1 /* 2 * Copryight 1997 Sean Eric Fagan 3 * 4 * Redistribution and use in source and binary forms, with or without 5 * modification, are permitted provided that the following conditions 6 * are met: 7 * 1. Redistributions of source code must retain the above copyright 8 * notice, this list of conditions and the following disclaimer. 9 * 2. Redistributions in binary form must reproduce the above copyright 10 * notice, this list of conditions and the following disclaimer in the 11 * documentation and/or other materials provided with the distribution. 12 * 3. All advertising materials mentioning features or use of this software 13 * must display the following acknowledgement: 14 * This product includes software developed by Sean Eric Fagan 15 * 4. Neither the name of the author may be used to endorse or promote 16 * products derived from this software without specific prior written 17 * permission. 18 * 19 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND 20 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 21 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 22 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE 23 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 24 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 25 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 26 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 27 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 28 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 29 * SUCH DAMAGE. 30 */ 31 32 #include <sys/cdefs.h> 33 __FBSDID("$FreeBSD$"); 34 35 /* 36 * Various setup functions for truss. Not the cleanest-written code, 37 * I'm afraid. 38 */ 39 40 #include <sys/param.h> 41 #include <sys/ioctl.h> 42 #include <sys/pioctl.h> 43 #include <sys/wait.h> 44 45 #include <err.h> 46 #include <fcntl.h> 47 #include <signal.h> 48 #include <stdio.h> 49 #include <stdlib.h> 50 #include <string.h> 51 #include <time.h> 52 #include <unistd.h> 53 54 #include "truss.h" 55 #include "extern.h" 56 57 static int evflags = 0; 58 59 /* 60 * setup_and_wait() is called to start a process. All it really does 61 * is fork(), set itself up to stop on exec or exit, and then exec 62 * the given command. At that point, the child process stops, and 63 * the parent can wake up and deal with it. 64 */ 65 66 int 67 setup_and_wait(char *command[]) 68 { 69 struct procfs_status pfs; 70 char buf[32]; 71 int fd; 72 int pid; 73 int flags; 74 int loop; 75 76 pid = fork(); 77 if (pid == -1) { 78 err(1, "fork failed"); 79 } 80 if (pid == 0) { /* Child */ 81 int mask = S_EXEC | S_EXIT; 82 fd = open("/proc/curproc/mem", O_WRONLY); 83 if (fd == -1) 84 err(2, "cannot open /proc/curproc/mem"); 85 fcntl(fd, F_SETFD, 1); 86 if (ioctl(fd, PIOCBIS, mask) == -1) 87 err(3, "PIOCBIS"); 88 flags = PF_LINGER; 89 /* 90 * The PF_LINGER flag tells procfs not to wake up the 91 * process on last close; normally, this is the behaviour 92 * we want. 93 */ 94 if (ioctl(fd, PIOCSFL, flags) == -1) 95 warn("cannot set PF_LINGER"); 96 execvp(command[0], command); 97 mask = ~0; 98 ioctl(fd, PIOCBIC, ~0); 99 err(4, "execvp %s", command[0]); 100 } 101 /* Only in the parent here */ 102 103 if (waitpid(pid, NULL, WNOHANG) != 0) { 104 /* 105 * Process exited before it got to us -- meaning the exec failed 106 * miserably -- so we just quietly exit. 107 */ 108 exit(1); 109 } 110 111 sprintf(buf, "/proc/%d/mem", pid); 112 113 /* Try 6 times to trace our child, waiting 1/2 second each time */ 114 for (loop=6 ;; loop--) { 115 if (loop != 6) 116 usleep(500000); 117 if ((fd = open(buf, O_RDWR)) == -1) { 118 if (loop > 0) 119 continue; 120 else 121 err(5, "cannot open1 %s", buf); 122 } 123 if (ioctl(fd, PIOCWAIT, &pfs) == -1) { 124 if (loop >= 0) 125 continue; 126 else 127 err(6, "PIOCWAIT"); 128 } 129 if (pfs.why == S_EXIT) { 130 warnx("process exited before exec'ing"); 131 ioctl(fd, PIOCCONT, 0); 132 wait(0); 133 exit(7); 134 } else 135 break; 136 } 137 close(fd); 138 return (pid); 139 } 140 141 /* 142 * start_tracing picks up where setup_and_wait() dropped off -- namely, 143 * it sets the event mask for the given process id. Called for both 144 * monitoring an existing process and when we create our own. 145 */ 146 147 int 148 start_tracing(int pid, int failisfatal, int eventflags, int flags) 149 { 150 int fd; 151 char buf[32]; 152 struct procfs_status tmp; 153 154 sprintf(buf, "/proc/%d/mem", pid); 155 /* usleep(500000); */ 156 157 fd = open(buf, O_RDWR); 158 if (fd == -1) { 159 /* 160 * The process may have run away before we could start -- this 161 * happens with SUGID programs. So we need to see if it still 162 * exists before we complain bitterly. 163 */ 164 if (!failisfatal && kill(pid, 0) == -1) 165 return (-1); 166 err(8, "cannot open2 %s", buf); 167 } 168 169 if (ioctl(fd, PIOCSTATUS, &tmp) == -1) { 170 err(10, "cannot get procfs status struct"); 171 } 172 evflags = tmp.events; 173 174 if (ioctl(fd, PIOCBIS, eventflags) == -1) 175 err(9, "cannot set procfs event bit mask"); 176 177 /* 178 * This clears the PF_LINGER set above in setup_and_wait(); 179 * if truss happens to die before this, then the process 180 * needs to be woken up via procctl. 181 */ 182 183 if (ioctl(fd, PIOCSFL, flags) == -1) 184 warn("cannot clear PF_LINGER"); 185 186 return (fd); 187 } 188 189 /* 190 * Restore a process back to it's pre-truss state. 191 * Called for SIGINT, SIGTERM, SIGQUIT. This only 192 * applies if truss was told to monitor an already-existing 193 * process. 194 */ 195 void 196 restore_proc(int signo __unused) { 197 198 ioctl(Procfd, PIOCBIC, ~0); 199 if (evflags) 200 ioctl(Procfd, PIOCBIS, evflags); 201 exit(0); 202 } 203