1 /* 2 * Copryight 1997 Sean Eric Fagan 3 * 4 * Redistribution and use in source and binary forms, with or without 5 * modification, are permitted provided that the following conditions 6 * are met: 7 * 1. Redistributions of source code must retain the above copyright 8 * notice, this list of conditions and the following disclaimer. 9 * 2. Redistributions in binary form must reproduce the above copyright 10 * notice, this list of conditions and the following disclaimer in the 11 * documentation and/or other materials provided with the distribution. 12 * 3. All advertising materials mentioning features or use of this software 13 * must display the following acknowledgement: 14 * This product includes software developed by Sean Eric Fagan 15 * 4. Neither the name of the author may be used to endorse or promote 16 * products derived from this software without specific prior written 17 * permission. 18 * 19 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND 20 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 21 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 22 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE 23 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 24 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 25 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 26 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 27 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 28 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 29 * SUCH DAMAGE. 30 */ 31 32 #include <sys/cdefs.h> 33 __FBSDID("$FreeBSD$"); 34 35 /* 36 * Various setup functions for truss. Not the cleanest-written code, 37 * I'm afraid. 38 */ 39 40 #include <sys/param.h> 41 #include <sys/ioctl.h> 42 #include <sys/pioctl.h> 43 #include <sys/wait.h> 44 45 #include <err.h> 46 #include <fcntl.h> 47 #include <signal.h> 48 #include <stdio.h> 49 #include <stdlib.h> 50 #include <string.h> 51 #include <time.h> 52 #include <unistd.h> 53 54 #include "truss.h" 55 #include "extern.h" 56 57 static int evflags = 0; 58 59 /* 60 * setup_and_wait() is called to start a process. All it really does 61 * is fork(), set itself up to stop on exec or exit, and then exec 62 * the given command. At that point, the child process stops, and 63 * the parent can wake up and deal with it. 64 */ 65 66 int 67 setup_and_wait(char *command[]) 68 { 69 struct procfs_status pfs; 70 char buf[32]; 71 int fd; 72 int pid; 73 int flags; 74 75 pid = fork(); 76 if (pid == -1) { 77 err(1, "fork failed"); 78 } 79 if (pid == 0) { /* Child */ 80 int mask = S_EXEC | S_EXIT; 81 fd = open("/proc/curproc/mem", O_WRONLY); 82 if (fd == -1) 83 err(2, "cannot open /proc/curproc/mem"); 84 fcntl(fd, F_SETFD, 1); 85 if (ioctl(fd, PIOCBIS, mask) == -1) 86 err(3, "PIOCBIS"); 87 flags = PF_LINGER; 88 /* 89 * The PF_LINGER flag tells procfs not to wake up the 90 * process on last close; normally, this is the behaviour 91 * we want. 92 */ 93 if (ioctl(fd, PIOCSFL, flags) == -1) 94 warn("cannot set PF_LINGER"); 95 execvp(command[0], command); 96 mask = ~0; 97 ioctl(fd, PIOCBIC, ~0); 98 err(4, "execvp %s", command[0]); 99 } 100 /* Only in the parent here */ 101 102 if (waitpid(pid, NULL, WNOHANG) != 0) { 103 /* 104 * Process exited before it got to us -- meaning the exec failed 105 * miserably -- so we just quietly exit. 106 */ 107 exit(1); 108 } 109 110 sprintf(buf, "/proc/%d/mem", pid); 111 if ((fd = open(buf, O_RDWR)) == -1) 112 err(5, "cannot open %s", buf); 113 if (ioctl(fd, PIOCWAIT, &pfs) == -1) 114 err(6, "PIOCWAIT"); 115 if (pfs.why == S_EXIT) { 116 warnx("process exited before exec'ing"); 117 ioctl(fd, PIOCCONT, 0); 118 wait(0); 119 exit(7); 120 } 121 close(fd); 122 return (pid); 123 } 124 125 /* 126 * start_tracing picks up where setup_and_wait() dropped off -- namely, 127 * it sets the event mask for the given process id. Called for both 128 * monitoring an existing process and when we create our own. 129 */ 130 131 int 132 start_tracing(int pid, int failisfatal, int eventflags, int flags) 133 { 134 int fd; 135 char buf[32]; 136 struct procfs_status tmp; 137 138 sprintf(buf, "/proc/%d/mem", pid); 139 140 fd = open(buf, O_RDWR); 141 if (fd == -1) { 142 /* 143 * The process may have run away before we could start -- this 144 * happens with SUGID programs. So we need to see if it still 145 * exists before we complain bitterly. 146 */ 147 if (!failisfatal && kill(pid, 0) == -1) 148 return (-1); 149 err(8, "cannot open %s", buf); 150 } 151 152 if (ioctl(fd, PIOCSTATUS, &tmp) == -1) { 153 err(10, "cannot get procfs status struct"); 154 } 155 evflags = tmp.events; 156 157 if (ioctl(fd, PIOCBIS, eventflags) == -1) 158 err(9, "cannot set procfs event bit mask"); 159 160 /* 161 * This clears the PF_LINGER set above in setup_and_wait(); 162 * if truss happens to die before this, then the process 163 * needs to be woken up via procctl. 164 */ 165 166 if (ioctl(fd, PIOCSFL, flags) == -1) 167 warn("cannot clear PF_LINGER"); 168 169 return (fd); 170 } 171 172 /* 173 * Restore a process back to it's pre-truss state. 174 * Called for SIGINT, SIGTERM, SIGQUIT. This only 175 * applies if truss was told to monitor an already-existing 176 * process. 177 */ 178 void 179 restore_proc(int signo __unused) { 180 181 ioctl(Procfd, PIOCBIC, ~0); 182 if (evflags) 183 ioctl(Procfd, PIOCBIS, evflags); 184 exit(0); 185 } 186