xref: /freebsd/sys/dev/filemon/filemon.c (revision acc1a9ef8333c798c210fa94be6af4d5fe2dd794)
1 /*-
2  * Copyright (c) 2011, David E. O'Brien.
3  * Copyright (c) 2009-2011, Juniper Networks, Inc.
4  * Copyright (c) 2015, EMC Corp.
5  * All rights reserved.
6  *
7  * Redistribution and use in source and binary forms, with or without
8  * modification, are permitted provided that the following conditions
9  * are met:
10  * 1. Redistributions of source code must retain the above copyright
11  *    notice, this list of conditions and the following disclaimer.
12  * 2. Redistributions in binary form must reproduce the above copyright
13  *    notice, this list of conditions and the following disclaimer in the
14  *    documentation and/or other materials provided with the distribution.
15  *
16  * THIS SOFTWARE IS PROVIDED BY JUNIPER NETWORKS AND CONTRIBUTORS ``AS IS'' AND
17  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
18  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
19  * ARE DISCLAIMED. IN NO EVENT SHALL JUNIPER NETWORKS OR CONTRIBUTORS BE LIABLE
20  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
21  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
22  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
23  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
24  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
25  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
26  * SUCH DAMAGE.
27  */
28 
29 #include <sys/cdefs.h>
30 __FBSDID("$FreeBSD$");
31 
32 #include "opt_compat.h"
33 
34 #include <sys/param.h>
35 #include <sys/file.h>
36 #include <sys/systm.h>
37 #include <sys/buf.h>
38 #include <sys/capsicum.h>
39 #include <sys/condvar.h>
40 #include <sys/conf.h>
41 #include <sys/fcntl.h>
42 #include <sys/ioccom.h>
43 #include <sys/kernel.h>
44 #include <sys/lock.h>
45 #include <sys/malloc.h>
46 #include <sys/module.h>
47 #include <sys/poll.h>
48 #include <sys/proc.h>
49 #include <sys/queue.h>
50 #include <sys/sx.h>
51 #include <sys/syscall.h>
52 #include <sys/sysent.h>
53 #include <sys/sysproto.h>
54 #include <sys/uio.h>
55 
56 #include "filemon.h"
57 
58 #if defined(COMPAT_IA32) || defined(COMPAT_FREEBSD32) || defined(COMPAT_ARCH32)
59 #include <compat/freebsd32/freebsd32_syscall.h>
60 #include <compat/freebsd32/freebsd32_proto.h>
61 
62 extern struct sysentvec ia32_freebsd_sysvec;
63 #endif
64 
65 extern struct sysentvec elf32_freebsd_sysvec;
66 extern struct sysentvec elf64_freebsd_sysvec;
67 
68 static d_close_t	filemon_close;
69 static d_ioctl_t	filemon_ioctl;
70 static d_open_t		filemon_open;
71 
72 static struct cdevsw filemon_cdevsw = {
73 	.d_version	= D_VERSION,
74 	.d_close	= filemon_close,
75 	.d_ioctl	= filemon_ioctl,
76 	.d_open		= filemon_open,
77 	.d_name		= "filemon",
78 };
79 
80 MALLOC_DECLARE(M_FILEMON);
81 MALLOC_DEFINE(M_FILEMON, "filemon", "File access monitor");
82 
83 struct filemon {
84 	TAILQ_ENTRY(filemon) link;	/* Link into the in-use list. */
85 	struct sx	lock;		/* Lock mutex for this filemon. */
86 	struct file	*fp;		/* Output file pointer. */
87 	struct proc     *p;		/* The process being monitored. */
88 	char		fname1[MAXPATHLEN]; /* Temporary filename buffer. */
89 	char		fname2[MAXPATHLEN]; /* Temporary filename buffer. */
90 	char		msgbufr[1024];	/* Output message buffer. */
91 };
92 
93 static TAILQ_HEAD(, filemon) filemons_inuse = TAILQ_HEAD_INITIALIZER(filemons_inuse);
94 static TAILQ_HEAD(, filemon) filemons_free = TAILQ_HEAD_INITIALIZER(filemons_free);
95 static struct sx access_lock;
96 
97 static struct cdev *filemon_dev;
98 
99 #include "filemon_lock.c"
100 #include "filemon_wrapper.c"
101 
102 static void
103 filemon_comment(struct filemon *filemon)
104 {
105 	int len;
106 	struct timeval now;
107 
108 	getmicrotime(&now);
109 
110 	len = snprintf(filemon->msgbufr, sizeof(filemon->msgbufr),
111 	    "# filemon version %d\n# Target pid %d\n# Start %ju.%06ju\nV %d\n",
112 	    FILEMON_VERSION, curproc->p_pid, (uintmax_t)now.tv_sec,
113 	    (uintmax_t)now.tv_usec, FILEMON_VERSION);
114 
115 	filemon_output(filemon, filemon->msgbufr, len);
116 }
117 
118 static void
119 filemon_dtr(void *data)
120 {
121 	struct filemon *filemon = data;
122 
123 	if (filemon != NULL) {
124 		struct file *fp;
125 
126 		/* Follow same locking order as filemon_pid_check. */
127 		filemon_lock_write();
128 		sx_xlock(&filemon->lock);
129 
130 		/* Remove from the in-use list. */
131 		TAILQ_REMOVE(&filemons_inuse, filemon, link);
132 
133 		fp = filemon->fp;
134 		filemon->fp = NULL;
135 		filemon->p = NULL;
136 
137 		/* Add to the free list. */
138 		TAILQ_INSERT_TAIL(&filemons_free, filemon, link);
139 
140 		/* Give up write access. */
141 		sx_xunlock(&filemon->lock);
142 		filemon_unlock_write();
143 
144 		if (fp != NULL)
145 			fdrop(fp, curthread);
146 	}
147 }
148 
149 static int
150 filemon_ioctl(struct cdev *dev, u_long cmd, caddr_t data, int flag __unused,
151     struct thread *td)
152 {
153 	int error = 0;
154 	struct filemon *filemon;
155 	struct proc *p;
156 	cap_rights_t rights;
157 
158 	if ((error = devfs_get_cdevpriv((void **) &filemon)) != 0)
159 		return (error);
160 
161 	sx_xlock(&filemon->lock);
162 
163 	switch (cmd) {
164 	/* Set the output file descriptor. */
165 	case FILEMON_SET_FD:
166 		if (filemon->fp != NULL) {
167 			error = EEXIST;
168 			break;
169 		}
170 
171 		error = fget_write(td, *(int *)data,
172 		    cap_rights_init(&rights, CAP_PWRITE),
173 		    &filemon->fp);
174 		if (error == 0)
175 			/* Write the file header. */
176 			filemon_comment(filemon);
177 		break;
178 
179 	/* Set the monitored process ID. */
180 	case FILEMON_SET_PID:
181 		error = pget(*((pid_t *)data), PGET_CANDEBUG | PGET_NOTWEXIT,
182 		    &p);
183 		if (error == 0) {
184 			filemon->p = p;
185 			PROC_UNLOCK(p);
186 		}
187 		break;
188 
189 	default:
190 		error = EINVAL;
191 		break;
192 	}
193 
194 	sx_xunlock(&filemon->lock);
195 	return (error);
196 }
197 
198 static int
199 filemon_open(struct cdev *dev, int oflags __unused, int devtype __unused,
200     struct thread *td __unused)
201 {
202 	struct filemon *filemon;
203 
204 	/* Get exclusive write access. */
205 	filemon_lock_write();
206 
207 	if ((filemon = TAILQ_FIRST(&filemons_free)) != NULL)
208 		TAILQ_REMOVE(&filemons_free, filemon, link);
209 
210 	/* Give up write access. */
211 	filemon_unlock_write();
212 
213 	if (filemon == NULL) {
214 		filemon = malloc(sizeof(struct filemon), M_FILEMON,
215 		    M_WAITOK | M_ZERO);
216 		sx_init(&filemon->lock, "filemon");
217 	}
218 
219 	devfs_set_cdevpriv(filemon, filemon_dtr);
220 
221 	/* Get exclusive write access. */
222 	filemon_lock_write();
223 
224 	/* Add to the in-use list. */
225 	TAILQ_INSERT_TAIL(&filemons_inuse, filemon, link);
226 
227 	/* Give up write access. */
228 	filemon_unlock_write();
229 
230 	return (0);
231 }
232 
233 static int
234 filemon_close(struct cdev *dev __unused, int flag __unused, int fmt __unused,
235     struct thread *td __unused)
236 {
237 
238 	return (0);
239 }
240 
241 static void
242 filemon_load(void *dummy __unused)
243 {
244 	sx_init(&access_lock, "filemons_inuse");
245 
246 	/* Install the syscall wrappers. */
247 	filemon_wrapper_install();
248 
249 	filemon_dev = make_dev(&filemon_cdevsw, 0, UID_ROOT, GID_WHEEL, 0666,
250 	    "filemon");
251 }
252 
253 static int
254 filemon_unload(void)
255 {
256  	struct filemon *filemon;
257 	int error = 0;
258 
259 	/* Get exclusive write access. */
260 	filemon_lock_write();
261 
262 	if (TAILQ_FIRST(&filemons_inuse) != NULL)
263 		error = EBUSY;
264 	else {
265 		destroy_dev(filemon_dev);
266 
267 		/* Deinstall the syscall wrappers. */
268 		filemon_wrapper_deinstall();
269 	}
270 
271 	/* Give up write access. */
272 	filemon_unlock_write();
273 
274 	if (error == 0) {
275 		/* free() filemon structs free list. */
276 		filemon_lock_write();
277 		while ((filemon = TAILQ_FIRST(&filemons_free)) != NULL) {
278 			TAILQ_REMOVE(&filemons_free, filemon, link);
279 			sx_destroy(&filemon->lock);
280 			free(filemon, M_FILEMON);
281 		}
282 		filemon_unlock_write();
283 
284 		sx_destroy(&access_lock);
285 	}
286 
287 	return (error);
288 }
289 
290 static int
291 filemon_modevent(module_t mod __unused, int type, void *data)
292 {
293 	int error = 0;
294 
295 	switch (type) {
296 	case MOD_LOAD:
297 		filemon_load(data);
298 		break;
299 
300 	case MOD_UNLOAD:
301 		error = filemon_unload();
302 		break;
303 
304 	case MOD_QUIESCE:
305 		/*
306 		 * The wrapper implementation is unsafe for reliable unload.
307 		 * Require forcing an unload.
308 		 */
309 		error = EBUSY;
310 		break;
311 
312 	case MOD_SHUTDOWN:
313 		break;
314 
315 	default:
316 		error = EOPNOTSUPP;
317 		break;
318 
319 	}
320 
321 	return (error);
322 }
323 
324 DEV_MODULE(filemon, filemon_modevent, NULL);
325 MODULE_VERSION(filemon, 1);
326