1 /*- 2 * Copyright (c) 2011, David E. O'Brien. 3 * Copyright (c) 2009-2011, Juniper Networks, Inc. 4 * Copyright (c) 2015-2016, EMC Corp. 5 * All rights reserved. 6 * 7 * Redistribution and use in source and binary forms, with or without 8 * modification, are permitted provided that the following conditions 9 * are met: 10 * 1. Redistributions of source code must retain the above copyright 11 * notice, this list of conditions and the following disclaimer. 12 * 2. Redistributions in binary form must reproduce the above copyright 13 * notice, this list of conditions and the following disclaimer in the 14 * documentation and/or other materials provided with the distribution. 15 * 16 * THIS SOFTWARE IS PROVIDED BY JUNIPER NETWORKS AND CONTRIBUTORS ``AS IS'' AND 17 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 18 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 19 * ARE DISCLAIMED. IN NO EVENT SHALL JUNIPER NETWORKS OR CONTRIBUTORS BE LIABLE 20 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 21 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 22 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 23 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 24 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 25 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 26 * SUCH DAMAGE. 27 */ 28 29 #include <sys/cdefs.h> 30 __FBSDID("$FreeBSD$"); 31 32 #include "opt_compat.h" 33 34 #include <sys/param.h> 35 #include <sys/file.h> 36 #include <sys/systm.h> 37 #include <sys/buf.h> 38 #include <sys/capsicum.h> 39 #include <sys/condvar.h> 40 #include <sys/conf.h> 41 #include <sys/fcntl.h> 42 #include <sys/ioccom.h> 43 #include <sys/kernel.h> 44 #include <sys/lock.h> 45 #include <sys/malloc.h> 46 #include <sys/module.h> 47 #include <sys/poll.h> 48 #include <sys/proc.h> 49 #include <sys/sx.h> 50 #include <sys/syscall.h> 51 #include <sys/sysent.h> 52 #include <sys/sysproto.h> 53 #include <sys/uio.h> 54 55 #include "filemon.h" 56 57 #if defined(COMPAT_FREEBSD32) 58 #include <compat/freebsd32/freebsd32_syscall.h> 59 #include <compat/freebsd32/freebsd32_proto.h> 60 #include <compat/freebsd32/freebsd32_util.h> 61 #endif 62 63 static d_close_t filemon_close; 64 static d_ioctl_t filemon_ioctl; 65 static d_open_t filemon_open; 66 67 static struct cdevsw filemon_cdevsw = { 68 .d_version = D_VERSION, 69 .d_close = filemon_close, 70 .d_ioctl = filemon_ioctl, 71 .d_open = filemon_open, 72 .d_name = "filemon", 73 }; 74 75 MALLOC_DECLARE(M_FILEMON); 76 MALLOC_DEFINE(M_FILEMON, "filemon", "File access monitor"); 77 78 /* 79 * The filemon->lock protects several things currently: 80 * - fname1/fname2/msgbufr are pre-allocated and used per syscall 81 * for logging and copyins rather than stack variables. 82 * - Serializing the filemon's log output. 83 * - Preventing inheritance or removal of the filemon into proc.p_filemon. 84 */ 85 struct filemon { 86 struct sx lock; /* Lock for this filemon. */ 87 struct file *fp; /* Output file pointer. */ 88 struct ucred *cred; /* Credential of tracer. */ 89 char fname1[MAXPATHLEN]; /* Temporary filename buffer. */ 90 char fname2[MAXPATHLEN]; /* Temporary filename buffer. */ 91 char msgbufr[1024]; /* Output message buffer. */ 92 int error; /* Log write error, returned on close(2). */ 93 u_int refcnt; /* Pointer reference count. */ 94 u_int proccnt; /* Process count. */ 95 }; 96 97 static struct cdev *filemon_dev; 98 static void filemon_output(struct filemon *filemon, char *msg, size_t len); 99 100 static __inline struct filemon * 101 filemon_acquire(struct filemon *filemon) 102 { 103 104 if (filemon != NULL) 105 refcount_acquire(&filemon->refcnt); 106 return (filemon); 107 } 108 109 /* 110 * Release a reference and free on the last one. 111 */ 112 static void 113 filemon_release(struct filemon *filemon) 114 { 115 116 if (refcount_release(&filemon->refcnt) == 0) 117 return; 118 /* 119 * There are valid cases of releasing while locked, such as in 120 * filemon_untrack_processes, but none which are done where there 121 * is not at least 1 reference remaining. 122 */ 123 sx_assert(&filemon->lock, SA_UNLOCKED); 124 125 if (filemon->cred != NULL) 126 crfree(filemon->cred); 127 sx_destroy(&filemon->lock); 128 free(filemon, M_FILEMON); 129 } 130 131 /* 132 * Acquire the proc's p_filemon reference and lock the filemon. 133 * The proc's p_filemon may not match this filemon on return. 134 */ 135 static struct filemon * 136 filemon_proc_get(struct proc *p) 137 { 138 struct filemon *filemon; 139 140 PROC_LOCK(p); 141 filemon = filemon_acquire(p->p_filemon); 142 PROC_UNLOCK(p); 143 144 if (filemon == NULL) 145 return (NULL); 146 /* 147 * The p->p_filemon may have changed by now. That case is handled 148 * by the exit and fork hooks and filemon_attach_proc specially. 149 */ 150 sx_xlock(&filemon->lock); 151 return (filemon); 152 } 153 154 /* Remove and release the filemon on the given process. */ 155 static void 156 filemon_proc_drop(struct proc *p) 157 { 158 struct filemon *filemon; 159 160 KASSERT(p->p_filemon != NULL, ("%s: proc %p NULL p_filemon", 161 __func__, p)); 162 sx_assert(&p->p_filemon->lock, SA_XLOCKED); 163 PROC_LOCK(p); 164 filemon = p->p_filemon; 165 p->p_filemon = NULL; 166 --filemon->proccnt; 167 PROC_UNLOCK(p); 168 /* 169 * This should not be the last reference yet. filemon_release() 170 * cannot be called with filemon locked, which the caller expects 171 * will stay locked. 172 */ 173 KASSERT(filemon->refcnt > 1, ("%s: proc %p dropping filemon %p " 174 "with last reference", __func__, p, filemon)); 175 filemon_release(filemon); 176 } 177 178 /* Unlock and release the filemon. */ 179 static __inline void 180 filemon_drop(struct filemon *filemon) 181 { 182 183 sx_xunlock(&filemon->lock); 184 filemon_release(filemon); 185 } 186 187 #include "filemon_wrapper.c" 188 189 static void 190 filemon_write_header(struct filemon *filemon) 191 { 192 int len; 193 struct timeval now; 194 195 getmicrotime(&now); 196 197 len = snprintf(filemon->msgbufr, sizeof(filemon->msgbufr), 198 "# filemon version %d\n# Target pid %d\n# Start %ju.%06ju\nV %d\n", 199 FILEMON_VERSION, curproc->p_pid, (uintmax_t)now.tv_sec, 200 (uintmax_t)now.tv_usec, FILEMON_VERSION); 201 202 filemon_output(filemon, filemon->msgbufr, len); 203 } 204 205 /* 206 * Invalidate the passed filemon in all processes. 207 */ 208 static void 209 filemon_untrack_processes(struct filemon *filemon) 210 { 211 struct proc *p; 212 213 sx_assert(&filemon->lock, SA_XLOCKED); 214 215 /* Avoid allproc loop if there is no need. */ 216 if (filemon->proccnt == 0) 217 return; 218 219 /* 220 * Processes in this list won't go away while here since 221 * filemon_event_process_exit() will lock on filemon->lock 222 * which we hold. 223 */ 224 sx_slock(&allproc_lock); 225 FOREACH_PROC_IN_SYSTEM(p) { 226 /* 227 * No PROC_LOCK is needed to compare here since it is 228 * guaranteed to not change since we have its filemon 229 * locked. Everything that changes this p_filemon will 230 * be locked on it. 231 */ 232 if (p->p_filemon == filemon) 233 filemon_proc_drop(p); 234 } 235 sx_sunlock(&allproc_lock); 236 237 /* 238 * It's possible some references were acquired but will be 239 * dropped shortly as they are restricted from being 240 * inherited. There is at least the reference in cdevpriv remaining. 241 */ 242 KASSERT(filemon->refcnt > 0, ("%s: filemon %p should have " 243 "references still.", __func__, filemon)); 244 KASSERT(filemon->proccnt == 0, ("%s: filemon %p should not have " 245 "attached procs still.", __func__, filemon)); 246 } 247 248 /* 249 * Close out the log. 250 */ 251 static void 252 filemon_close_log(struct filemon *filemon) 253 { 254 struct file *fp; 255 struct timeval now; 256 size_t len; 257 258 sx_assert(&filemon->lock, SA_XLOCKED); 259 if (filemon->fp == NULL) 260 return; 261 262 getmicrotime(&now); 263 264 len = snprintf(filemon->msgbufr, 265 sizeof(filemon->msgbufr), 266 "# Stop %ju.%06ju\n# Bye bye\n", 267 (uintmax_t)now.tv_sec, (uintmax_t)now.tv_usec); 268 269 filemon_output(filemon, filemon->msgbufr, len); 270 fp = filemon->fp; 271 filemon->fp = NULL; 272 273 sx_xunlock(&filemon->lock); 274 fdrop(fp, curthread); 275 sx_xlock(&filemon->lock); 276 } 277 278 /* 279 * The devfs file is being closed. Untrace all processes. It is possible 280 * filemon_close/close(2) was not called. 281 */ 282 static void 283 filemon_dtr(void *data) 284 { 285 struct filemon *filemon = data; 286 287 if (filemon == NULL) 288 return; 289 290 sx_xlock(&filemon->lock); 291 /* 292 * Detach the filemon. It cannot be inherited after this. 293 */ 294 filemon_untrack_processes(filemon); 295 filemon_close_log(filemon); 296 filemon_drop(filemon); 297 } 298 299 /* Attach the filemon to the process. */ 300 static int 301 filemon_attach_proc(struct filemon *filemon, struct proc *p) 302 { 303 struct filemon *filemon2; 304 305 sx_assert(&filemon->lock, SA_XLOCKED); 306 PROC_LOCK_ASSERT(p, MA_OWNED); 307 KASSERT((p->p_flag & P_WEXIT) == 0, 308 ("%s: filemon %p attaching to exiting process %p", 309 __func__, filemon, p)); 310 KASSERT((p->p_flag & P_INEXEC) == 0, 311 ("%s: filemon %p attaching to execing process %p", 312 __func__, filemon, p)); 313 314 if (p->p_filemon == filemon) 315 return (0); 316 /* 317 * Don't allow truncating other process traces. It is 318 * not really intended to trace procs other than curproc 319 * anyhow. 320 */ 321 if (p->p_filemon != NULL && p != curproc) 322 return (EBUSY); 323 /* 324 * Historic behavior of filemon has been to let a child initiate 325 * tracing on itself and cease existing tracing. Bmake 326 * .META + .MAKE relies on this. It is only relevant for attaching to 327 * curproc. 328 */ 329 while (p->p_filemon != NULL) { 330 PROC_UNLOCK(p); 331 sx_xunlock(&filemon->lock); 332 while ((filemon2 = filemon_proc_get(p)) != NULL) { 333 /* It may have changed. */ 334 if (p->p_filemon == filemon2) 335 filemon_proc_drop(p); 336 filemon_drop(filemon2); 337 } 338 sx_xlock(&filemon->lock); 339 PROC_LOCK(p); 340 /* 341 * It may have been attached to, though unlikely. 342 * Try again if needed. 343 */ 344 } 345 346 KASSERT(p->p_filemon == NULL, 347 ("%s: proc %p didn't detach filemon %p", __func__, p, 348 p->p_filemon)); 349 p->p_filemon = filemon_acquire(filemon); 350 ++filemon->proccnt; 351 352 return (0); 353 } 354 355 static int 356 filemon_ioctl(struct cdev *dev, u_long cmd, caddr_t data, int flag __unused, 357 struct thread *td) 358 { 359 int error = 0; 360 struct filemon *filemon; 361 struct proc *p; 362 cap_rights_t rights; 363 364 if ((error = devfs_get_cdevpriv((void **) &filemon)) != 0) 365 return (error); 366 367 sx_xlock(&filemon->lock); 368 369 switch (cmd) { 370 /* Set the output file descriptor. */ 371 case FILEMON_SET_FD: 372 if (filemon->fp != NULL) { 373 error = EEXIST; 374 break; 375 } 376 377 error = fget_write(td, *(int *)data, 378 cap_rights_init(&rights, CAP_PWRITE), 379 &filemon->fp); 380 if (error == 0) 381 /* Write the file header. */ 382 filemon_write_header(filemon); 383 break; 384 385 /* Set the monitored process ID. */ 386 case FILEMON_SET_PID: 387 /* Invalidate any existing processes already set. */ 388 filemon_untrack_processes(filemon); 389 390 error = pget(*((pid_t *)data), 391 PGET_CANDEBUG | PGET_NOTWEXIT | PGET_NOTINEXEC, &p); 392 if (error == 0) { 393 KASSERT(p->p_filemon != filemon, 394 ("%s: proc %p didn't untrack filemon %p", 395 __func__, p, filemon)); 396 error = filemon_attach_proc(filemon, p); 397 PROC_UNLOCK(p); 398 } 399 break; 400 401 default: 402 error = EINVAL; 403 break; 404 } 405 406 sx_xunlock(&filemon->lock); 407 return (error); 408 } 409 410 static int 411 filemon_open(struct cdev *dev, int oflags __unused, int devtype __unused, 412 struct thread *td) 413 { 414 int error; 415 struct filemon *filemon; 416 417 filemon = malloc(sizeof(*filemon), M_FILEMON, 418 M_WAITOK | M_ZERO); 419 sx_init(&filemon->lock, "filemon"); 420 refcount_init(&filemon->refcnt, 1); 421 filemon->cred = crhold(td->td_ucred); 422 423 error = devfs_set_cdevpriv(filemon, filemon_dtr); 424 if (error != 0) 425 filemon_release(filemon); 426 427 return (error); 428 } 429 430 /* Called on close of last devfs file handle, before filemon_dtr(). */ 431 static int 432 filemon_close(struct cdev *dev __unused, int flag __unused, int fmt __unused, 433 struct thread *td __unused) 434 { 435 struct filemon *filemon; 436 int error; 437 438 if ((error = devfs_get_cdevpriv((void **) &filemon)) != 0) 439 return (error); 440 441 sx_xlock(&filemon->lock); 442 filemon_close_log(filemon); 443 error = filemon->error; 444 sx_xunlock(&filemon->lock); 445 /* 446 * Processes are still being traced but won't log anything 447 * now. After this call returns filemon_dtr() is called which 448 * will detach processes. 449 */ 450 451 return (error); 452 } 453 454 static void 455 filemon_load(void *dummy __unused) 456 { 457 458 /* Install the syscall wrappers. */ 459 filemon_wrapper_install(); 460 461 filemon_dev = make_dev(&filemon_cdevsw, 0, UID_ROOT, GID_WHEEL, 0666, 462 "filemon"); 463 } 464 465 static int 466 filemon_unload(void) 467 { 468 469 destroy_dev(filemon_dev); 470 filemon_wrapper_deinstall(); 471 472 return (0); 473 } 474 475 static int 476 filemon_modevent(module_t mod __unused, int type, void *data) 477 { 478 int error = 0; 479 480 switch (type) { 481 case MOD_LOAD: 482 filemon_load(data); 483 break; 484 485 case MOD_UNLOAD: 486 error = filemon_unload(); 487 break; 488 489 case MOD_QUIESCE: 490 /* 491 * The wrapper implementation is unsafe for reliable unload. 492 * Require forcing an unload. 493 */ 494 error = EBUSY; 495 break; 496 497 case MOD_SHUTDOWN: 498 break; 499 500 default: 501 error = EOPNOTSUPP; 502 break; 503 504 } 505 506 return (error); 507 } 508 509 DEV_MODULE(filemon, filemon_modevent, NULL); 510 MODULE_VERSION(filemon, 1); 511