xref: /freebsd/sys/dev/filemon/filemon_wrapper.c (revision ddd5b8e9b4d8957fce018c520657cdfa4ecffad3)
1 /*-
2  * Copyright (c) 2011, David E. O'Brien.
3  * Copyright (c) 2009-2011, Juniper Networks, Inc.
4  * All rights reserved.
5  *
6  * Redistribution and use in source and binary forms, with or without
7  * modification, are permitted provided that the following conditions
8  * are met:
9  * 1. Redistributions of source code must retain the above copyright
10  *    notice, this list of conditions and the following disclaimer.
11  * 2. Redistributions in binary form must reproduce the above copyright
12  *    notice, this list of conditions and the following disclaimer in the
13  *    documentation and/or other materials provided with the distribution.
14  *
15  * THIS SOFTWARE IS PROVIDED BY JUNIPER NETWORKS AND CONTRIBUTORS ``AS IS'' AND
16  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
17  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
18  * ARE DISCLAIMED. IN NO EVENT SHALL JUNIPER NETWORKS OR CONTRIBUTORS BE LIABLE
19  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
20  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
21  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
22  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
23  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
24  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
25  * SUCH DAMAGE.
26  */
27 
28 #include <sys/cdefs.h>
29 __FBSDID("$FreeBSD$");
30 
31 #if __FreeBSD_version > 800032
32 #define FILEMON_HAS_LINKAT
33 #endif
34 
35 #if __FreeBSD_version < 900044	/* r225617 (2011-09-16) failed to bump
36 				   __FreeBSD_version.  This really should
37 				   be based on "900045".  "900044" is r225469
38 				   (2011-09-10) so this code is broken for
39 				   9-CURRENT September 10th-16th. */
40 #define sys_chdir	chdir
41 #define sys_execve	execve
42 #define sys_fork	fork
43 #define sys_link	link
44 #define sys_open	open
45 #define sys_rename	rename
46 #define sys_stat	stat
47 #define sys_symlink	symlink
48 #define sys_unlink	unlink
49 #define sys_vfork	vfork
50 #define sys_sys_exit	sys_exit
51 #ifdef FILEMON_HAS_LINKAT
52 #define sys_linkat	linkat
53 #endif
54 #endif	/* __FreeBSD_version */
55 
56 static void
57 filemon_output(struct filemon *filemon, char *msg, size_t len)
58 {
59 	struct uio auio;
60 	struct iovec aiov;
61 
62 	if (filemon->fp == NULL)
63 		return;
64 
65 	aiov.iov_base = msg;
66 	aiov.iov_len = len;
67 	auio.uio_iov = &aiov;
68 	auio.uio_iovcnt = 1;
69 	auio.uio_resid = len;
70 	auio.uio_segflg = UIO_SYSSPACE;
71 	auio.uio_rw = UIO_WRITE;
72 	auio.uio_td = curthread;
73 	auio.uio_offset = (off_t) -1;
74 
75 	bwillwrite();
76 
77 	fo_write(filemon->fp, &auio, curthread->td_ucred, 0, curthread);
78 }
79 
80 static struct filemon *
81 filemon_pid_check(struct proc *p)
82 {
83 	struct filemon *filemon;
84 
85 	while (p->p_pptr) {
86 		TAILQ_FOREACH(filemon, &filemons_inuse, link) {
87 			if (p->p_pid == filemon->pid)
88 				return (filemon);
89 		}
90 		p = p->p_pptr;
91 	}
92 	return (NULL);
93 }
94 
95 static void
96 filemon_comment(struct filemon *filemon)
97 {
98 	int len;
99 	struct timeval now;
100 
101 	/* Load timestamp before locking.  Less accurate but less contention. */
102 	getmicrotime(&now);
103 
104 	/* Grab a read lock on the filemon inuse list. */
105 	filemon_lock_read();
106 
107 	/* Lock the found filemon structure. */
108 	filemon_filemon_lock(filemon);
109 
110 	len = snprintf(filemon->msgbufr, sizeof(filemon->msgbufr),
111 	    "# filemon version %d\n# Target pid %d\n# Start %ju.%06ju\nV %d\n",
112 	    FILEMON_VERSION, curproc->p_pid, (uintmax_t)now.tv_sec,
113 	    (uintmax_t)now.tv_usec, FILEMON_VERSION);
114 
115 	filemon_output(filemon, filemon->msgbufr, len);
116 
117 	/* Unlock the found filemon structure. */
118 	filemon_filemon_unlock(filemon);
119 
120 	/* Release the read lock. */
121 	filemon_unlock_read();
122 }
123 
124 static int
125 filemon_wrapper_chdir(struct thread *td, struct chdir_args *uap)
126 {
127 	int ret;
128 	size_t done;
129 	size_t len;
130 	struct filemon *filemon;
131 
132 	if ((ret = sys_chdir(td, uap)) == 0) {
133 		/* Grab a read lock on the filemon inuse list. */
134 		filemon_lock_read();
135 
136 		if ((filemon = filemon_pid_check(curproc)) != NULL) {
137 			/* Lock the found filemon structure. */
138 			filemon_filemon_lock(filemon);
139 
140 			copyinstr(uap->path, filemon->fname1,
141 			    sizeof(filemon->fname1), &done);
142 
143 			len = snprintf(filemon->msgbufr,
144 			    sizeof(filemon->msgbufr), "C %d %s\n",
145 			    curproc->p_pid, filemon->fname1);
146 
147 			filemon_output(filemon, filemon->msgbufr, len);
148 
149 			/* Unlock the found filemon structure. */
150 			filemon_filemon_unlock(filemon);
151 		}
152 
153 		/* Release the read lock. */
154 		filemon_unlock_read();
155 	}
156 
157 	return (ret);
158 }
159 
160 static int
161 filemon_wrapper_execve(struct thread *td, struct execve_args *uap)
162 {
163 	char fname[MAXPATHLEN];
164 	int ret;
165 	size_t done;
166 	size_t len;
167 	struct filemon *filemon;
168 
169 	copyinstr(uap->fname, fname, sizeof(fname), &done);
170 
171 	if ((ret = sys_execve(td, uap)) == 0) {
172 		/* Grab a read lock on the filemon inuse list. */
173 		filemon_lock_read();
174 
175 		if ((filemon = filemon_pid_check(curproc)) != NULL) {
176 			/* Lock the found filemon structure. */
177 			filemon_filemon_lock(filemon);
178 
179 			len = snprintf(filemon->msgbufr,
180 			    sizeof(filemon->msgbufr), "E %d %s\n",
181 			    curproc->p_pid, fname);
182 
183 			filemon_output(filemon, filemon->msgbufr, len);
184 
185 			/* Unlock the found filemon structure. */
186 			filemon_filemon_unlock(filemon);
187 		}
188 
189 		/* Release the read lock. */
190 		filemon_unlock_read();
191 	}
192 
193 	return (ret);
194 }
195 
196 #if defined(COMPAT_IA32) || defined(COMPAT_FREEBSD32) || defined(COMPAT_ARCH32)
197 static int
198 filemon_wrapper_freebsd32_execve(struct thread *td,
199     struct freebsd32_execve_args *uap)
200 {
201 	char fname[MAXPATHLEN];
202 	int ret;
203 	size_t done;
204 	size_t len;
205 	struct filemon *filemon;
206 
207 	copyinstr(uap->fname, fname, sizeof(fname), &done);
208 
209 	if ((ret = freebsd32_execve(td, uap)) == 0) {
210 		/* Grab a read lock on the filemon inuse list. */
211 		filemon_lock_read();
212 
213 		if ((filemon = filemon_pid_check(curproc)) != NULL) {
214 			/* Lock the found filemon structure. */
215 			filemon_filemon_lock(filemon);
216 
217 			len = snprintf(filemon->msgbufr,
218 			    sizeof(filemon->msgbufr), "E %d %s\n",
219 			    curproc->p_pid, fname);
220 
221 			filemon_output(filemon, filemon->msgbufr, len);
222 
223 			/* Unlock the found filemon structure. */
224 			filemon_filemon_unlock(filemon);
225 		}
226 
227 		/* Release the read lock. */
228 		filemon_unlock_read();
229 	}
230 
231 	return (ret);
232 }
233 #endif
234 
235 static int
236 filemon_wrapper_fork(struct thread *td, struct fork_args *uap)
237 {
238 	int ret;
239 	size_t len;
240 	struct filemon *filemon;
241 
242 	if ((ret = sys_fork(td, uap)) == 0) {
243 		/* Grab a read lock on the filemon inuse list. */
244 		filemon_lock_read();
245 
246 		if ((filemon = filemon_pid_check(curproc)) != NULL) {
247 			/* Lock the found filemon structure. */
248 			filemon_filemon_lock(filemon);
249 
250 			len = snprintf(filemon->msgbufr,
251 			    sizeof(filemon->msgbufr), "F %d %ld\n",
252 			    curproc->p_pid, (long)curthread->td_retval[0]);
253 
254 			filemon_output(filemon, filemon->msgbufr, len);
255 
256 			/* Unlock the found filemon structure. */
257 			filemon_filemon_unlock(filemon);
258 		}
259 
260 		/* Release the read lock. */
261 		filemon_unlock_read();
262 	}
263 
264 	return (ret);
265 }
266 
267 static int
268 filemon_wrapper_open(struct thread *td, struct open_args *uap)
269 {
270 	int ret;
271 	size_t done;
272 	size_t len;
273 	struct filemon *filemon;
274 
275 	if ((ret = sys_open(td, uap)) == 0) {
276 		/* Grab a read lock on the filemon inuse list. */
277 		filemon_lock_read();
278 
279 		if ((filemon = filemon_pid_check(curproc)) != NULL) {
280 			/* Lock the found filemon structure. */
281 			filemon_filemon_lock(filemon);
282 
283 			copyinstr(uap->path, filemon->fname1,
284 			    sizeof(filemon->fname1), &done);
285 
286 			if (uap->flags & O_RDWR) {
287 				/*
288 				 * We'll get the W record below, but need
289 				 * to also output an R to distingish from
290 				 * O_WRONLY.
291 				 */
292 				len = snprintf(filemon->msgbufr,
293 				    sizeof(filemon->msgbufr), "R %d %s\n",
294 				    curproc->p_pid, filemon->fname1);
295 				filemon_output(filemon, filemon->msgbufr, len);
296 			}
297 
298 
299 			len = snprintf(filemon->msgbufr,
300 			    sizeof(filemon->msgbufr), "%c %d %s\n",
301 			    (uap->flags & O_ACCMODE) ? 'W':'R',
302 			    curproc->p_pid, filemon->fname1);
303 			filemon_output(filemon, filemon->msgbufr, len);
304 
305 			/* Unlock the found filemon structure. */
306 			filemon_filemon_unlock(filemon);
307 		}
308 
309 		/* Release the read lock. */
310 		filemon_unlock_read();
311 	}
312 
313 	return (ret);
314 }
315 
316 static int
317 filemon_wrapper_rename(struct thread *td, struct rename_args *uap)
318 {
319 	int ret;
320 	size_t done;
321 	size_t len;
322 	struct filemon *filemon;
323 
324 	if ((ret = sys_rename(td, uap)) == 0) {
325 		/* Grab a read lock on the filemon inuse list. */
326 		filemon_lock_read();
327 
328 		if ((filemon = filemon_pid_check(curproc)) != NULL) {
329 			/* Lock the found filemon structure. */
330 			filemon_filemon_lock(filemon);
331 
332 			copyinstr(uap->from, filemon->fname1,
333 			    sizeof(filemon->fname1), &done);
334 			copyinstr(uap->to, filemon->fname2,
335 			    sizeof(filemon->fname2), &done);
336 
337 			len = snprintf(filemon->msgbufr,
338 			    sizeof(filemon->msgbufr), "M %d '%s' '%s'\n",
339 			    curproc->p_pid, filemon->fname1, filemon->fname2);
340 
341 			filemon_output(filemon, filemon->msgbufr, len);
342 
343 			/* Unlock the found filemon structure. */
344 			filemon_filemon_unlock(filemon);
345 		}
346 
347 		/* Release the read lock. */
348 		filemon_unlock_read();
349 	}
350 
351 	return (ret);
352 }
353 
354 static int
355 filemon_wrapper_link(struct thread *td, struct link_args *uap)
356 {
357 	int ret;
358 	size_t done;
359 	size_t len;
360 	struct filemon *filemon;
361 
362 	if ((ret = sys_link(td, uap)) == 0) {
363 		/* Grab a read lock on the filemon inuse list. */
364 		filemon_lock_read();
365 
366 		if ((filemon = filemon_pid_check(curproc)) != NULL) {
367 			/* Lock the found filemon structure. */
368 			filemon_filemon_lock(filemon);
369 
370 			copyinstr(uap->path, filemon->fname1,
371 			    sizeof(filemon->fname1), &done);
372 			copyinstr(uap->link, filemon->fname2,
373 			    sizeof(filemon->fname2), &done);
374 
375 			len = snprintf(filemon->msgbufr,
376 			    sizeof(filemon->msgbufr), "L %d '%s' '%s'\n",
377 			    curproc->p_pid, filemon->fname1, filemon->fname2);
378 
379 			filemon_output(filemon, filemon->msgbufr, len);
380 
381 			/* Unlock the found filemon structure. */
382 			filemon_filemon_unlock(filemon);
383 		}
384 
385 		/* Release the read lock. */
386 		filemon_unlock_read();
387 	}
388 
389 	return (ret);
390 }
391 
392 static int
393 filemon_wrapper_symlink(struct thread *td, struct symlink_args *uap)
394 {
395 	int ret;
396 	size_t done;
397 	size_t len;
398 	struct filemon *filemon;
399 
400 	if ((ret = sys_symlink(td, uap)) == 0) {
401 		/* Grab a read lock on the filemon inuse list. */
402 		filemon_lock_read();
403 
404 		if ((filemon = filemon_pid_check(curproc)) != NULL) {
405 			/* Lock the found filemon structure. */
406 			filemon_filemon_lock(filemon);
407 
408 			copyinstr(uap->path, filemon->fname1,
409 			    sizeof(filemon->fname1), &done);
410 			copyinstr(uap->link, filemon->fname2,
411 			    sizeof(filemon->fname2), &done);
412 
413 			len = snprintf(filemon->msgbufr,
414 			    sizeof(filemon->msgbufr), "L %d '%s' '%s'\n",
415 			    curproc->p_pid, filemon->fname1, filemon->fname2);
416 
417 			filemon_output(filemon, filemon->msgbufr, len);
418 
419 			/* Unlock the found filemon structure. */
420 			filemon_filemon_unlock(filemon);
421 		}
422 
423 		/* Release the read lock. */
424 		filemon_unlock_read();
425 	}
426 
427 	return (ret);
428 }
429 
430 #ifdef FILEMON_HAS_LINKAT
431 static int
432 filemon_wrapper_linkat(struct thread *td, struct linkat_args *uap)
433 {
434 	int ret;
435 	size_t done;
436 	size_t len;
437 	struct filemon *filemon;
438 
439 	if ((ret = sys_linkat(td, uap)) == 0) {
440 		/* Grab a read lock on the filemon inuse list. */
441 		filemon_lock_read();
442 
443 		if ((filemon = filemon_pid_check(curproc)) != NULL) {
444 			/* Lock the found filemon structure. */
445 			filemon_filemon_lock(filemon);
446 
447 			copyinstr(uap->path1, filemon->fname1,
448 			    sizeof(filemon->fname1), &done);
449 			copyinstr(uap->path2, filemon->fname2,
450 			    sizeof(filemon->fname2), &done);
451 
452 			len = snprintf(filemon->msgbufr,
453 			    sizeof(filemon->msgbufr), "L %d '%s' '%s'\n",
454 			    curproc->p_pid, filemon->fname1, filemon->fname2);
455 
456 			filemon_output(filemon, filemon->msgbufr, len);
457 
458 			/* Unlock the found filemon structure. */
459 			filemon_filemon_unlock(filemon);
460 		}
461 
462 		/* Release the read lock. */
463 		filemon_unlock_read();
464 	}
465 
466 	return (ret);
467 }
468 #endif
469 
470 static int
471 filemon_wrapper_stat(struct thread *td, struct stat_args *uap)
472 {
473 	int ret;
474 	size_t done;
475 	size_t len;
476 	struct filemon *filemon;
477 
478 	if ((ret = sys_stat(td, uap)) == 0) {
479 		/* Grab a read lock on the filemon inuse list. */
480 		filemon_lock_read();
481 
482 		if ((filemon = filemon_pid_check(curproc)) != NULL) {
483 			/* Lock the found filemon structure. */
484 			filemon_filemon_lock(filemon);
485 
486 			copyinstr(uap->path, filemon->fname1,
487 			    sizeof(filemon->fname1), &done);
488 
489 			len = snprintf(filemon->msgbufr,
490 			    sizeof(filemon->msgbufr), "S %d %s\n",
491 			    curproc->p_pid, filemon->fname1);
492 
493 			filemon_output(filemon, filemon->msgbufr, len);
494 
495 			/* Unlock the found filemon structure. */
496 			filemon_filemon_unlock(filemon);
497 		}
498 
499 		/* Release the read lock. */
500 		filemon_unlock_read();
501 	}
502 
503 	return (ret);
504 }
505 
506 #if defined(COMPAT_IA32) || defined(COMPAT_FREEBSD32) || defined(COMPAT_ARCH32)
507 static int
508 filemon_wrapper_freebsd32_stat(struct thread *td,
509     struct freebsd32_stat_args *uap)
510 {
511 	int ret;
512 	size_t done;
513 	size_t len;
514 	struct filemon *filemon;
515 
516 	if ((ret = freebsd32_stat(td, uap)) == 0) {
517 		/* Grab a read lock on the filemon inuse list. */
518 		filemon_lock_read();
519 
520 		if ((filemon = filemon_pid_check(curproc)) != NULL) {
521 			/* Lock the found filemon structure. */
522 			filemon_filemon_lock(filemon);
523 
524 			copyinstr(uap->path, filemon->fname1,
525 			    sizeof(filemon->fname1), &done);
526 
527 			len = snprintf(filemon->msgbufr,
528 			    sizeof(filemon->msgbufr), "S %d %s\n",
529 			    curproc->p_pid, filemon->fname1);
530 
531 			filemon_output(filemon, filemon->msgbufr, len);
532 
533 			/* Unlock the found filemon structure. */
534 			filemon_filemon_unlock(filemon);
535 		}
536 
537 		/* Release the read lock. */
538 		filemon_unlock_read();
539 	}
540 
541 	return (ret);
542 }
543 #endif
544 
545 static void
546 filemon_wrapper_sys_exit(struct thread *td, struct sys_exit_args *uap)
547 {
548 	size_t len;
549 	struct filemon *filemon;
550 	struct timeval now;
551 
552 	/* Get timestamp before locking. */
553 	getmicrotime(&now);
554 
555 	/* Grab a read lock on the filemon inuse list. */
556 	filemon_lock_read();
557 
558 	if ((filemon = filemon_pid_check(curproc)) != NULL) {
559 		/* Lock the found filemon structure. */
560 		filemon_filemon_lock(filemon);
561 
562 		len = snprintf(filemon->msgbufr, sizeof(filemon->msgbufr),
563 		    "X %d %d\n", curproc->p_pid, uap->rval);
564 
565 		filemon_output(filemon, filemon->msgbufr, len);
566 
567 		/* Check if the monitored process is about to exit. */
568 		if (filemon->pid == curproc->p_pid) {
569 			len = snprintf(filemon->msgbufr,
570 			    sizeof(filemon->msgbufr),
571 			    "# Stop %ju.%06ju\n# Bye bye\n",
572 			    (uintmax_t)now.tv_sec, (uintmax_t)now.tv_usec);
573 
574 			filemon_output(filemon, filemon->msgbufr, len);
575 		}
576 
577 		/* Unlock the found filemon structure. */
578 		filemon_filemon_unlock(filemon);
579 	}
580 
581 	/* Release the read lock. */
582 	filemon_unlock_read();
583 
584 	sys_sys_exit(td, uap);
585 }
586 
587 static int
588 filemon_wrapper_unlink(struct thread *td, struct unlink_args *uap)
589 {
590 	int ret;
591 	size_t done;
592 	size_t len;
593 	struct filemon *filemon;
594 
595 	if ((ret = sys_unlink(td, uap)) == 0) {
596 		/* Grab a read lock on the filemon inuse list. */
597 		filemon_lock_read();
598 
599 		if ((filemon = filemon_pid_check(curproc)) != NULL) {
600 			/* Lock the found filemon structure. */
601 			filemon_filemon_lock(filemon);
602 
603 			copyinstr(uap->path, filemon->fname1,
604 			    sizeof(filemon->fname1), &done);
605 
606 			len = snprintf(filemon->msgbufr,
607 			    sizeof(filemon->msgbufr), "D %d %s\n",
608 			    curproc->p_pid, filemon->fname1);
609 
610 			filemon_output(filemon, filemon->msgbufr, len);
611 
612 			/* Unlock the found filemon structure. */
613 			filemon_filemon_unlock(filemon);
614 		}
615 
616 		/* Release the read lock. */
617 		filemon_unlock_read();
618 	}
619 
620 	return (ret);
621 }
622 
623 static int
624 filemon_wrapper_vfork(struct thread *td, struct vfork_args *uap)
625 {
626 	int ret;
627 	size_t len;
628 	struct filemon *filemon;
629 
630 	if ((ret = sys_vfork(td, uap)) == 0) {
631 		/* Grab a read lock on the filemon inuse list. */
632 		filemon_lock_read();
633 
634 		if ((filemon = filemon_pid_check(curproc)) != NULL) {
635 			/* Lock the found filemon structure. */
636 			filemon_filemon_lock(filemon);
637 
638 			len = snprintf(filemon->msgbufr,
639 			    sizeof(filemon->msgbufr), "F %d %ld\n",
640 			    curproc->p_pid, (long)curthread->td_retval[0]);
641 
642 			filemon_output(filemon, filemon->msgbufr, len);
643 
644 			/* Unlock the found filemon structure. */
645 			filemon_filemon_unlock(filemon);
646 		}
647 
648 		/* Release the read lock. */
649 		filemon_unlock_read();
650 	}
651 
652 	return (ret);
653 }
654 
655 static void
656 filemon_wrapper_install(void)
657 {
658 #if defined(__LP64__)
659 	struct sysent *sv_table = elf64_freebsd_sysvec.sv_table;
660 #else
661 	struct sysent *sv_table = elf32_freebsd_sysvec.sv_table;
662 #endif
663 
664 	sv_table[SYS_chdir].sy_call = (sy_call_t *) filemon_wrapper_chdir;
665 	sv_table[SYS_exit].sy_call = (sy_call_t *) filemon_wrapper_sys_exit;
666 	sv_table[SYS_execve].sy_call = (sy_call_t *) filemon_wrapper_execve;
667 	sv_table[SYS_fork].sy_call = (sy_call_t *) filemon_wrapper_fork;
668 	sv_table[SYS_open].sy_call = (sy_call_t *) filemon_wrapper_open;
669 	sv_table[SYS_rename].sy_call = (sy_call_t *) filemon_wrapper_rename;
670 	sv_table[SYS_stat].sy_call = (sy_call_t *) filemon_wrapper_stat;
671 	sv_table[SYS_unlink].sy_call = (sy_call_t *) filemon_wrapper_unlink;
672 	sv_table[SYS_vfork].sy_call = (sy_call_t *) filemon_wrapper_vfork;
673 	sv_table[SYS_link].sy_call = (sy_call_t *) filemon_wrapper_link;
674 	sv_table[SYS_symlink].sy_call = (sy_call_t *) filemon_wrapper_symlink;
675 #ifdef FILEMON_HAS_LINKAT
676 	sv_table[SYS_linkat].sy_call = (sy_call_t *) filemon_wrapper_linkat;
677 #endif
678 
679 #if defined(COMPAT_IA32) || defined(COMPAT_FREEBSD32) || defined(COMPAT_ARCH32)
680 	sv_table = ia32_freebsd_sysvec.sv_table;
681 
682 	sv_table[FREEBSD32_SYS_chdir].sy_call = (sy_call_t *) filemon_wrapper_chdir;
683 	sv_table[FREEBSD32_SYS_exit].sy_call = (sy_call_t *) filemon_wrapper_sys_exit;
684 	sv_table[FREEBSD32_SYS_freebsd32_execve].sy_call = (sy_call_t *) filemon_wrapper_freebsd32_execve;
685 	sv_table[FREEBSD32_SYS_fork].sy_call = (sy_call_t *) filemon_wrapper_fork;
686 	sv_table[FREEBSD32_SYS_open].sy_call = (sy_call_t *) filemon_wrapper_open;
687 	sv_table[FREEBSD32_SYS_rename].sy_call = (sy_call_t *) filemon_wrapper_rename;
688 	sv_table[FREEBSD32_SYS_freebsd32_stat].sy_call = (sy_call_t *) filemon_wrapper_freebsd32_stat;
689 	sv_table[FREEBSD32_SYS_unlink].sy_call = (sy_call_t *) filemon_wrapper_unlink;
690 	sv_table[FREEBSD32_SYS_vfork].sy_call = (sy_call_t *) filemon_wrapper_vfork;
691 	sv_table[FREEBSD32_SYS_link].sy_call = (sy_call_t *) filemon_wrapper_link;
692 	sv_table[FREEBSD32_SYS_symlink].sy_call = (sy_call_t *) filemon_wrapper_symlink;
693 #ifdef FILEMON_HAS_LINKAT
694 	sv_table[FREEBSD32_SYS_linkat].sy_call = (sy_call_t *) filemon_wrapper_linkat;
695 #endif
696 #endif	/* COMPAT_ARCH32 */
697 }
698 
699 static void
700 filemon_wrapper_deinstall(void)
701 {
702 #if defined(__LP64__)
703 	struct sysent *sv_table = elf64_freebsd_sysvec.sv_table;
704 #else
705 	struct sysent *sv_table = elf32_freebsd_sysvec.sv_table;
706 #endif
707 
708 	sv_table[SYS_chdir].sy_call = (sy_call_t *)sys_chdir;
709 	sv_table[SYS_exit].sy_call = (sy_call_t *)sys_sys_exit;
710 	sv_table[SYS_execve].sy_call = (sy_call_t *)sys_execve;
711 	sv_table[SYS_fork].sy_call = (sy_call_t *)sys_fork;
712 	sv_table[SYS_open].sy_call = (sy_call_t *)sys_open;
713 	sv_table[SYS_rename].sy_call = (sy_call_t *)sys_rename;
714 	sv_table[SYS_stat].sy_call = (sy_call_t *)sys_stat;
715 	sv_table[SYS_unlink].sy_call = (sy_call_t *)sys_unlink;
716 	sv_table[SYS_vfork].sy_call = (sy_call_t *)sys_vfork;
717 	sv_table[SYS_link].sy_call = (sy_call_t *)sys_link;
718 	sv_table[SYS_symlink].sy_call = (sy_call_t *)sys_symlink;
719 #ifdef FILEMON_HAS_LINKAT
720 	sv_table[SYS_linkat].sy_call = (sy_call_t *)sys_linkat;
721 #endif
722 
723 #if defined(COMPAT_IA32) || defined(COMPAT_FREEBSD32) || defined(COMPAT_ARCH32)
724 	sv_table = ia32_freebsd_sysvec.sv_table;
725 
726 	sv_table[FREEBSD32_SYS_chdir].sy_call = (sy_call_t *)sys_chdir;
727 	sv_table[FREEBSD32_SYS_exit].sy_call = (sy_call_t *)sys_sys_exit;
728 	sv_table[FREEBSD32_SYS_freebsd32_execve].sy_call = (sy_call_t *)freebsd32_execve;
729 	sv_table[FREEBSD32_SYS_fork].sy_call = (sy_call_t *)sys_fork;
730 	sv_table[FREEBSD32_SYS_open].sy_call = (sy_call_t *)sys_open;
731 	sv_table[FREEBSD32_SYS_rename].sy_call = (sy_call_t *)sys_rename;
732 	sv_table[FREEBSD32_SYS_freebsd32_stat].sy_call = (sy_call_t *)freebsd32_stat;
733 	sv_table[FREEBSD32_SYS_unlink].sy_call = (sy_call_t *)sys_unlink;
734 	sv_table[FREEBSD32_SYS_vfork].sy_call = (sy_call_t *)sys_vfork;
735 	sv_table[FREEBSD32_SYS_link].sy_call = (sy_call_t *)sys_link;
736 	sv_table[FREEBSD32_SYS_symlink].sy_call = (sy_call_t *)sys_symlink;
737 #ifdef FILEMON_HAS_LINKAT
738 	sv_table[FREEBSD32_SYS_linkat].sy_call = (sy_call_t *)sys_linkat;
739 #endif
740 #endif	/* COMPAT_ARCH32 */
741 }
742