1# -*- tab-width: 4 -*- ;; Emacs 2# vi: set filetype=sh tabstop=8 shiftwidth=8 noexpandtab :: Vi/ViM 3############################################################ IDENT(1) 4# 5# $Title: dwatch(8) module for jail(2) management syscalls $ 6# $Copyright: 2026 Devin Teske. All rights reserved. $ 7# 8############################################################ DESCRIPTION 9# 10# Print jail management activity -- jail(2), jail_set(2), jail_get(2), 11# jail_attach(2), and jail_remove(2) -- naming the syscall, the jail id 12# operated on, and any errno returned. Answers "who is creating, 13# entering, or destroying jails?" Complements the dwatch `-j jail' 14# filter, which scopes any profile to processes inside one jail; this 15# profile watches the management plane itself, from any jail or none. 16# Use jail-attach, jail-get, jail-remove, or jail-set to watch a 17# single operation by name. 18# 19############################################################ PROBE 20 21case "$PROFILE" in 22jail) 23 : ${PROBE:=$( echo \ 24 syscall::jail:return, \ 25 syscall::jail_set:return, \ 26 syscall::jail_get:return, \ 27 syscall::jail_attach:return, \ 28 syscall::jail_remove:return )} ;; 29*) 30 : ${PROBE:=syscall::jail_${PROFILE#jail-}:return} 31esac 32 33# 34# Derive the matching entry probes from the return probes being watched 35# 36ENTRY_PROBE=$( echo "$PROBE" | awk 'gsub(/:return/, ":entry") || 1' ) 37 38############################################################ ACTIONS 39 40exec 9<<EOF 41self int jail_arg; 42this int jail_jid; 43 44$ENTRY_PROBE /* probe ID $ID */ 45{${TRACE:+ 46 printf("<$ID>");} 47 self->jail_arg = -1; 48} 49 50syscall::jail_attach:entry, 51syscall::jail_remove:entry /* probe ID $(( $ID + 1 )) */ 52{${TRACE:+ 53 printf("<$(( $ID + 1 ))>");} 54 /* arg0 is the jail id being attached-to or removed */ 55 self->jail_arg = (int)arg0; 56} 57 58$PROBE /* probe ID $(( $ID + 2 )) */ 59{${TRACE:+ 60 printf("<$(( $ID + 2 ))>"); 61} 62 /* 63 * jail(2), jail_set(2), and jail_get(2) return the jail id; 64 * jail_attach(2) and jail_remove(2) were given it at entry 65 */ 66 this->jail_jid = self->jail_arg >= 0 ? 67 self->jail_arg : (int)arg0; 68 self->jail_arg = 0; 69} 70EOF 71ACTIONS=$( cat <&9 ) 72ID=$(( $ID + 3 )) 73 74############################################################ EVENT DETAILS 75 76if [ ! "$CUSTOM_DETAILS" ]; then 77exec 9<<EOF 78 /* 79 * Print jail management details 80 */ 81 printf("%s(2) jid %d%s%s", 82 probefunc, 83 this->jail_jid, 84 errno > 0 ? " -- " : "", 85 errno > 0 ? strerror[errno] : ""); 86EOF 87EVENT_DETAILS=$( cat <&9 ) 88fi 89 90################################################################################ 91# END 92################################################################################ 93