1 /*- 2 * Copyright (c) 2011, David E. O'Brien. 3 * Copyright (c) 2009-2011, Juniper Networks, Inc. 4 * Copyright (c) 2015, EMC Corp. 5 * All rights reserved. 6 * 7 * Redistribution and use in source and binary forms, with or without 8 * modification, are permitted provided that the following conditions 9 * are met: 10 * 1. Redistributions of source code must retain the above copyright 11 * notice, this list of conditions and the following disclaimer. 12 * 2. Redistributions in binary form must reproduce the above copyright 13 * notice, this list of conditions and the following disclaimer in the 14 * documentation and/or other materials provided with the distribution. 15 * 16 * THIS SOFTWARE IS PROVIDED BY JUNIPER NETWORKS AND CONTRIBUTORS ``AS IS'' AND 17 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 18 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 19 * ARE DISCLAIMED. IN NO EVENT SHALL JUNIPER NETWORKS OR CONTRIBUTORS BE LIABLE 20 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 21 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 22 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 23 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 24 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 25 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 26 * SUCH DAMAGE. 27 */ 28 29 #include <sys/cdefs.h> 30 __FBSDID("$FreeBSD$"); 31 32 #include "opt_compat.h" 33 34 #include <sys/param.h> 35 #include <sys/file.h> 36 #include <sys/systm.h> 37 #include <sys/buf.h> 38 #include <sys/capsicum.h> 39 #include <sys/condvar.h> 40 #include <sys/conf.h> 41 #include <sys/fcntl.h> 42 #include <sys/ioccom.h> 43 #include <sys/kernel.h> 44 #include <sys/lock.h> 45 #include <sys/malloc.h> 46 #include <sys/module.h> 47 #include <sys/poll.h> 48 #include <sys/proc.h> 49 #include <sys/queue.h> 50 #include <sys/sx.h> 51 #include <sys/syscall.h> 52 #include <sys/sysent.h> 53 #include <sys/sysproto.h> 54 #include <sys/uio.h> 55 56 #include "filemon.h" 57 58 #if defined(COMPAT_IA32) || defined(COMPAT_FREEBSD32) || defined(COMPAT_ARCH32) 59 #include <compat/freebsd32/freebsd32_syscall.h> 60 #include <compat/freebsd32/freebsd32_proto.h> 61 62 extern struct sysentvec ia32_freebsd_sysvec; 63 #endif 64 65 extern struct sysentvec elf32_freebsd_sysvec; 66 extern struct sysentvec elf64_freebsd_sysvec; 67 68 static d_close_t filemon_close; 69 static d_ioctl_t filemon_ioctl; 70 static d_open_t filemon_open; 71 72 static struct cdevsw filemon_cdevsw = { 73 .d_version = D_VERSION, 74 .d_close = filemon_close, 75 .d_ioctl = filemon_ioctl, 76 .d_open = filemon_open, 77 .d_name = "filemon", 78 }; 79 80 MALLOC_DECLARE(M_FILEMON); 81 MALLOC_DEFINE(M_FILEMON, "filemon", "File access monitor"); 82 83 struct filemon { 84 TAILQ_ENTRY(filemon) link; /* Link into the in-use list. */ 85 struct sx lock; /* Lock mutex for this filemon. */ 86 struct file *fp; /* Output file pointer. */ 87 struct proc *p; /* The process being monitored. */ 88 char fname1[MAXPATHLEN]; /* Temporary filename buffer. */ 89 char fname2[MAXPATHLEN]; /* Temporary filename buffer. */ 90 char msgbufr[1024]; /* Output message buffer. */ 91 }; 92 93 static TAILQ_HEAD(, filemon) filemons_inuse = TAILQ_HEAD_INITIALIZER(filemons_inuse); 94 static TAILQ_HEAD(, filemon) filemons_free = TAILQ_HEAD_INITIALIZER(filemons_free); 95 static struct sx access_lock; 96 97 static struct cdev *filemon_dev; 98 99 #include "filemon_lock.c" 100 #include "filemon_wrapper.c" 101 102 static void 103 filemon_comment(struct filemon *filemon) 104 { 105 int len; 106 struct timeval now; 107 108 getmicrotime(&now); 109 110 len = snprintf(filemon->msgbufr, sizeof(filemon->msgbufr), 111 "# filemon version %d\n# Target pid %d\n# Start %ju.%06ju\nV %d\n", 112 FILEMON_VERSION, curproc->p_pid, (uintmax_t)now.tv_sec, 113 (uintmax_t)now.tv_usec, FILEMON_VERSION); 114 115 filemon_output(filemon, filemon->msgbufr, len); 116 } 117 118 static void 119 filemon_dtr(void *data) 120 { 121 struct filemon *filemon = data; 122 123 if (filemon != NULL) { 124 struct file *fp; 125 126 /* Follow same locking order as filemon_pid_check. */ 127 filemon_lock_write(); 128 sx_xlock(&filemon->lock); 129 130 /* Remove from the in-use list. */ 131 TAILQ_REMOVE(&filemons_inuse, filemon, link); 132 133 fp = filemon->fp; 134 filemon->fp = NULL; 135 filemon->p = NULL; 136 137 /* Add to the free list. */ 138 TAILQ_INSERT_TAIL(&filemons_free, filemon, link); 139 140 /* Give up write access. */ 141 sx_xunlock(&filemon->lock); 142 filemon_unlock_write(); 143 144 if (fp != NULL) 145 fdrop(fp, curthread); 146 } 147 } 148 149 static int 150 filemon_ioctl(struct cdev *dev, u_long cmd, caddr_t data, int flag __unused, 151 struct thread *td) 152 { 153 int error = 0; 154 struct filemon *filemon; 155 struct proc *p; 156 cap_rights_t rights; 157 158 if ((error = devfs_get_cdevpriv((void **) &filemon)) != 0) 159 return (error); 160 161 sx_xlock(&filemon->lock); 162 163 switch (cmd) { 164 /* Set the output file descriptor. */ 165 case FILEMON_SET_FD: 166 if (filemon->fp != NULL) { 167 error = EEXIST; 168 break; 169 } 170 171 error = fget_write(td, *(int *)data, 172 cap_rights_init(&rights, CAP_PWRITE), 173 &filemon->fp); 174 if (error == 0) 175 /* Write the file header. */ 176 filemon_comment(filemon); 177 break; 178 179 /* Set the monitored process ID. */ 180 case FILEMON_SET_PID: 181 error = pget(*((pid_t *)data), PGET_CANDEBUG | PGET_NOTWEXIT, 182 &p); 183 if (error == 0) { 184 filemon->p = p; 185 PROC_UNLOCK(p); 186 } 187 break; 188 189 default: 190 error = EINVAL; 191 break; 192 } 193 194 sx_xunlock(&filemon->lock); 195 return (error); 196 } 197 198 static int 199 filemon_open(struct cdev *dev, int oflags __unused, int devtype __unused, 200 struct thread *td __unused) 201 { 202 struct filemon *filemon; 203 204 /* Get exclusive write access. */ 205 filemon_lock_write(); 206 207 if ((filemon = TAILQ_FIRST(&filemons_free)) != NULL) 208 TAILQ_REMOVE(&filemons_free, filemon, link); 209 210 /* Give up write access. */ 211 filemon_unlock_write(); 212 213 if (filemon == NULL) { 214 filemon = malloc(sizeof(struct filemon), M_FILEMON, 215 M_WAITOK | M_ZERO); 216 sx_init(&filemon->lock, "filemon"); 217 } 218 219 devfs_set_cdevpriv(filemon, filemon_dtr); 220 221 /* Get exclusive write access. */ 222 filemon_lock_write(); 223 224 /* Add to the in-use list. */ 225 TAILQ_INSERT_TAIL(&filemons_inuse, filemon, link); 226 227 /* Give up write access. */ 228 filemon_unlock_write(); 229 230 return (0); 231 } 232 233 static int 234 filemon_close(struct cdev *dev __unused, int flag __unused, int fmt __unused, 235 struct thread *td __unused) 236 { 237 238 return (0); 239 } 240 241 static void 242 filemon_load(void *dummy __unused) 243 { 244 sx_init(&access_lock, "filemons_inuse"); 245 246 /* Install the syscall wrappers. */ 247 filemon_wrapper_install(); 248 249 filemon_dev = make_dev(&filemon_cdevsw, 0, UID_ROOT, GID_WHEEL, 0666, 250 "filemon"); 251 } 252 253 static int 254 filemon_unload(void) 255 { 256 struct filemon *filemon; 257 int error = 0; 258 259 /* Get exclusive write access. */ 260 filemon_lock_write(); 261 262 if (TAILQ_FIRST(&filemons_inuse) != NULL) 263 error = EBUSY; 264 else { 265 destroy_dev(filemon_dev); 266 267 /* Deinstall the syscall wrappers. */ 268 filemon_wrapper_deinstall(); 269 } 270 271 /* Give up write access. */ 272 filemon_unlock_write(); 273 274 if (error == 0) { 275 /* free() filemon structs free list. */ 276 filemon_lock_write(); 277 while ((filemon = TAILQ_FIRST(&filemons_free)) != NULL) { 278 TAILQ_REMOVE(&filemons_free, filemon, link); 279 sx_destroy(&filemon->lock); 280 free(filemon, M_FILEMON); 281 } 282 filemon_unlock_write(); 283 284 sx_destroy(&access_lock); 285 } 286 287 return (error); 288 } 289 290 static int 291 filemon_modevent(module_t mod __unused, int type, void *data) 292 { 293 int error = 0; 294 295 switch (type) { 296 case MOD_LOAD: 297 filemon_load(data); 298 break; 299 300 case MOD_UNLOAD: 301 error = filemon_unload(); 302 break; 303 304 case MOD_QUIESCE: 305 /* 306 * The wrapper implementation is unsafe for reliable unload. 307 * Require forcing an unload. 308 */ 309 error = EBUSY; 310 break; 311 312 case MOD_SHUTDOWN: 313 break; 314 315 default: 316 error = EOPNOTSUPP; 317 break; 318 319 } 320 321 return (error); 322 } 323 324 DEV_MODULE(filemon, filemon_modevent, NULL); 325 MODULE_VERSION(filemon, 1); 326