1 /*-
2 * SPDX-License-Identifier: BSD-2-Clause
3 *
4 * Copyright (c) 2007-2011 Robert N. M. Watson
5 * Copyright (c) 2015 Allan Jude <allanjude@freebsd.org>
6 * All rights reserved.
7 *
8 * Redistribution and use in source and binary forms, with or without
9 * modification, are permitted provided that the following conditions
10 * are met:
11 * 1. Redistributions of source code must retain the above copyright
12 * notice, this list of conditions and the following disclaimer.
13 * 2. Redistributions in binary form must reproduce the above copyright
14 * notice, this list of conditions and the following disclaimer in the
15 * documentation and/or other materials provided with the distribution.
16 *
17 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
18 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
19 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
20 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
21 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
22 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
23 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
24 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
25 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
26 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
27 * SUCH DAMAGE.
28 */
29
30 #include <sys/param.h>
31 #include <sys/capsicum.h>
32 #include <sys/socket.h>
33 #include <sys/sysctl.h>
34 #include <sys/un.h>
35 #include <sys/user.h>
36
37 #include <netinet/in.h>
38
39 #include <arpa/inet.h>
40
41 #include <err.h>
42 #include <libprocstat.h>
43 #include <inttypes.h>
44 #include <stdio.h>
45 #include <stdlib.h>
46 #include <string.h>
47
48 #include "procstat.h"
49
50 static const char *
protocol_to_string(int domain,int type,int protocol)51 protocol_to_string(int domain, int type, int protocol)
52 {
53
54 switch (domain) {
55 case AF_INET:
56 case AF_INET6:
57 switch (protocol) {
58 case IPPROTO_TCP:
59 return ("TCP");
60 case IPPROTO_UDP:
61 return ("UDP");
62 case IPPROTO_ICMP:
63 return ("ICM");
64 case IPPROTO_RAW:
65 return ("RAW");
66 case IPPROTO_SCTP:
67 return ("SCT");
68 default:
69 return ("IP?");
70 }
71
72 case AF_LOCAL:
73 switch (type) {
74 case SOCK_STREAM:
75 return ("UDS");
76 case SOCK_DGRAM:
77 return ("UDD");
78 case SOCK_SEQPACKET:
79 return ("UDQ");
80 default:
81 return ("UD?");
82 }
83 case AF_DIVERT:
84 return ("IPD");
85 break;
86 default:
87 return ("?");
88 }
89 }
90
91 static void
addr_to_string(struct sockaddr_storage * ss,char * buffer,int buflen)92 addr_to_string(struct sockaddr_storage *ss, char *buffer, int buflen)
93 {
94 char buffer2[INET6_ADDRSTRLEN];
95 struct sockaddr_in6 *sin6;
96 struct sockaddr_in *sin;
97 struct sockaddr_un *sun;
98
99 switch (ss->ss_family) {
100 case AF_LOCAL:
101 sun = (struct sockaddr_un *)ss;
102 if (strlen(sun->sun_path) == 0)
103 strlcpy(buffer, "-", buflen);
104 else
105 strlcpy(buffer, sun->sun_path, buflen);
106 break;
107
108 case AF_INET:
109 sin = (struct sockaddr_in *)ss;
110 if (sin->sin_addr.s_addr == INADDR_ANY)
111 snprintf(buffer, buflen, "%s:%d", "*",
112 ntohs(sin->sin_port));
113 else if (inet_ntop(AF_INET, &sin->sin_addr, buffer2,
114 sizeof(buffer2)) != NULL)
115 snprintf(buffer, buflen, "%s:%d", buffer2,
116 ntohs(sin->sin_port));
117 break;
118
119 case AF_INET6:
120 sin6 = (struct sockaddr_in6 *)ss;
121 if (inet_ntop(AF_INET6, &sin6->sin6_addr, buffer2,
122 sizeof(buffer2)) != NULL)
123 snprintf(buffer, buflen, "%s.%d", buffer2,
124 ntohs(sin6->sin6_port));
125 else
126 strlcpy(buffer, "-", buflen);
127 break;
128
129 default:
130 strlcpy(buffer, "", buflen);
131 break;
132 }
133 }
134
135 static struct cap_desc {
136 uint64_t cd_right;
137 const char *cd_desc;
138 } cap_desc[] = {
139 /* General file I/O. */
140 { CAP_READ, "rd" },
141 { CAP_WRITE, "wr" },
142 { CAP_SEEK, "se" },
143 { CAP_MMAP, "mm" },
144 { CAP_CREATE, "cr" },
145 { CAP_FEXECVE, "fe" },
146 { CAP_FSYNC, "fy" },
147 { CAP_FTRUNCATE, "ft" },
148
149 /* VFS methods. */
150 { CAP_FCHDIR, "cd" },
151 { CAP_FCHFLAGS, "cf" },
152 { CAP_FCHMOD, "cm" },
153 { CAP_FCHOWN, "cn" },
154 { CAP_FCHROOT, "ct" },
155 { CAP_FCNTL, "fc" },
156 { CAP_FLOCK, "fl" },
157 { CAP_FPATHCONF, "fp" },
158 { CAP_FSCK, "fk" },
159 { CAP_FSTAT, "fs" },
160 { CAP_FSTATFS, "sf" },
161 { CAP_FUTIMES, "fu" },
162 { CAP_LINKAT_SOURCE, "ls" },
163 { CAP_LINKAT_TARGET, "lt" },
164 { CAP_MKDIRAT, "md" },
165 { CAP_MKFIFOAT, "mf" },
166 { CAP_MKNODAT, "mn" },
167 { CAP_RENAMEAT_SOURCE, "rs" },
168 { CAP_RENAMEAT_TARGET, "rt" },
169 { CAP_SYMLINKAT, "sl" },
170 { CAP_UNLINKAT, "un" },
171
172 /* Lookups - used to constrain *at() calls. */
173 { CAP_LOOKUP, "lo" },
174
175 /* Extended attributes. */
176 { CAP_EXTATTR_GET, "eg" },
177 { CAP_EXTATTR_SET, "es" },
178 { CAP_EXTATTR_DELETE, "ed" },
179 { CAP_EXTATTR_LIST, "el" },
180
181 /* Access Control Lists. */
182 { CAP_ACL_GET, "ag" },
183 { CAP_ACL_SET, "as" },
184 { CAP_ACL_DELETE, "ad" },
185 { CAP_ACL_CHECK, "ac" },
186
187 /* Socket operations. */
188 { CAP_ACCEPT, "at" },
189 { CAP_BIND, "bd" },
190 { CAP_CONNECT, "co" },
191 { CAP_GETPEERNAME, "pn" },
192 { CAP_GETSOCKNAME, "sn" },
193 { CAP_GETSOCKOPT, "gs" },
194 { CAP_LISTEN, "ln" },
195 { CAP_PEELOFF, "pf" },
196 { CAP_SETSOCKOPT, "ss" },
197 { CAP_SHUTDOWN, "sh" },
198
199 /* Mandatory Access Control. */
200 { CAP_MAC_GET, "mg" },
201 { CAP_MAC_SET, "ms" },
202
203 /* Methods on semaphores. */
204 { CAP_SEM_GETVALUE, "sg" },
205 { CAP_SEM_POST, "sp" },
206 { CAP_SEM_WAIT, "sw" },
207
208 /* Event monitoring and posting. */
209 { CAP_EVENT, "ev" },
210 { CAP_KQUEUE_EVENT, "ke" },
211 { CAP_KQUEUE_CHANGE, "kc" },
212
213 /* Strange and powerful rights that should not be given lightly. */
214 { CAP_IOCTL, "io" },
215 { CAP_TTYHOOK, "ty" },
216
217 /* Process management via process descriptors. */
218 { CAP_PDGETPID, "pg" },
219 { CAP_PDWAIT, "pw" },
220 { CAP_PDKILL, "pk" },
221
222 /*
223 * Rights that allow to use bindat(2) and connectat(2) syscalls on a
224 * directory descriptor.
225 */
226 { CAP_BINDAT, "ba" },
227 { CAP_CONNECTAT, "ca" },
228
229 /* Inotify descriptor rights. */
230 { CAP_INOTIFY_ADD, "ina" },
231 { CAP_INOTIFY_RM, "inr" },
232
233 /* Aliases and defines that combine multiple rights. */
234 { CAP_PREAD, "prd" },
235 { CAP_PWRITE, "pwr" },
236
237 { CAP_MMAP_R, "mmr" },
238 { CAP_MMAP_W, "mmw" },
239 { CAP_MMAP_X, "mmx" },
240 { CAP_MMAP_RW, "mrw" },
241 { CAP_MMAP_RX, "mrx" },
242 { CAP_MMAP_WX, "mwx" },
243 { CAP_MMAP_RWX, "mma" },
244
245 { CAP_RECV, "re" },
246 { CAP_SEND, "sd" },
247
248 { CAP_SOCK_CLIENT, "scl" },
249 { CAP_SOCK_SERVER, "ssr" },
250 };
251 static const u_int cap_desc_count = nitems(cap_desc);
252
253 static u_int
width_capability(cap_rights_t * rightsp)254 width_capability(cap_rights_t *rightsp)
255 {
256 u_int count, i, width;
257
258 count = 0;
259 width = 0;
260 for (i = 0; i < cap_desc_count; i++) {
261 if (cap_rights_is_set(rightsp, cap_desc[i].cd_right)) {
262 width += strlen(cap_desc[i].cd_desc);
263 if (count)
264 width++;
265 count++;
266 }
267 }
268 return (width);
269 }
270
271 static void
print_capability(cap_rights_t * rightsp,u_int capwidth)272 print_capability(cap_rights_t *rightsp, u_int capwidth)
273 {
274 u_int count, i;
275
276 count = 0;
277 for (i = width_capability(rightsp); i < capwidth; i++) {
278 if (i != 0)
279 xo_emit(" ");
280 else
281 xo_emit("-");
282 }
283 xo_open_list("capabilities");
284 for (i = 0; i < cap_desc_count; i++) {
285 if (cap_rights_is_set(rightsp, cap_desc[i].cd_right)) {
286 xo_emit("{D:/%s}{l:capabilities/%s}", count ? "," : "",
287 cap_desc[i].cd_desc);
288 count++;
289 }
290 }
291 xo_close_list("capabilities");
292 }
293
294 void
procstat_files(struct procstat * procstat,struct kinfo_proc * kipp)295 procstat_files(struct procstat *procstat, struct kinfo_proc *kipp)
296 {
297 struct sockstat sock;
298 struct filestat_list *head;
299 struct filestat *fst;
300 const char *str;
301 struct vnstat vn;
302 u_int capwidth, width;
303 int error;
304 char src_addr[PATH_MAX];
305 char dst_addr[PATH_MAX];
306
307 /*
308 * To print the header in capability mode, we need to know the width
309 * of the widest capability string. Even if we get no processes
310 * back, we will print the header, so we defer aborting due to a lack
311 * of processes until after the header logic.
312 */
313 capwidth = 0;
314 head = procstat_getfiles(procstat, kipp, 0);
315 if (head != NULL &&
316 (procstat_opts & PS_OPT_CAPABILITIES) != 0) {
317 STAILQ_FOREACH(fst, head, next) {
318 width = width_capability(&fst->fs_cap_rights);
319 if (width > capwidth)
320 capwidth = width;
321 }
322 if (capwidth < strlen("CAPABILITIES"))
323 capwidth = strlen("CAPABILITIES");
324 }
325
326 if ((procstat_opts & PS_OPT_NOHEADER) == 0) {
327 if ((procstat_opts & PS_OPT_CAPABILITIES) != 0)
328 xo_emit("{T:/%5s %-16s %5s %1s %-8s %-*s "
329 "%-3s %-12s}\n", "PID", "COMM", "FD", "T",
330 "FLAGS", capwidth, "CAPABILITIES", "PRO",
331 "NAME");
332 else
333 xo_emit("{T:/%5s %-16s %5s %1s %1s %-8s "
334 "%3s %7s %-3s %-12s}\n", "PID", "COMM", "FD", "T",
335 "V", "FLAGS", "REF", "OFFSET", "PRO", "NAME");
336 }
337
338 if (head == NULL)
339 return;
340 xo_emit("{ek:process_id/%5d/%d}", kipp->ki_pid);
341 xo_emit("{e:command/%-16s/%s}", kipp->ki_comm);
342 xo_open_list("files");
343 STAILQ_FOREACH(fst, head, next) {
344 xo_open_instance("files");
345 xo_emit("{dk:process_id/%5d/%d} ", kipp->ki_pid);
346 xo_emit("{d:command/%-16s/%s} ", kipp->ki_comm);
347 if (fst->fs_uflags & PS_FST_UFLAG_CTTY)
348 xo_emit("{P: }{:fd/%s} ", "ctty");
349 else if (fst->fs_uflags & PS_FST_UFLAG_CDIR)
350 xo_emit("{P: }{:fd/%s} ", "cwd");
351 else if (fst->fs_uflags & PS_FST_UFLAG_JAIL)
352 xo_emit("{P: }{:fd/%s} ", "jail");
353 else if (fst->fs_uflags & PS_FST_UFLAG_RDIR)
354 xo_emit("{P: }{:fd/%s} ", "root");
355 else if (fst->fs_uflags & PS_FST_UFLAG_TEXT)
356 xo_emit("{P: }{:fd/%s} ", "text");
357 else if (fst->fs_uflags & PS_FST_UFLAG_TRACE)
358 xo_emit("{:fd/%s} ", "trace");
359 else
360 xo_emit("{:fd/%5d} ", fst->fs_fd);
361
362 switch (fst->fs_type) {
363 case PS_FST_TYPE_VNODE:
364 str = "v";
365 xo_emit("{eq:fd_type/vnode}");
366 break;
367
368 case PS_FST_TYPE_SOCKET:
369 str = "s";
370 xo_emit("{eq:fd_type/socket}");
371 break;
372
373 case PS_FST_TYPE_PIPE:
374 str = "p";
375 xo_emit("{eq:fd_type/pipe}");
376 break;
377
378 case PS_FST_TYPE_FIFO:
379 str = "f";
380 xo_emit("{eq:fd_type/fifo}");
381 break;
382
383 case PS_FST_TYPE_KQUEUE:
384 str = "k";
385 xo_emit("{eq:fd_type/kqueue}");
386 break;
387
388 case PS_FST_TYPE_MQUEUE:
389 str = "m";
390 xo_emit("{eq:fd_type/mqueue}");
391 break;
392
393 case PS_FST_TYPE_SHM:
394 str = "h";
395 xo_emit("{eq:fd_type/shm}");
396 break;
397
398 case PS_FST_TYPE_PTS:
399 str = "t";
400 xo_emit("{eq:fd_type/pts}");
401 break;
402
403 case PS_FST_TYPE_SEM:
404 str = "e";
405 xo_emit("{eq:fd_type/sem}");
406 break;
407
408 case PS_FST_TYPE_PROCDESC:
409 str = "P";
410 xo_emit("{eq:fd_type/procdesc}");
411 break;
412
413 case PS_FST_TYPE_DEV:
414 str = "D";
415 xo_emit("{eq:fd_type/dev}");
416 break;
417
418 case PS_FST_TYPE_EVENTFD:
419 str = "E";
420 xo_emit("{eq:fd_type/eventfd}");
421 break;
422
423 case PS_FST_TYPE_INOTIFY:
424 str = "i";
425 xo_emit("{eq:fd_type/inotify}");
426 break;
427
428 case PS_FST_TYPE_NONE:
429 str = "?";
430 xo_emit("{eq:fd_type/none}");
431 break;
432
433 case PS_FST_TYPE_UNKNOWN:
434 default:
435 str = "?";
436 xo_emit("{eq:fd_type/unknown}");
437 break;
438 }
439 xo_emit("{d:fd_type/%1s/%s} ", str);
440 if ((procstat_opts & PS_OPT_CAPABILITIES) == 0) {
441 str = "-";
442 if (fst->fs_type == PS_FST_TYPE_VNODE) {
443 error = procstat_get_vnode_info(procstat, fst,
444 &vn, NULL);
445 switch (vn.vn_type) {
446 case PS_FST_VTYPE_VREG:
447 str = "r";
448 xo_emit("{eq:vode_type/regular}");
449 break;
450
451 case PS_FST_VTYPE_VDIR:
452 str = "d";
453 xo_emit("{eq:vode_type/directory}");
454 break;
455
456 case PS_FST_VTYPE_VBLK:
457 str = "b";
458 xo_emit("{eq:vode_type/block}");
459 break;
460
461 case PS_FST_VTYPE_VCHR:
462 str = "c";
463 xo_emit("{eq:vode_type/character}");
464 break;
465
466 case PS_FST_VTYPE_VLNK:
467 str = "l";
468 xo_emit("{eq:vode_type/link}");
469 break;
470
471 case PS_FST_VTYPE_VSOCK:
472 str = "s";
473 xo_emit("{eq:vode_type/socket}");
474 break;
475
476 case PS_FST_VTYPE_VFIFO:
477 str = "f";
478 xo_emit("{eq:vode_type/fifo}");
479 break;
480
481 case PS_FST_VTYPE_VBAD:
482 str = "x";
483 xo_emit("{eq:vode_type/revoked_device}");
484 break;
485
486 case PS_FST_VTYPE_VNON:
487 str = "?";
488 xo_emit("{eq:vode_type/non}");
489 break;
490
491 case PS_FST_VTYPE_UNKNOWN:
492 default:
493 str = "?";
494 xo_emit("{eq:vode_type/unknown}");
495 break;
496 }
497 }
498 xo_emit("{d:vnode_type/%1s/%s} ", str);
499 }
500
501 xo_emit("{d:/%s}", fst->fs_fflags & PS_FST_FFLAG_READ ?
502 "r" : "-");
503 xo_emit("{d:/%s}", fst->fs_fflags & PS_FST_FFLAG_WRITE ?
504 "w" : "-");
505 xo_emit("{d:/%s}", fst->fs_fflags & PS_FST_FFLAG_APPEND ?
506 "a" : "-");
507 xo_emit("{d:/%s}", fst->fs_fflags & PS_FST_FFLAG_ASYNC ?
508 "s" : "-");
509 xo_emit("{d:/%s}", fst->fs_fflags & PS_FST_FFLAG_SYNC ?
510 "f" : "-");
511 xo_emit("{d:/%s}", fst->fs_fflags & PS_FST_FFLAG_NONBLOCK ?
512 "n" : "-");
513 xo_emit("{d:/%s}", fst->fs_fflags & PS_FST_FFLAG_DIRECT ?
514 "d" : "-");
515 xo_emit("{d:/%s}", fst->fs_fflags & PS_FST_FFLAG_HASLOCK ?
516 "l" : "-");
517 xo_emit(" ");
518 xo_open_list("fd_flags");
519 if (fst->fs_fflags & PS_FST_FFLAG_READ)
520 xo_emit("{elq:fd_flags/read}");
521 if (fst->fs_fflags & PS_FST_FFLAG_WRITE)
522 xo_emit("{elq:fd_flags/write}");
523 if (fst->fs_fflags & PS_FST_FFLAG_APPEND)
524 xo_emit("{elq:fd_flags/append}");
525 if (fst->fs_fflags & PS_FST_FFLAG_ASYNC)
526 xo_emit("{elq:fd_flags/async}");
527 if (fst->fs_fflags & PS_FST_FFLAG_SYNC)
528 xo_emit("{elq:fd_flags/fsync}");
529 if (fst->fs_fflags & PS_FST_FFLAG_NONBLOCK)
530 xo_emit("{elq:fd_flags/nonblocking}");
531 if (fst->fs_fflags & PS_FST_FFLAG_DIRECT)
532 xo_emit("{elq:fd_flags/direct_io}");
533 if (fst->fs_fflags & PS_FST_FFLAG_HASLOCK)
534 xo_emit("{elq:fd_flags/lock_held}");
535 xo_close_list("fd_flags");
536
537 if ((procstat_opts & PS_OPT_CAPABILITIES) == 0) {
538 if (fst->fs_ref_count > -1)
539 xo_emit("{:ref_count/%3d/%d} ",
540 fst->fs_ref_count);
541 else
542 xo_emit("{q:ref_count/%3c/%c} ", '-');
543 if (fst->fs_offset > -1)
544 xo_emit("{:offset/%7jd/%jd} ",
545 (intmax_t)fst->fs_offset);
546 else
547 xo_emit("{q:offset/%7c/%c} ", '-');
548 }
549 if ((procstat_opts & PS_OPT_CAPABILITIES) != 0) {
550 print_capability(&fst->fs_cap_rights, capwidth);
551 xo_emit(" ");
552 }
553 switch (fst->fs_type) {
554 case PS_FST_TYPE_SOCKET:
555 error = procstat_get_socket_info(procstat, fst, &sock,
556 NULL);
557 if (error != 0)
558 break;
559 xo_emit("{:protocol/%-3s/%s} ",
560 protocol_to_string(sock.dom_family,
561 sock.type, sock.proto));
562 if (sock.proto == IPPROTO_TCP ||
563 sock.proto == IPPROTO_SCTP ||
564 sock.type == SOCK_STREAM) {
565 xo_emit("{:sendq/%u} ", sock.sendq);
566 xo_emit("{:recvq/%u} ", sock.recvq);
567 }
568 /*
569 * While generally we like to print two addresses,
570 * local and peer, for sockets, it turns out to be
571 * more useful to print the first non-nul address for
572 * local sockets, as typically they aren't bound and
573 * connected, and the path strings can get long.
574 */
575 if (sock.dom_family == AF_LOCAL) {
576 struct sockaddr_un *sun =
577 (struct sockaddr_un *)&sock.sa_local;
578
579 if (sun->sun_path[0] != 0)
580 addr_to_string(&sock.sa_local,
581 src_addr, sizeof(src_addr));
582 else
583 addr_to_string(&sock.sa_peer,
584 src_addr, sizeof(src_addr));
585 xo_emit("{:path/%s}", src_addr);
586 } else {
587 addr_to_string(&sock.sa_local, src_addr,
588 sizeof(src_addr));
589 addr_to_string(&sock.sa_peer, dst_addr,
590 sizeof(dst_addr));
591 xo_emit("{:path/%s %s}", src_addr, dst_addr);
592 }
593 break;
594
595 default:
596 xo_emit("{:protocol/%-3s/%s} ", "-");
597 xo_emit("{:path/%-18s/%s}", fst->fs_path != NULL ?
598 fst->fs_path : "-");
599 }
600
601 xo_emit("\n");
602 xo_close_instance("files");
603 }
604 xo_close_list("files");
605 procstat_freefiles(procstat, head);
606 }
607