1*434283fdSDevin Teske# -*- tab-width: 4 -*- ;; Emacs 2*434283fdSDevin Teske# vi: set filetype=sh tabstop=8 shiftwidth=8 noexpandtab :: Vi/ViM 3*434283fdSDevin Teske############################################################ IDENT(1) 4*434283fdSDevin Teske# 5*434283fdSDevin Teske# $Title: dwatch(8) module for priv_check(9) privilege requests $ 6*434283fdSDevin Teske# $Copyright: 2026 Devin Teske. All rights reserved. $ 7*434283fdSDevin Teske# 8*434283fdSDevin Teske############################################################ DESCRIPTION 9*434283fdSDevin Teske# 10*434283fdSDevin Teske# Print privilege requests denied by priv_check(9), decoded to their 11*434283fdSDevin Teske# symbolic priv(9) names by the priv_string table in priv.d of 12*434283fdSDevin Teske# libdtrace(1). Answers "why is this process getting EPERM?" -- kernel 13*434283fdSDevin Teske# privilege denials (jails, unprivileged users, MAC policies) name the 14*434283fdSDevin Teske# exact privilege refused, something no amount of truss(1) will reveal. 15*434283fdSDevin Teske# Use priv-ok to instead watch privileges being granted. 16*434283fdSDevin Teske# 17*434283fdSDevin Teske# NB: Requires priv.d, a drop-in file for older releases like this module. 18*434283fdSDevin Teske# 19*434283fdSDevin Teske############################################################ PROBE 20*434283fdSDevin Teske 21*434283fdSDevin Teskecase "$PROFILE" in 22*434283fdSDevin Teskepriv) 23*434283fdSDevin Teske : ${PROBE:=priv:kernel:priv_check:priv-err} ;; 24*434283fdSDevin Teske*) 25*434283fdSDevin Teske : ${PROBE:=priv:kernel:priv_check:${PROFILE#priv-}} 26*434283fdSDevin Teskeesac 27*434283fdSDevin Teske 28*434283fdSDevin Teske############################################################ ACTIONS 29*434283fdSDevin Teske 30*434283fdSDevin Teskeexec 9<<EOF 31*434283fdSDevin Teskethis int priv; 32*434283fdSDevin Teske 33*434283fdSDevin Teske$PROBE /* probe ID $ID */ 34*434283fdSDevin Teske{${TRACE:+ 35*434283fdSDevin Teske printf("<$ID>");} 36*434283fdSDevin Teske this->priv = (int)arg0; 37*434283fdSDevin Teske} 38*434283fdSDevin TeskeEOF 39*434283fdSDevin TeskeACTIONS=$( cat <&9 ) 40*434283fdSDevin TeskeID=$(( $ID + 1 )) 41*434283fdSDevin Teske 42*434283fdSDevin Teske############################################################ EVENT DETAILS 43*434283fdSDevin Teske 44*434283fdSDevin Teskeif [ ! "$CUSTOM_DETAILS" ]; then 45*434283fdSDevin Teskeexec 9<<EOF 46*434283fdSDevin Teske /* 47*434283fdSDevin Teske * Print privilege request details 48*434283fdSDevin Teske */ 49*434283fdSDevin Teske printf("%s %s (%d)", 50*434283fdSDevin Teske probename == "priv-err" ? "denied" : "granted", 51*434283fdSDevin Teske priv_string[this->priv], 52*434283fdSDevin Teske this->priv); 53*434283fdSDevin TeskeEOF 54*434283fdSDevin TeskeEVENT_DETAILS=$( cat <&9 ) 55*434283fdSDevin Teskefi 56*434283fdSDevin Teske 57*434283fdSDevin Teske################################################################################ 58*434283fdSDevin Teske# END 59*434283fdSDevin Teske################################################################################ 60