xref: /freebsd/sys/kern/kern_procctl.c (revision ec0e626bafb335b30c499d06066997f54b10c092)
1 /*-
2  * Copyright (c) 2014 John Baldwin
3  * Copyright (c) 2014 The FreeBSD Foundation
4  *
5  * Portions of this software were developed by Konstantin Belousov
6  * under sponsorship from the FreeBSD Foundation.
7  *
8  * Redistribution and use in source and binary forms, with or without
9  * modification, are permitted provided that the following conditions
10  * are met:
11  * 1. Redistributions of source code must retain the above copyright
12  *    notice, this list of conditions and the following disclaimer.
13  * 2. Redistributions in binary form must reproduce the above copyright
14  *    notice, this list of conditions and the following disclaimer in the
15  *    documentation and/or other materials provided with the distribution.
16  *
17  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
18  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
19  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
20  * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
21  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
22  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
23  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
24  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
25  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
26  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
27  * SUCH DAMAGE.
28  */
29 
30 #include <sys/cdefs.h>
31 __FBSDID("$FreeBSD$");
32 
33 #include <sys/param.h>
34 #include <sys/systm.h>
35 #include <sys/capsicum.h>
36 #include <sys/lock.h>
37 #include <sys/mutex.h>
38 #include <sys/priv.h>
39 #include <sys/proc.h>
40 #include <sys/procctl.h>
41 #include <sys/sx.h>
42 #include <sys/syscallsubr.h>
43 #include <sys/sysproto.h>
44 #include <sys/wait.h>
45 
46 static int
47 protect_setchild(struct thread *td, struct proc *p, int flags)
48 {
49 
50 	PROC_LOCK_ASSERT(p, MA_OWNED);
51 	if (p->p_flag & P_SYSTEM || p_cansched(td, p) != 0)
52 		return (0);
53 	if (flags & PPROT_SET) {
54 		p->p_flag |= P_PROTECTED;
55 		if (flags & PPROT_INHERIT)
56 			p->p_flag2 |= P2_INHERIT_PROTECTED;
57 	} else {
58 		p->p_flag &= ~P_PROTECTED;
59 		p->p_flag2 &= ~P2_INHERIT_PROTECTED;
60 	}
61 	return (1);
62 }
63 
64 static int
65 protect_setchildren(struct thread *td, struct proc *top, int flags)
66 {
67 	struct proc *p;
68 	int ret;
69 
70 	p = top;
71 	ret = 0;
72 	sx_assert(&proctree_lock, SX_LOCKED);
73 	for (;;) {
74 		ret |= protect_setchild(td, p, flags);
75 		PROC_UNLOCK(p);
76 		/*
77 		 * If this process has children, descend to them next,
78 		 * otherwise do any siblings, and if done with this level,
79 		 * follow back up the tree (but not past top).
80 		 */
81 		if (!LIST_EMPTY(&p->p_children))
82 			p = LIST_FIRST(&p->p_children);
83 		else for (;;) {
84 			if (p == top) {
85 				PROC_LOCK(p);
86 				return (ret);
87 			}
88 			if (LIST_NEXT(p, p_sibling)) {
89 				p = LIST_NEXT(p, p_sibling);
90 				break;
91 			}
92 			p = p->p_pptr;
93 		}
94 		PROC_LOCK(p);
95 	}
96 }
97 
98 static int
99 protect_set(struct thread *td, struct proc *p, int flags)
100 {
101 	int error, ret;
102 
103 	switch (PPROT_OP(flags)) {
104 	case PPROT_SET:
105 	case PPROT_CLEAR:
106 		break;
107 	default:
108 		return (EINVAL);
109 	}
110 
111 	if ((PPROT_FLAGS(flags) & ~(PPROT_DESCEND | PPROT_INHERIT)) != 0)
112 		return (EINVAL);
113 
114 	error = priv_check(td, PRIV_VM_MADV_PROTECT);
115 	if (error)
116 		return (error);
117 
118 	if (flags & PPROT_DESCEND)
119 		ret = protect_setchildren(td, p, flags);
120 	else
121 		ret = protect_setchild(td, p, flags);
122 	if (ret == 0)
123 		return (EPERM);
124 	return (0);
125 }
126 
127 static int
128 reap_acquire(struct thread *td, struct proc *p)
129 {
130 
131 	sx_assert(&proctree_lock, SX_XLOCKED);
132 	if (p != curproc)
133 		return (EPERM);
134 	if ((p->p_treeflag & P_TREE_REAPER) != 0)
135 		return (EBUSY);
136 	p->p_treeflag |= P_TREE_REAPER;
137 	/*
138 	 * We do not reattach existing children and the whole tree
139 	 * under them to us, since p->p_reaper already seen them.
140 	 */
141 	return (0);
142 }
143 
144 static int
145 reap_release(struct thread *td, struct proc *p)
146 {
147 
148 	sx_assert(&proctree_lock, SX_XLOCKED);
149 	if (p != curproc)
150 		return (EPERM);
151 	if (p == initproc)
152 		return (EINVAL);
153 	if ((p->p_treeflag & P_TREE_REAPER) == 0)
154 		return (EINVAL);
155 	reaper_abandon_children(p, false);
156 	return (0);
157 }
158 
159 static int
160 reap_status(struct thread *td, struct proc *p,
161     struct procctl_reaper_status *rs)
162 {
163 	struct proc *reap, *p2, *first_p;
164 
165 	sx_assert(&proctree_lock, SX_LOCKED);
166 	bzero(rs, sizeof(*rs));
167 	if ((p->p_treeflag & P_TREE_REAPER) == 0) {
168 		reap = p->p_reaper;
169 	} else {
170 		reap = p;
171 		rs->rs_flags |= REAPER_STATUS_OWNED;
172 	}
173 	if (reap == initproc)
174 		rs->rs_flags |= REAPER_STATUS_REALINIT;
175 	rs->rs_reaper = reap->p_pid;
176 	rs->rs_descendants = 0;
177 	rs->rs_children = 0;
178 	if (!LIST_EMPTY(&reap->p_reaplist)) {
179 		first_p = LIST_FIRST(&reap->p_children);
180 		if (first_p == NULL)
181 			first_p = LIST_FIRST(&reap->p_reaplist);
182 		rs->rs_pid = first_p->p_pid;
183 		LIST_FOREACH(p2, &reap->p_reaplist, p_reapsibling) {
184 			if (proc_realparent(p2) == reap)
185 				rs->rs_children++;
186 			rs->rs_descendants++;
187 		}
188 	} else {
189 		rs->rs_pid = -1;
190 		KASSERT(LIST_EMPTY(&reap->p_reaplist), ("reap children list"));
191 		KASSERT(LIST_EMPTY(&reap->p_children), ("children list"));
192 	}
193 	return (0);
194 }
195 
196 static int
197 reap_getpids(struct thread *td, struct proc *p, struct procctl_reaper_pids *rp)
198 {
199 	struct proc *reap, *p2;
200 	struct procctl_reaper_pidinfo *pi, *pip;
201 	u_int i, n;
202 	int error;
203 
204 	sx_assert(&proctree_lock, SX_LOCKED);
205 	PROC_UNLOCK(p);
206 	reap = (p->p_treeflag & P_TREE_REAPER) == 0 ? p->p_reaper : p;
207 	n = i = 0;
208 	error = 0;
209 	LIST_FOREACH(p2, &reap->p_reaplist, p_reapsibling)
210 		n++;
211 	sx_unlock(&proctree_lock);
212 	if (rp->rp_count < n)
213 		n = rp->rp_count;
214 	pi = malloc(n * sizeof(*pi), M_TEMP, M_WAITOK);
215 	sx_slock(&proctree_lock);
216 	LIST_FOREACH(p2, &reap->p_reaplist, p_reapsibling) {
217 		if (i == n)
218 			break;
219 		pip = &pi[i];
220 		bzero(pip, sizeof(*pip));
221 		pip->pi_pid = p2->p_pid;
222 		pip->pi_subtree = p2->p_reapsubtree;
223 		pip->pi_flags = REAPER_PIDINFO_VALID;
224 		if (proc_realparent(p2) == reap)
225 			pip->pi_flags |= REAPER_PIDINFO_CHILD;
226 		i++;
227 	}
228 	sx_sunlock(&proctree_lock);
229 	error = copyout(pi, rp->rp_pids, i * sizeof(*pi));
230 	free(pi, M_TEMP);
231 	sx_slock(&proctree_lock);
232 	PROC_LOCK(p);
233 	return (error);
234 }
235 
236 static int
237 reap_kill(struct thread *td, struct proc *p, struct procctl_reaper_kill *rk)
238 {
239 	struct proc *reap, *p2;
240 	ksiginfo_t ksi;
241 	int error, error1;
242 
243 	sx_assert(&proctree_lock, SX_LOCKED);
244 	if (IN_CAPABILITY_MODE(td))
245 		return (ECAPMODE);
246 	if (rk->rk_sig <= 0 || rk->rk_sig > _SIG_MAXSIG)
247 		return (EINVAL);
248 	if ((rk->rk_flags & ~REAPER_KILL_CHILDREN) != 0)
249 		return (EINVAL);
250 	PROC_UNLOCK(p);
251 	reap = (p->p_treeflag & P_TREE_REAPER) == 0 ? p->p_reaper : p;
252 	ksiginfo_init(&ksi);
253 	ksi.ksi_signo = rk->rk_sig;
254 	ksi.ksi_code = SI_USER;
255 	ksi.ksi_pid = td->td_proc->p_pid;
256 	ksi.ksi_uid = td->td_ucred->cr_ruid;
257 	error = ESRCH;
258 	rk->rk_killed = 0;
259 	rk->rk_fpid = -1;
260 	for (p2 = (rk->rk_flags & REAPER_KILL_CHILDREN) != 0 ?
261 	    LIST_FIRST(&reap->p_children) : LIST_FIRST(&reap->p_reaplist);
262 	    p2 != NULL;
263 	    p2 = (rk->rk_flags & REAPER_KILL_CHILDREN) != 0 ?
264 	    LIST_NEXT(p2, p_sibling) : LIST_NEXT(p2, p_reapsibling)) {
265 		if ((rk->rk_flags & REAPER_KILL_SUBTREE) != 0 &&
266 		    p2->p_reapsubtree != rk->rk_subtree)
267 			continue;
268 		PROC_LOCK(p2);
269 		error1 = p_cansignal(td, p2, rk->rk_sig);
270 		if (error1 == 0) {
271 			pksignal(p2, rk->rk_sig, &ksi);
272 			rk->rk_killed++;
273 			error = error1;
274 		} else if (error == ESRCH) {
275 			error = error1;
276 			rk->rk_fpid = p2->p_pid;
277 		}
278 		PROC_UNLOCK(p2);
279 		/* Do not end the loop on error, signal everything we can. */
280 	}
281 	PROC_LOCK(p);
282 	return (error);
283 }
284 
285 static int
286 trace_ctl(struct thread *td, struct proc *p, int state)
287 {
288 
289 	PROC_LOCK_ASSERT(p, MA_OWNED);
290 
291 	/*
292 	 * Ktrace changes p_traceflag from or to zero under the
293 	 * process lock, so the test does not need to acquire ktrace
294 	 * mutex.
295 	 */
296 	if ((p->p_flag & P_TRACED) != 0 || p->p_traceflag != 0)
297 		return (EBUSY);
298 
299 	switch (state) {
300 	case PROC_TRACE_CTL_ENABLE:
301 		if (td->td_proc != p)
302 			return (EPERM);
303 		p->p_flag2 &= ~(P2_NOTRACE | P2_NOTRACE_EXEC);
304 		break;
305 	case PROC_TRACE_CTL_DISABLE_EXEC:
306 		p->p_flag2 |= P2_NOTRACE_EXEC | P2_NOTRACE;
307 		break;
308 	case PROC_TRACE_CTL_DISABLE:
309 		if ((p->p_flag2 & P2_NOTRACE_EXEC) != 0) {
310 			KASSERT((p->p_flag2 & P2_NOTRACE) != 0,
311 			    ("dandling P2_NOTRACE_EXEC"));
312 			if (td->td_proc != p)
313 				return (EPERM);
314 			p->p_flag2 &= ~P2_NOTRACE_EXEC;
315 		} else {
316 			p->p_flag2 |= P2_NOTRACE;
317 		}
318 		break;
319 	default:
320 		return (EINVAL);
321 	}
322 	return (0);
323 }
324 
325 static int
326 trace_status(struct thread *td, struct proc *p, int *data)
327 {
328 
329 	if ((p->p_flag2 & P2_NOTRACE) != 0) {
330 		KASSERT((p->p_flag & P_TRACED) == 0,
331 		    ("%d traced but tracing disabled", p->p_pid));
332 		*data = -1;
333 	} else if ((p->p_flag & P_TRACED) != 0) {
334 		*data = p->p_pptr->p_pid;
335 	} else {
336 		*data = 0;
337 	}
338 	return (0);
339 }
340 
341 #ifndef _SYS_SYSPROTO_H_
342 struct procctl_args {
343 	idtype_t idtype;
344 	id_t	id;
345 	int	com;
346 	void	*data;
347 };
348 #endif
349 /* ARGSUSED */
350 int
351 sys_procctl(struct thread *td, struct procctl_args *uap)
352 {
353 	void *data;
354 	union {
355 		struct procctl_reaper_status rs;
356 		struct procctl_reaper_pids rp;
357 		struct procctl_reaper_kill rk;
358 	} x;
359 	int error, error1, flags;
360 
361 	switch (uap->com) {
362 	case PROC_SPROTECT:
363 	case PROC_TRACE_CTL:
364 		error = copyin(uap->data, &flags, sizeof(flags));
365 		if (error != 0)
366 			return (error);
367 		data = &flags;
368 		break;
369 	case PROC_REAP_ACQUIRE:
370 	case PROC_REAP_RELEASE:
371 		if (uap->data != NULL)
372 			return (EINVAL);
373 		data = NULL;
374 		break;
375 	case PROC_REAP_STATUS:
376 		data = &x.rs;
377 		break;
378 	case PROC_REAP_GETPIDS:
379 		error = copyin(uap->data, &x.rp, sizeof(x.rp));
380 		if (error != 0)
381 			return (error);
382 		data = &x.rp;
383 		break;
384 	case PROC_REAP_KILL:
385 		error = copyin(uap->data, &x.rk, sizeof(x.rk));
386 		if (error != 0)
387 			return (error);
388 		data = &x.rk;
389 		break;
390 	case PROC_TRACE_STATUS:
391 		data = &flags;
392 		break;
393 	default:
394 		return (EINVAL);
395 	}
396 	error = kern_procctl(td, uap->idtype, uap->id, uap->com, data);
397 	switch (uap->com) {
398 	case PROC_REAP_STATUS:
399 		if (error == 0)
400 			error = copyout(&x.rs, uap->data, sizeof(x.rs));
401 		break;
402 	case PROC_REAP_KILL:
403 		error1 = copyout(&x.rk, uap->data, sizeof(x.rk));
404 		if (error == 0)
405 			error = error1;
406 		break;
407 	case PROC_TRACE_STATUS:
408 		if (error == 0)
409 			error = copyout(&flags, uap->data, sizeof(flags));
410 		break;
411 	}
412 	return (error);
413 }
414 
415 static int
416 kern_procctl_single(struct thread *td, struct proc *p, int com, void *data)
417 {
418 
419 	PROC_LOCK_ASSERT(p, MA_OWNED);
420 	switch (com) {
421 	case PROC_SPROTECT:
422 		return (protect_set(td, p, *(int *)data));
423 	case PROC_REAP_ACQUIRE:
424 		return (reap_acquire(td, p));
425 	case PROC_REAP_RELEASE:
426 		return (reap_release(td, p));
427 	case PROC_REAP_STATUS:
428 		return (reap_status(td, p, data));
429 	case PROC_REAP_GETPIDS:
430 		return (reap_getpids(td, p, data));
431 	case PROC_REAP_KILL:
432 		return (reap_kill(td, p, data));
433 	case PROC_TRACE_CTL:
434 		return (trace_ctl(td, p, *(int *)data));
435 	case PROC_TRACE_STATUS:
436 		return (trace_status(td, p, data));
437 	default:
438 		return (EINVAL);
439 	}
440 }
441 
442 int
443 kern_procctl(struct thread *td, idtype_t idtype, id_t id, int com, void *data)
444 {
445 	struct pgrp *pg;
446 	struct proc *p;
447 	int error, first_error, ok;
448 	bool tree_locked;
449 
450 	switch (com) {
451 	case PROC_REAP_ACQUIRE:
452 	case PROC_REAP_RELEASE:
453 	case PROC_REAP_STATUS:
454 	case PROC_REAP_GETPIDS:
455 	case PROC_REAP_KILL:
456 	case PROC_TRACE_STATUS:
457 		if (idtype != P_PID)
458 			return (EINVAL);
459 	}
460 
461 	switch (com) {
462 	case PROC_SPROTECT:
463 	case PROC_REAP_STATUS:
464 	case PROC_REAP_GETPIDS:
465 	case PROC_REAP_KILL:
466 	case PROC_TRACE_CTL:
467 		sx_slock(&proctree_lock);
468 		tree_locked = true;
469 		break;
470 	case PROC_REAP_ACQUIRE:
471 	case PROC_REAP_RELEASE:
472 		sx_xlock(&proctree_lock);
473 		tree_locked = true;
474 		break;
475 	case PROC_TRACE_STATUS:
476 		tree_locked = false;
477 		break;
478 	default:
479 		return (EINVAL);
480 	}
481 
482 	switch (idtype) {
483 	case P_PID:
484 		p = pfind(id);
485 		if (p == NULL) {
486 			error = ESRCH;
487 			break;
488 		}
489 		error = p_cansee(td, p);
490 		if (error == 0)
491 			error = kern_procctl_single(td, p, com, data);
492 		PROC_UNLOCK(p);
493 		break;
494 	case P_PGID:
495 		/*
496 		 * Attempt to apply the operation to all members of the
497 		 * group.  Ignore processes in the group that can't be
498 		 * seen.  Ignore errors so long as at least one process is
499 		 * able to complete the request successfully.
500 		 */
501 		pg = pgfind(id);
502 		if (pg == NULL) {
503 			error = ESRCH;
504 			break;
505 		}
506 		PGRP_UNLOCK(pg);
507 		ok = 0;
508 		first_error = 0;
509 		LIST_FOREACH(p, &pg->pg_members, p_pglist) {
510 			PROC_LOCK(p);
511 			if (p->p_state == PRS_NEW || p_cansee(td, p) != 0) {
512 				PROC_UNLOCK(p);
513 				continue;
514 			}
515 			error = kern_procctl_single(td, p, com, data);
516 			PROC_UNLOCK(p);
517 			if (error == 0)
518 				ok = 1;
519 			else if (first_error == 0)
520 				first_error = error;
521 		}
522 		if (ok)
523 			error = 0;
524 		else if (first_error != 0)
525 			error = first_error;
526 		else
527 			/*
528 			 * Was not able to see any processes in the
529 			 * process group.
530 			 */
531 			error = ESRCH;
532 		break;
533 	default:
534 		error = EINVAL;
535 		break;
536 	}
537 	if (tree_locked)
538 		sx_unlock(&proctree_lock);
539 	return (error);
540 }
541