XXX */ 54 55 MALLOC(kth, struct ktr_header *, sizeof (struct ktr_header), 56 M_TEMP, M_WAITOK); 57 kth->ktr_type = type; 58 microtime(&kth->ktr_time); 59 kth->ktr_pid = p->p_pid; 60 bcopy(p->p_comm, kth->ktr_comm, MAXCOMLEN); 61 return (kth); 62 } 63 64 ktrsyscall(vp, code, narg, args) 65 struct vnode *vp; 66 int code, narg, args[]; 67 { 68 struct ktr_header *kth; 69 struct ktr_syscall *ktp; 70 register len = sizeof(struct ktr_syscall) + (narg * sizeof(int)); 71 struct proc *p = curproc; /* XXX */ 72 int *argp, i; 73 74 p->p_traceflag |= KTRFAC_ACTIVE; 75 kth = ktrgetheader(KTR_SYSCALL); 76 MALLOC(ktp, struct ktr_syscall *, len, M_TEMP, M_WAITOK); 77 ktp->ktr_code = code; 78 ktp->ktr_narg = narg; 79 argp = (int *)((char *)ktp + sizeof(struct ktr_syscall)); 80 for (i = 0; i < narg; i++) 81 *argp++ = args[i]; 82 kth->ktr_buf = (caddr_t)ktp; 83 kth->ktr_len = len; 84 ktrwrite(vp, kth); 85 FREE(ktp, M_TEMP); 86 FREE(kth, M_TEMP); 87 p->p_traceflag &= ~KTRFAC_ACTIVE; 88 } 89 90 ktrsysret(vp, code, error, retval) 91 struct vnode *vp; 92 int code, error, retval; 93 { 94 struct ktr_header *kth; 95 struct ktr_sysret ktp; 96 struct proc *p = curproc; /* XXX */ 97 98 p->p_traceflag |= KTRFAC_ACTIVE; 99 kth = ktrgetheader(KTR_SYSRET); 100 ktp.ktr_code = code; 101 ktp.ktr_error = error; 102 ktp.ktr_retval = retval; /* what about val2 ? */ 103 104 kth->ktr_buf = (caddr_t)&ktp; 105 kth->ktr_len = sizeof(struct ktr_sysret); 106 107 ktrwrite(vp, kth); 108 FREE(kth, M_TEMP); 109 p->p_traceflag &= ~KTRFAC_ACTIVE; 110 } 111 112 ktrnamei(vp, path) 113 struct vnode *vp; 114 char *path; 115 { 116 struct ktr_header *kth; 117 struct proc *p = curproc; /* XXX */ 118 119 p->p_traceflag |= KTRFAC_ACTIVE; 120 kth = ktrgetheader(KTR_NAMEI); 121 kth->ktr_len = strlen(path); 122 kth->ktr_buf = path; 123 124 ktrwrite(vp, kth); 125 FREE(kth, M_TEMP); 126 p->p_traceflag &= ~KTRFAC_ACTIVE; 127 } 128 129 ktrgenio(vp, fd, rw, iov, len, error) 130 struct vnode *vp; 131 int fd; 132 enum uio_rw rw; 133 register struct iovec *iov; 134 int len, error; 135 { 136 struct ktr_header *kth; 137 register struct ktr_genio *ktp; 138 register caddr_t cp; 139 register int resid = len, cnt; 140 struct proc *p = curproc; /* XXX */ 141 142 if (error) 143 return; 144 p->p_traceflag |= KTRFAC_ACTIVE; 145 kth = ktrgetheader(KTR_GENIO); 146 MALLOC(ktp, struct ktr_genio *, sizeof(struct ktr_genio) + len, 147 M_TEMP, M_WAITOK); 148 ktp->ktr_fd = fd; 149 ktp->ktr_rw = rw; 150 cp = (caddr_t)((char *)ktp + sizeof (struct ktr_genio)); 151 while (resid > 0) { 152 if ((cnt = iov->iov_len) > resid) 153 cnt = resid; 154 if (copyin(iov->iov_base, cp, (unsigned)cnt)) 155 goto done; 156 cp += cnt; 157 resid -= cnt; 158 iov++; 159 } 160 kth->ktr_buf = (caddr_t)ktp; 161 kth->ktr_len = sizeof (struct ktr_genio) + len; 162 163 ktrwrite(vp, kth); 164 done: 165 FREE(kth, M_TEMP); 166 FREE(ktp, M_TEMP); 167 p->p_traceflag &= ~KTRFAC_ACTIVE; 168 } 169 170 ktrpsig(vp, sig, action, mask, code) 171 struct vnode *vp; 172 int sig; 173 sig_t action; 174 int mask, code; 175 { 176 struct ktr_header *kth; 177 struct ktr_psig kp; 178 struct proc *p = curproc; /* XXX */ 179 180 p->p_traceflag |= KTRFAC_ACTIVE; 181 kth = ktrgetheader(KTR_PSIG); 182 kp.signo = (char)sig; 183 kp.action = action; 184 kp.mask = mask; 185 kp.code = code; 186 kth->ktr_buf = (caddr_t)&kp; 187 kth->ktr_len = sizeof (struct ktr_psig); 188 189 ktrwrite(vp, kth); 190 FREE(kth, M_TEMP); 191 p->p_traceflag &= ~KTRFAC_ACTIVE; 192 } 193 194 ktrcsw(vp, out, user) 195 struct vnode *vp; 196 int out, user; 197 { 198 struct ktr_header *kth; 199 struct ktr_csw kc; 200 struct proc *p = curproc; /* XXX */ 201 202 p->p_traceflag |= KTRFAC_ACTIVE; 203 kth = ktrgetheader(KTR_CSW); 204 kc.out = out; 205 kc.user = user; 206 kth->ktr_buf = (caddr_t)&kc; 207 kth->ktr_len = sizeof (struct ktr_csw); 208 209 ktrwrite(vp, kth); 210 FREE(kth, M_TEMP); 211 p->p_traceflag &= ~KTRFAC_ACTIVE; 212 } 213 214 /* Interface and common routines */ 215 216 /* 217 * ktrace system call 218 */ 219 struct ktrace_args { 220 char *fname; 221 int ops; 222 int facs; 223 int pid; 224 }; 225 /* ARGSUSED */ 226 ktrace(curp, uap, retval) 227 struct proc *curp; 228 register struct ktrace_args *uap; 229 int *retval; 230 { 231 register struct vnode *vp = NULL; 232 register struct proc *p; 233 struct pgrp *pg; 234 int facs = uap->facs & ~KTRFAC_ROOT; 235 int ops = KTROP(uap->ops); 236 int descend = uap->ops & KTRFLAG_DESCEND; 237 int ret = 0; 238 int error = 0; 239 struct nameidata nd; 240 241 curp->p_traceflag |= KTRFAC_ACTIVE; 242 if (ops != KTROP_CLEAR) { 243 /* 244 * an operation which requires a file argument. 245 */ 246 NDINIT(&nd, LOOKUP, FOLLOW, UIO_USERSPACE, uap->fname, curp); 247 if (error = vn_open(&nd, FREAD|FWRITE, 0)) { 248 curp->p_traceflag &= ~KTRFAC_ACTIVE; 249 return (error); 250 } 251 vp = nd.ni_vp; 252 VOP_UNLOCK(vp); 253 if (vp->v_type != VREG) { 254 (void) vn_close(vp, FREAD|FWRITE, curp->p_ucred, curp); 255 curp->p_traceflag &= ~KTRFAC_ACTIVE; 256 return (EACCES); 257 } 258 } 259 /* 260 * Clear all uses of the tracefile 261 */ 262 if (ops == KTROP_CLEARFILE) { 263 for (p = (struct proc *)allproc; p != NULL; p = p->p_next) { 264 if (p->p_tracep == vp) { 265 if (ktrcanset(curp, p)) { 266 p->p_tracep = NULL; 267 p->p_traceflag = 0; 268 (void) vn_close(vp, FREAD|FWRITE, 269 p->p_ucred, p); 270 } else 271 error = EPERM; 272 } 273 } 274 goto done; 275 } 276 /* 277 * need something to (un)trace (XXX - why is this here?) 278 */ 279 if (!facs) { 280 error = EINVAL; 281 goto done; 282 } 283 /* 284 * do it 285 */ 286 if (uap->pid < 0) { 287 /* 288 * by process group 289 */ 290 pg = pgfind(-uap->pid); 291 if (pg == NULL) { 292 error = ESRCH; 293 goto done; 294 } 295 for (p = pg->pg_mem; p != NULL; p = p->p_pgrpnxt) 296 if (descend) 297 ret |= ktrsetchildren(curp, p, ops, facs, vp); 298 else 299 ret |= ktrops(curp, p, ops, facs, vp); 300 301 } else { 302 /* 303 * by pid 304 */ 305 p = pfind(uap->pid); 306 if (p == NULL) { 307 error = ESRCH; 308 goto done; 309 } 310 if (descend) 311 ret |= ktrsetchildren(curp, p, ops, facs, vp); 312 else 313 ret |= ktrops(curp, p, ops, facs, vp); 314 } 315 if (!ret) 316 error = EPERM; 317 done: 318 if (vp != NULL) 319 (void) vn_close(vp, FWRITE, curp->p_ucred, curp); 320 curp->p_traceflag &= ~KTRFAC_ACTIVE; 321 return (error); 322 } 323 324 int 325 ktrops(curp, p, ops, facs, vp) 326 struct proc *p, *curp; 327 int ops, facs; 328 struct vnode *vp; 329 { 330 331 if (!ktrcanset(curp, p)) 332 return (0); 333 if (ops == KTROP_SET) { 334 if (p->p_tracep != vp) { 335 /* 336 * if trace file already in use, relinquish 337 */ 338 if (p->p_tracep != NULL) 339 vrele(p->p_tracep); 340 VREF(vp); 341 p->p_tracep = vp; 342 } 343 p->p_traceflag |= facs; 344 if (curp->p_ucred->cr_uid == 0) 345 p->p_traceflag |= KTRFAC_ROOT; 346 } else { 347 /* KTROP_CLEAR */ 348 if (((p->p_traceflag &= ~facs) & KTRFAC_MASK) == 0) { 349 /* no more tracing */ 350 p->p_traceflag = 0; 351 if (p->p_tracep != NULL) { 352 vrele(p->p_tracep); 353 p->p_tracep = NULL; 354 } 355 } 356 } 357 358 return (1); 359 } 360 361 ktrsetchildren(curp, top, ops, facs, vp) 362 struct proc *curp, *top; 363 int ops, facs; 364 struct vnode *vp; 365 { 366 register struct proc *p; 367 register int ret = 0; 368 369 p = top; 370 for (;;) { 371 ret |= ktrops(curp, p, ops, facs, vp); 372 /* 373 * If this process has children, descend to them next, 374 * otherwise do any siblings, and if done with this level, 375 * follow back up the tree (but not past top). 376 */ 377 if (p->p_cptr) 378 p = p->p_cptr; 379 else if (p == top) 380 return (ret); 381 else if (p->p_osptr) 382 p = p->p_osptr; 383 else for (;;) { 384 p = p->p_pptr; 385 if (p == top) 386 return (ret); 387 if (p->p_osptr) { 388 p = p->p_osptr; 389 break; 390 } 391 } 392 } 393 /*NOTREACHED*/ 394 } 395 396 ktrwrite(vp, kth) 397 struct vnode *vp; 398 register struct ktr_header *kth; 399 { 400 struct uio auio; 401 struct iovec aiov[2]; 402 register struct proc *p = curproc; /* XXX */ 403 int error; 404 405 if (vp == NULL) 406 return; 407 auio.uio_iov = &aiov[0]; 408 auio.uio_offset = 0; 409 auio.uio_segflg = UIO_SYSSPACE; 410 auio.uio_rw = UIO_WRITE; 411 aiov[0].iov_base = (caddr_t)kth; 412 aiov[0].iov_len = sizeof(struct ktr_header); 413 auio.uio_resid = sizeof(struct ktr_header); 414 auio.uio_iovcnt = 1; 415 auio.uio_procp = (struct proc *)0; 416 if (kth->ktr_len > 0) { 417 auio.uio_iovcnt++; 418 aiov[1].iov_base = kth->ktr_buf; 419 aiov[1].iov_len = kth->ktr_len; 420 auio.uio_resid += kth->ktr_len; 421 } 422 VOP_LOCK(vp); 423 error = VOP_WRITE(vp, &auio, IO_UNIT|IO_APPEND, p->p_ucred); 424 VOP_UNLOCK(vp); 425 if (!error) 426 return; 427 /* 428 * If error encountered, give up tracing on this vnode. 429 */ 430 log(LOG_NOTICE, "ktrace write failed, errno %d, tracing stopped\n", 431 error); 432 for (p = (struct proc *)allproc; p != NULL; p = p->p_next) { 433 if (p->p_tracep == vp) { 434 p->p_tracep = NULL; 435 p->p_traceflag = 0; 436 vrele(vp); 437 } 438 } 439 } 440 441 /* 442 * Return true if caller has permission to set the ktracing state 443 * of target. Essentially, the target can't possess any 444 * more permissions than the caller. KTRFAC_ROOT signifies that 445 * root previously set the tracing status on the target process, and 446 * so, only root may further change it. 447 * 448 * TODO: check groups. use caller effective gid. 449 */ 450 ktrcanset(callp, targetp) 451 struct proc *callp, *targetp; 452 { 453 register struct pcred *caller = callp->p_cred; 454 register struct pcred *target = targetp->p_cred; 455 456 if ((caller->pc_ucred->cr_uid == target->p_ruid && 457 target->p_ruid == target->p_svuid && 458 caller->p_rgid == target->p_rgid && /* XXX */ 459 target->p_rgid == target->p_svgid && 460 (targetp->p_traceflag & KTRFAC_ROOT) == 0) || 461 caller->pc_ucred->cr_uid == 0) 462 return (1); 463 464 return (0); 465 } 466 467 #endif 468