1 /* 2 * Copyright (c) 1989, 1993 3 * The Regents of the University of California. All rights reserved. 4 * 5 * Redistribution and use in source and binary forms, with or without 6 * modification, are permitted provided that the following conditions 7 * are met: 8 * 1. Redistributions of source code must retain the above copyright 9 * notice, this list of conditions and the following disclaimer. 10 * 2. Redistributions in binary form must reproduce the above copyright 11 * notice, this list of conditions and the following disclaimer in the 12 * documentation and/or other materials provided with the distribution. 13 * 3. All advertising materials mentioning features or use of this software 14 * must display the following acknowledgement: 15 * This product includes software developed by the University of 16 * California, Berkeley and its contributors. 17 * 4. Neither the name of the University nor the names of its contributors 18 * may be used to endorse or promote products derived from this software 19 * without specific prior written permission. 20 * 21 * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND 22 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 23 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 24 * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE 25 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 26 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 27 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 28 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 29 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 30 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 31 * SUCH DAMAGE. 32 * 33 * @(#)kern_ktrace.c 8.2 (Berkeley) 9/23/93 34 * $Id: kern_ktrace.c,v 1.26 1999/04/28 11:36:55 phk Exp $ 35 */ 36 37 #include "opt_ktrace.h" 38 39 #include <sys/param.h> 40 #include <sys/systm.h> 41 #include <sys/sysproto.h> 42 #include <sys/kernel.h> 43 #include <sys/proc.h> 44 #include <sys/fcntl.h> 45 #include <sys/lock.h> 46 #include <sys/namei.h> 47 #include <sys/vnode.h> 48 #include <sys/ktrace.h> 49 #include <sys/malloc.h> 50 #include <sys/syslog.h> 51 52 #include <stddef.h> 53 54 static MALLOC_DEFINE(M_KTRACE, "KTRACE", "KTRACE"); 55 56 #ifdef KTRACE 57 static struct ktr_header *ktrgetheader __P((int type)); 58 static void ktrwrite __P((struct vnode *, struct ktr_header *)); 59 static int ktrcanset __P((struct proc *,struct proc *)); 60 static int ktrsetchildren __P((struct proc *,struct proc *,int,int,struct vnode *)); 61 static int ktrops __P((struct proc *,struct proc *,int,int,struct vnode *)); 62 63 64 static struct ktr_header * 65 ktrgetheader(type) 66 int type; 67 { 68 register struct ktr_header *kth; 69 struct proc *p = curproc; /* XXX */ 70 71 MALLOC(kth, struct ktr_header *, sizeof (struct ktr_header), 72 M_KTRACE, M_WAITOK); 73 kth->ktr_type = type; 74 microtime(&kth->ktr_time); 75 kth->ktr_pid = p->p_pid; 76 bcopy(p->p_comm, kth->ktr_comm, MAXCOMLEN); 77 return (kth); 78 } 79 80 void 81 ktrsyscall(vp, code, narg, args) 82 struct vnode *vp; 83 int code, narg; 84 register_t args[]; 85 { 86 struct ktr_header *kth; 87 struct ktr_syscall *ktp; 88 register int len = offsetof(struct ktr_syscall, ktr_args) + 89 (narg * sizeof(register_t)); 90 struct proc *p = curproc; /* XXX */ 91 register_t *argp; 92 int i; 93 94 p->p_traceflag |= KTRFAC_ACTIVE; 95 kth = ktrgetheader(KTR_SYSCALL); 96 MALLOC(ktp, struct ktr_syscall *, len, M_KTRACE, M_WAITOK); 97 ktp->ktr_code = code; 98 ktp->ktr_narg = narg; 99 argp = &ktp->ktr_args[0]; 100 for (i = 0; i < narg; i++) 101 *argp++ = args[i]; 102 kth->ktr_buf = (caddr_t)ktp; 103 kth->ktr_len = len; 104 ktrwrite(vp, kth); 105 FREE(ktp, M_KTRACE); 106 FREE(kth, M_KTRACE); 107 p->p_traceflag &= ~KTRFAC_ACTIVE; 108 } 109 110 void 111 ktrsysret(vp, code, error, retval) 112 struct vnode *vp; 113 int code, error; 114 register_t retval; 115 { 116 struct ktr_header *kth; 117 struct ktr_sysret ktp; 118 struct proc *p = curproc; /* XXX */ 119 120 p->p_traceflag |= KTRFAC_ACTIVE; 121 kth = ktrgetheader(KTR_SYSRET); 122 ktp.ktr_code = code; 123 ktp.ktr_error = error; 124 ktp.ktr_retval = retval; /* what about val2 ? */ 125 126 kth->ktr_buf = (caddr_t)&ktp; 127 kth->ktr_len = sizeof(struct ktr_sysret); 128 129 ktrwrite(vp, kth); 130 FREE(kth, M_KTRACE); 131 p->p_traceflag &= ~KTRFAC_ACTIVE; 132 } 133 134 void 135 ktrnamei(vp, path) 136 struct vnode *vp; 137 char *path; 138 { 139 struct ktr_header *kth; 140 struct proc *p = curproc; /* XXX */ 141 142 p->p_traceflag |= KTRFAC_ACTIVE; 143 kth = ktrgetheader(KTR_NAMEI); 144 kth->ktr_len = strlen(path); 145 kth->ktr_buf = path; 146 147 ktrwrite(vp, kth); 148 FREE(kth, M_KTRACE); 149 p->p_traceflag &= ~KTRFAC_ACTIVE; 150 } 151 152 void 153 ktrgenio(vp, fd, rw, iov, len, error) 154 struct vnode *vp; 155 int fd; 156 enum uio_rw rw; 157 register struct iovec *iov; 158 int len, error; 159 { 160 struct ktr_header *kth; 161 register struct ktr_genio *ktp; 162 register caddr_t cp; 163 register int resid = len, cnt; 164 struct proc *p = curproc; /* XXX */ 165 166 if (error) 167 return; 168 p->p_traceflag |= KTRFAC_ACTIVE; 169 kth = ktrgetheader(KTR_GENIO); 170 MALLOC(ktp, struct ktr_genio *, sizeof(struct ktr_genio) + len, 171 M_KTRACE, M_WAITOK); 172 ktp->ktr_fd = fd; 173 ktp->ktr_rw = rw; 174 cp = (caddr_t)((char *)ktp + sizeof (struct ktr_genio)); 175 while (resid > 0) { 176 if ((cnt = iov->iov_len) > resid) 177 cnt = resid; 178 if (copyin(iov->iov_base, cp, (unsigned)cnt)) 179 goto done; 180 cp += cnt; 181 resid -= cnt; 182 iov++; 183 } 184 kth->ktr_buf = (caddr_t)ktp; 185 kth->ktr_len = sizeof (struct ktr_genio) + len; 186 187 ktrwrite(vp, kth); 188 done: 189 FREE(kth, M_KTRACE); 190 FREE(ktp, M_KTRACE); 191 p->p_traceflag &= ~KTRFAC_ACTIVE; 192 } 193 194 void 195 ktrpsig(vp, sig, action, mask, code) 196 struct vnode *vp; 197 int sig; 198 sig_t action; 199 int mask, code; 200 { 201 struct ktr_header *kth; 202 struct ktr_psig kp; 203 struct proc *p = curproc; /* XXX */ 204 205 p->p_traceflag |= KTRFAC_ACTIVE; 206 kth = ktrgetheader(KTR_PSIG); 207 kp.signo = (char)sig; 208 kp.action = action; 209 kp.mask = mask; 210 kp.code = code; 211 kth->ktr_buf = (caddr_t)&kp; 212 kth->ktr_len = sizeof (struct ktr_psig); 213 214 ktrwrite(vp, kth); 215 FREE(kth, M_KTRACE); 216 p->p_traceflag &= ~KTRFAC_ACTIVE; 217 } 218 219 void 220 ktrcsw(vp, out, user) 221 struct vnode *vp; 222 int out, user; 223 { 224 struct ktr_header *kth; 225 struct ktr_csw kc; 226 struct proc *p = curproc; /* XXX */ 227 228 p->p_traceflag |= KTRFAC_ACTIVE; 229 kth = ktrgetheader(KTR_CSW); 230 kc.out = out; 231 kc.user = user; 232 kth->ktr_buf = (caddr_t)&kc; 233 kth->ktr_len = sizeof (struct ktr_csw); 234 235 ktrwrite(vp, kth); 236 FREE(kth, M_KTRACE); 237 p->p_traceflag &= ~KTRFAC_ACTIVE; 238 } 239 #endif 240 241 /* Interface and common routines */ 242 243 /* 244 * ktrace system call 245 */ 246 #ifndef _SYS_SYSPROTO_H_ 247 struct ktrace_args { 248 char *fname; 249 int ops; 250 int facs; 251 int pid; 252 }; 253 #endif 254 /* ARGSUSED */ 255 int 256 ktrace(curp, uap) 257 struct proc *curp; 258 register struct ktrace_args *uap; 259 { 260 #ifdef KTRACE 261 register struct vnode *vp = NULL; 262 register struct proc *p; 263 struct pgrp *pg; 264 int facs = uap->facs & ~KTRFAC_ROOT; 265 int ops = KTROP(uap->ops); 266 int descend = uap->ops & KTRFLAG_DESCEND; 267 int ret = 0; 268 int error = 0; 269 struct nameidata nd; 270 271 curp->p_traceflag |= KTRFAC_ACTIVE; 272 if (ops != KTROP_CLEAR) { 273 /* 274 * an operation which requires a file argument. 275 */ 276 NDINIT(&nd, LOOKUP, FOLLOW, UIO_USERSPACE, uap->fname, curp); 277 error = vn_open(&nd, FREAD|FWRITE, 0); 278 if (error) { 279 curp->p_traceflag &= ~KTRFAC_ACTIVE; 280 return (error); 281 } 282 vp = nd.ni_vp; 283 VOP_UNLOCK(vp, 0, curp); 284 if (vp->v_type != VREG) { 285 (void) vn_close(vp, FREAD|FWRITE, curp->p_ucred, curp); 286 curp->p_traceflag &= ~KTRFAC_ACTIVE; 287 return (EACCES); 288 } 289 } 290 /* 291 * Clear all uses of the tracefile 292 */ 293 if (ops == KTROP_CLEARFILE) { 294 for (p = allproc.lh_first; p != 0; p = p->p_list.le_next) { 295 if (p->p_tracep == vp) { 296 if (ktrcanset(curp, p)) { 297 p->p_tracep = NULL; 298 p->p_traceflag = 0; 299 (void) vn_close(vp, FREAD|FWRITE, 300 p->p_ucred, p); 301 } else 302 error = EPERM; 303 } 304 } 305 goto done; 306 } 307 /* 308 * need something to (un)trace (XXX - why is this here?) 309 */ 310 if (!facs) { 311 error = EINVAL; 312 goto done; 313 } 314 /* 315 * do it 316 */ 317 if (uap->pid < 0) { 318 /* 319 * by process group 320 */ 321 pg = pgfind(-uap->pid); 322 if (pg == NULL) { 323 error = ESRCH; 324 goto done; 325 } 326 for (p = pg->pg_members.lh_first; p != 0; p = p->p_pglist.le_next) 327 if (descend) 328 ret |= ktrsetchildren(curp, p, ops, facs, vp); 329 else 330 ret |= ktrops(curp, p, ops, facs, vp); 331 332 } else { 333 /* 334 * by pid 335 */ 336 p = pfind(uap->pid); 337 if (p == NULL) { 338 error = ESRCH; 339 goto done; 340 } 341 if (descend) 342 ret |= ktrsetchildren(curp, p, ops, facs, vp); 343 else 344 ret |= ktrops(curp, p, ops, facs, vp); 345 } 346 if (!ret) 347 error = EPERM; 348 done: 349 if (vp != NULL) 350 (void) vn_close(vp, FWRITE, curp->p_ucred, curp); 351 curp->p_traceflag &= ~KTRFAC_ACTIVE; 352 return (error); 353 #else 354 return ENOSYS; 355 #endif 356 } 357 358 /* 359 * utrace system call 360 */ 361 /* ARGSUSED */ 362 int 363 utrace(curp, uap) 364 struct proc *curp; 365 register struct utrace_args *uap; 366 { 367 #ifdef KTRACE 368 struct ktr_header *kth; 369 struct proc *p = curproc; /* XXX */ 370 register caddr_t cp; 371 372 if (!KTRPOINT(p, KTR_USER)) 373 return (0); 374 p->p_traceflag |= KTRFAC_ACTIVE; 375 kth = ktrgetheader(KTR_USER); 376 MALLOC(cp, caddr_t, uap->len, M_KTRACE, M_WAITOK); 377 if (!copyin(uap->addr, cp, uap->len)) { 378 kth->ktr_buf = cp; 379 kth->ktr_len = uap->len; 380 ktrwrite(p->p_tracep, kth); 381 } 382 FREE(kth, M_KTRACE); 383 FREE(cp, M_KTRACE); 384 p->p_traceflag &= ~KTRFAC_ACTIVE; 385 386 return (0); 387 #else 388 return (ENOSYS); 389 #endif 390 } 391 392 #ifdef KTRACE 393 static int 394 ktrops(curp, p, ops, facs, vp) 395 struct proc *p, *curp; 396 int ops, facs; 397 struct vnode *vp; 398 { 399 400 if (!ktrcanset(curp, p)) 401 return (0); 402 if (ops == KTROP_SET) { 403 if (p->p_tracep != vp) { 404 /* 405 * if trace file already in use, relinquish 406 */ 407 if (p->p_tracep != NULL) 408 vrele(p->p_tracep); 409 VREF(vp); 410 p->p_tracep = vp; 411 } 412 p->p_traceflag |= facs; 413 if (curp->p_ucred->cr_uid == 0) 414 p->p_traceflag |= KTRFAC_ROOT; 415 } else { 416 /* KTROP_CLEAR */ 417 if (((p->p_traceflag &= ~facs) & KTRFAC_MASK) == 0) { 418 /* no more tracing */ 419 p->p_traceflag = 0; 420 if (p->p_tracep != NULL) { 421 vrele(p->p_tracep); 422 p->p_tracep = NULL; 423 } 424 } 425 } 426 427 return (1); 428 } 429 430 static int 431 ktrsetchildren(curp, top, ops, facs, vp) 432 struct proc *curp, *top; 433 int ops, facs; 434 struct vnode *vp; 435 { 436 register struct proc *p; 437 register int ret = 0; 438 439 p = top; 440 for (;;) { 441 ret |= ktrops(curp, p, ops, facs, vp); 442 /* 443 * If this process has children, descend to them next, 444 * otherwise do any siblings, and if done with this level, 445 * follow back up the tree (but not past top). 446 */ 447 if (p->p_children.lh_first) 448 p = p->p_children.lh_first; 449 else for (;;) { 450 if (p == top) 451 return (ret); 452 if (p->p_sibling.le_next) { 453 p = p->p_sibling.le_next; 454 break; 455 } 456 p = p->p_pptr; 457 } 458 } 459 /*NOTREACHED*/ 460 } 461 462 static void 463 ktrwrite(vp, kth) 464 struct vnode *vp; 465 register struct ktr_header *kth; 466 { 467 struct uio auio; 468 struct iovec aiov[2]; 469 register struct proc *p = curproc; /* XXX */ 470 int error; 471 472 if (vp == NULL) 473 return; 474 auio.uio_iov = &aiov[0]; 475 auio.uio_offset = 0; 476 auio.uio_segflg = UIO_SYSSPACE; 477 auio.uio_rw = UIO_WRITE; 478 aiov[0].iov_base = (caddr_t)kth; 479 aiov[0].iov_len = sizeof(struct ktr_header); 480 auio.uio_resid = sizeof(struct ktr_header); 481 auio.uio_iovcnt = 1; 482 auio.uio_procp = curproc; 483 if (kth->ktr_len > 0) { 484 auio.uio_iovcnt++; 485 aiov[1].iov_base = kth->ktr_buf; 486 aiov[1].iov_len = kth->ktr_len; 487 auio.uio_resid += kth->ktr_len; 488 } 489 vn_lock(vp, LK_EXCLUSIVE | LK_RETRY, p); 490 error = VOP_WRITE(vp, &auio, IO_UNIT|IO_APPEND, p->p_ucred); 491 VOP_UNLOCK(vp, 0, p); 492 if (!error) 493 return; 494 /* 495 * If error encountered, give up tracing on this vnode. 496 */ 497 log(LOG_NOTICE, "ktrace write failed, errno %d, tracing stopped\n", 498 error); 499 for (p = allproc.lh_first; p != 0; p = p->p_list.le_next) { 500 if (p->p_tracep == vp) { 501 p->p_tracep = NULL; 502 p->p_traceflag = 0; 503 vrele(vp); 504 } 505 } 506 } 507 508 /* 509 * Return true if caller has permission to set the ktracing state 510 * of target. Essentially, the target can't possess any 511 * more permissions than the caller. KTRFAC_ROOT signifies that 512 * root previously set the tracing status on the target process, and 513 * so, only root may further change it. 514 * 515 * TODO: check groups. use caller effective gid. 516 */ 517 static int 518 ktrcanset(callp, targetp) 519 struct proc *callp, *targetp; 520 { 521 register struct pcred *caller = callp->p_cred; 522 register struct pcred *target = targetp->p_cred; 523 524 if (!PRISON_CHECK(callp, targetp)) 525 return (0); 526 if ((caller->pc_ucred->cr_uid == target->p_ruid && 527 target->p_ruid == target->p_svuid && 528 caller->p_rgid == target->p_rgid && /* XXX */ 529 target->p_rgid == target->p_svgid && 530 (targetp->p_traceflag & KTRFAC_ROOT) == 0) || 531 caller->pc_ucred->cr_uid == 0) 532 return (1); 533 534 return (0); 535 } 536 537 #endif /* KTRACE */ 538