kern_ktrace.c revision 51791
1155131Srwatson/* 2155131Srwatson * Copyright (c) 1989, 1993 3155131Srwatson * The Regents of the University of California. All rights reserved. 4155131Srwatson * 5155131Srwatson * Redistribution and use in source and binary forms, with or without 6155131Srwatson * modification, are permitted provided that the following conditions 7155131Srwatson * are met: 8155131Srwatson * 1. Redistributions of source code must retain the above copyright 9155131Srwatson * notice, this list of conditions and the following disclaimer. 10155131Srwatson * 2. Redistributions in binary form must reproduce the above copyright 11155131Srwatson * notice, this list of conditions and the following disclaimer in the 12155131Srwatson * documentation and/or other materials provided with the distribution. 13155131Srwatson * 3. All advertising materials mentioning features or use of this software 14155131Srwatson * must display the following acknowledgement: 15155131Srwatson * This product includes software developed by the University of 16155131Srwatson * California, Berkeley and its contributors. 17155131Srwatson * 4. Neither the name of the University nor the names of its contributors 18155131Srwatson * may be used to endorse or promote products derived from this software 19155131Srwatson * without specific prior written permission. 20155131Srwatson * 21155131Srwatson * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND 22155131Srwatson * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 23155131Srwatson * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 24155131Srwatson * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE 25155131Srwatson * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 26155131Srwatson * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 27155131Srwatson * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 28155131Srwatson * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 29155131Srwatson * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 30155131Srwatson * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 31155131Srwatson * SUCH DAMAGE. 32168777Srwatson * 33155131Srwatson * @(#)kern_ktrace.c 8.2 (Berkeley) 9/23/93 34155131Srwatson * $FreeBSD: head/sys/kern/kern_ktrace.c 51791 1999-09-29 15:03:48Z marcel $ 35155131Srwatson */ 36155131Srwatson 37155131Srwatson#include "opt_ktrace.h" 38168777Srwatson 39155131Srwatson#include <sys/param.h> 40168777Srwatson#include <sys/systm.h> 41155131Srwatson#include <sys/sysproto.h> 42155131Srwatson#include <sys/kernel.h> 43168777Srwatson#include <sys/proc.h> 44155131Srwatson#include <sys/fcntl.h> 45168777Srwatson#include <sys/lock.h> 46168777Srwatson#include <sys/namei.h> 47168777Srwatson#include <sys/vnode.h> 48155131Srwatson#include <sys/ktrace.h> 49155131Srwatson#include <sys/malloc.h> 50155131Srwatson#include <sys/syslog.h> 51155131Srwatson 52155131Srwatson#include <stddef.h> 53155131Srwatson 54155131Srwatsonstatic MALLOC_DEFINE(M_KTRACE, "KTRACE", "KTRACE"); 55155131Srwatson 56155131Srwatson#ifdef KTRACE 57155131Srwatsonstatic struct ktr_header *ktrgetheader __P((int type)); 58155131Srwatsonstatic void ktrwrite __P((struct vnode *, struct ktr_header *)); 59155131Srwatsonstatic int ktrcanset __P((struct proc *,struct proc *)); 60155131Srwatsonstatic int ktrsetchildren __P((struct proc *,struct proc *,int,int,struct vnode *)); 61155131Srwatsonstatic int ktrops __P((struct proc *,struct proc *,int,int,struct vnode *)); 62168777Srwatson 63155131Srwatson 64168777Srwatsonstatic struct ktr_header * 65155131Srwatsonktrgetheader(type) 66155131Srwatson int type; 67155131Srwatson{ 68155131Srwatson register struct ktr_header *kth; 69155131Srwatson struct proc *p = curproc; /* XXX */ 70155131Srwatson 71168777Srwatson MALLOC(kth, struct ktr_header *, sizeof (struct ktr_header), 72168777Srwatson M_KTRACE, M_WAITOK); 73155131Srwatson kth->ktr_type = type; 74155131Srwatson microtime(&kth->ktr_time); 75155131Srwatson kth->ktr_pid = p->p_pid; 76168777Srwatson bcopy(p->p_comm, kth->ktr_comm, MAXCOMLEN + 1); 77155131Srwatson return (kth); 78168777Srwatson} 79168777Srwatson 80168777Srwatsonvoid 81168777Srwatsonktrsyscall(vp, code, narg, args) 82168777Srwatson struct vnode *vp; 83155131Srwatson int code, narg; 84168777Srwatson register_t args[]; 85155131Srwatson{ 86155131Srwatson struct ktr_header *kth; 87168777Srwatson struct ktr_syscall *ktp; 88168777Srwatson register int len = offsetof(struct ktr_syscall, ktr_args) + 89168777Srwatson (narg * sizeof(register_t)); 90168777Srwatson struct proc *p = curproc; /* XXX */ 91155131Srwatson register_t *argp; 92155131Srwatson int i; 93155131Srwatson 94155131Srwatson p->p_traceflag |= KTRFAC_ACTIVE; 95155131Srwatson kth = ktrgetheader(KTR_SYSCALL); 96155131Srwatson MALLOC(ktp, struct ktr_syscall *, len, M_KTRACE, M_WAITOK); 97155131Srwatson ktp->ktr_code = code; 98155131Srwatson ktp->ktr_narg = narg; 99155131Srwatson argp = &ktp->ktr_args[0]; 100155131Srwatson for (i = 0; i < narg; i++) 101155131Srwatson *argp++ = args[i]; 102155131Srwatson kth->ktr_buf = (caddr_t)ktp; 103 kth->ktr_len = len; 104 ktrwrite(vp, kth); 105 FREE(ktp, M_KTRACE); 106 FREE(kth, M_KTRACE); 107 p->p_traceflag &= ~KTRFAC_ACTIVE; 108} 109 110void 111ktrsysret(vp, code, error, retval) 112 struct vnode *vp; 113 int code, error; 114 register_t retval; 115{ 116 struct ktr_header *kth; 117 struct ktr_sysret ktp; 118 struct proc *p = curproc; /* XXX */ 119 120 p->p_traceflag |= KTRFAC_ACTIVE; 121 kth = ktrgetheader(KTR_SYSRET); 122 ktp.ktr_code = code; 123 ktp.ktr_error = error; 124 ktp.ktr_retval = retval; /* what about val2 ? */ 125 126 kth->ktr_buf = (caddr_t)&ktp; 127 kth->ktr_len = sizeof(struct ktr_sysret); 128 129 ktrwrite(vp, kth); 130 FREE(kth, M_KTRACE); 131 p->p_traceflag &= ~KTRFAC_ACTIVE; 132} 133 134void 135ktrnamei(vp, path) 136 struct vnode *vp; 137 char *path; 138{ 139 struct ktr_header *kth; 140 struct proc *p = curproc; /* XXX */ 141 142 p->p_traceflag |= KTRFAC_ACTIVE; 143 kth = ktrgetheader(KTR_NAMEI); 144 kth->ktr_len = strlen(path); 145 kth->ktr_buf = path; 146 147 ktrwrite(vp, kth); 148 FREE(kth, M_KTRACE); 149 p->p_traceflag &= ~KTRFAC_ACTIVE; 150} 151 152void 153ktrgenio(vp, fd, rw, iov, len, error) 154 struct vnode *vp; 155 int fd; 156 enum uio_rw rw; 157 register struct iovec *iov; 158 int len, error; 159{ 160 struct ktr_header *kth; 161 register struct ktr_genio *ktp; 162 register caddr_t cp; 163 register int resid = len, cnt; 164 struct proc *p = curproc; /* XXX */ 165 166 if (error) 167 return; 168 p->p_traceflag |= KTRFAC_ACTIVE; 169 kth = ktrgetheader(KTR_GENIO); 170 MALLOC(ktp, struct ktr_genio *, sizeof(struct ktr_genio) + len, 171 M_KTRACE, M_WAITOK); 172 ktp->ktr_fd = fd; 173 ktp->ktr_rw = rw; 174 cp = (caddr_t)((char *)ktp + sizeof (struct ktr_genio)); 175 while (resid > 0) { 176 if ((cnt = iov->iov_len) > resid) 177 cnt = resid; 178 if (copyin(iov->iov_base, cp, (unsigned)cnt)) 179 goto done; 180 cp += cnt; 181 resid -= cnt; 182 iov++; 183 } 184 kth->ktr_buf = (caddr_t)ktp; 185 kth->ktr_len = sizeof (struct ktr_genio) + len; 186 187 ktrwrite(vp, kth); 188done: 189 FREE(kth, M_KTRACE); 190 FREE(ktp, M_KTRACE); 191 p->p_traceflag &= ~KTRFAC_ACTIVE; 192} 193 194void 195ktrpsig(vp, sig, action, mask, code) 196 struct vnode *vp; 197 int sig, code; 198 sig_t action; 199 sigset_t *mask; 200{ 201 struct ktr_header *kth; 202 struct ktr_psig kp; 203 struct proc *p = curproc; /* XXX */ 204 205 p->p_traceflag |= KTRFAC_ACTIVE; 206 kth = ktrgetheader(KTR_PSIG); 207 kp.signo = (char)sig; 208 kp.action = action; 209 kp.mask = *mask; 210 kp.code = code; 211 kth->ktr_buf = (caddr_t)&kp; 212 kth->ktr_len = sizeof (struct ktr_psig); 213 214 ktrwrite(vp, kth); 215 FREE(kth, M_KTRACE); 216 p->p_traceflag &= ~KTRFAC_ACTIVE; 217} 218 219void 220ktrcsw(vp, out, user) 221 struct vnode *vp; 222 int out, user; 223{ 224 struct ktr_header *kth; 225 struct ktr_csw kc; 226 struct proc *p = curproc; /* XXX */ 227 228 p->p_traceflag |= KTRFAC_ACTIVE; 229 kth = ktrgetheader(KTR_CSW); 230 kc.out = out; 231 kc.user = user; 232 kth->ktr_buf = (caddr_t)&kc; 233 kth->ktr_len = sizeof (struct ktr_csw); 234 235 ktrwrite(vp, kth); 236 FREE(kth, M_KTRACE); 237 p->p_traceflag &= ~KTRFAC_ACTIVE; 238} 239#endif 240 241/* Interface and common routines */ 242 243/* 244 * ktrace system call 245 */ 246#ifndef _SYS_SYSPROTO_H_ 247struct ktrace_args { 248 char *fname; 249 int ops; 250 int facs; 251 int pid; 252}; 253#endif 254/* ARGSUSED */ 255int 256ktrace(curp, uap) 257 struct proc *curp; 258 register struct ktrace_args *uap; 259{ 260#ifdef KTRACE 261 register struct vnode *vp = NULL; 262 register struct proc *p; 263 struct pgrp *pg; 264 int facs = uap->facs & ~KTRFAC_ROOT; 265 int ops = KTROP(uap->ops); 266 int descend = uap->ops & KTRFLAG_DESCEND; 267 int ret = 0; 268 int error = 0; 269 struct nameidata nd; 270 271 curp->p_traceflag |= KTRFAC_ACTIVE; 272 if (ops != KTROP_CLEAR) { 273 /* 274 * an operation which requires a file argument. 275 */ 276 NDINIT(&nd, LOOKUP, NOFOLLOW, UIO_USERSPACE, uap->fname, curp); 277 error = vn_open(&nd, FREAD|FWRITE|O_NOFOLLOW, 0); 278 if (error) { 279 curp->p_traceflag &= ~KTRFAC_ACTIVE; 280 return (error); 281 } 282 vp = nd.ni_vp; 283 VOP_UNLOCK(vp, 0, curp); 284 if (vp->v_type != VREG) { 285 (void) vn_close(vp, FREAD|FWRITE, curp->p_ucred, curp); 286 curp->p_traceflag &= ~KTRFAC_ACTIVE; 287 return (EACCES); 288 } 289 } 290 /* 291 * Clear all uses of the tracefile 292 */ 293 if (ops == KTROP_CLEARFILE) { 294 for (p = allproc.lh_first; p != 0; p = p->p_list.le_next) { 295 if (p->p_tracep == vp) { 296 if (ktrcanset(curp, p)) { 297 p->p_tracep = NULL; 298 p->p_traceflag = 0; 299 (void) vn_close(vp, FREAD|FWRITE, 300 p->p_ucred, p); 301 } else 302 error = EPERM; 303 } 304 } 305 goto done; 306 } 307 /* 308 * need something to (un)trace (XXX - why is this here?) 309 */ 310 if (!facs) { 311 error = EINVAL; 312 goto done; 313 } 314 /* 315 * do it 316 */ 317 if (uap->pid < 0) { 318 /* 319 * by process group 320 */ 321 pg = pgfind(-uap->pid); 322 if (pg == NULL) { 323 error = ESRCH; 324 goto done; 325 } 326 for (p = pg->pg_members.lh_first; p != 0; p = p->p_pglist.le_next) 327 if (descend) 328 ret |= ktrsetchildren(curp, p, ops, facs, vp); 329 else 330 ret |= ktrops(curp, p, ops, facs, vp); 331 332 } else { 333 /* 334 * by pid 335 */ 336 p = pfind(uap->pid); 337 if (p == NULL) { 338 error = ESRCH; 339 goto done; 340 } 341 if (descend) 342 ret |= ktrsetchildren(curp, p, ops, facs, vp); 343 else 344 ret |= ktrops(curp, p, ops, facs, vp); 345 } 346 if (!ret) 347 error = EPERM; 348done: 349 if (vp != NULL) 350 (void) vn_close(vp, FWRITE, curp->p_ucred, curp); 351 curp->p_traceflag &= ~KTRFAC_ACTIVE; 352 return (error); 353#else 354 return ENOSYS; 355#endif 356} 357 358/* 359 * utrace system call 360 */ 361/* ARGSUSED */ 362int 363utrace(curp, uap) 364 struct proc *curp; 365 register struct utrace_args *uap; 366{ 367#ifdef KTRACE 368 struct ktr_header *kth; 369 struct proc *p = curproc; /* XXX */ 370 register caddr_t cp; 371 372 if (!KTRPOINT(p, KTR_USER)) 373 return (0); 374 p->p_traceflag |= KTRFAC_ACTIVE; 375 kth = ktrgetheader(KTR_USER); 376 MALLOC(cp, caddr_t, uap->len, M_KTRACE, M_WAITOK); 377 if (!copyin(uap->addr, cp, uap->len)) { 378 kth->ktr_buf = cp; 379 kth->ktr_len = uap->len; 380 ktrwrite(p->p_tracep, kth); 381 } 382 FREE(kth, M_KTRACE); 383 FREE(cp, M_KTRACE); 384 p->p_traceflag &= ~KTRFAC_ACTIVE; 385 386 return (0); 387#else 388 return (ENOSYS); 389#endif 390} 391 392#ifdef KTRACE 393static int 394ktrops(curp, p, ops, facs, vp) 395 struct proc *p, *curp; 396 int ops, facs; 397 struct vnode *vp; 398{ 399 400 if (!ktrcanset(curp, p)) 401 return (0); 402 if (ops == KTROP_SET) { 403 if (p->p_tracep != vp) { 404 /* 405 * if trace file already in use, relinquish 406 */ 407 if (p->p_tracep != NULL) 408 vrele(p->p_tracep); 409 VREF(vp); 410 p->p_tracep = vp; 411 } 412 p->p_traceflag |= facs; 413 if (curp->p_ucred->cr_uid == 0) 414 p->p_traceflag |= KTRFAC_ROOT; 415 } else { 416 /* KTROP_CLEAR */ 417 if (((p->p_traceflag &= ~facs) & KTRFAC_MASK) == 0) { 418 /* no more tracing */ 419 p->p_traceflag = 0; 420 if (p->p_tracep != NULL) { 421 vrele(p->p_tracep); 422 p->p_tracep = NULL; 423 } 424 } 425 } 426 427 return (1); 428} 429 430static int 431ktrsetchildren(curp, top, ops, facs, vp) 432 struct proc *curp, *top; 433 int ops, facs; 434 struct vnode *vp; 435{ 436 register struct proc *p; 437 register int ret = 0; 438 439 p = top; 440 for (;;) { 441 ret |= ktrops(curp, p, ops, facs, vp); 442 /* 443 * If this process has children, descend to them next, 444 * otherwise do any siblings, and if done with this level, 445 * follow back up the tree (but not past top). 446 */ 447 if (p->p_children.lh_first) 448 p = p->p_children.lh_first; 449 else for (;;) { 450 if (p == top) 451 return (ret); 452 if (p->p_sibling.le_next) { 453 p = p->p_sibling.le_next; 454 break; 455 } 456 p = p->p_pptr; 457 } 458 } 459 /*NOTREACHED*/ 460} 461 462static void 463ktrwrite(vp, kth) 464 struct vnode *vp; 465 register struct ktr_header *kth; 466{ 467 struct uio auio; 468 struct iovec aiov[2]; 469 register struct proc *p = curproc; /* XXX */ 470 int error; 471 472 if (vp == NULL) 473 return; 474 auio.uio_iov = &aiov[0]; 475 auio.uio_offset = 0; 476 auio.uio_segflg = UIO_SYSSPACE; 477 auio.uio_rw = UIO_WRITE; 478 aiov[0].iov_base = (caddr_t)kth; 479 aiov[0].iov_len = sizeof(struct ktr_header); 480 auio.uio_resid = sizeof(struct ktr_header); 481 auio.uio_iovcnt = 1; 482 auio.uio_procp = curproc; 483 if (kth->ktr_len > 0) { 484 auio.uio_iovcnt++; 485 aiov[1].iov_base = kth->ktr_buf; 486 aiov[1].iov_len = kth->ktr_len; 487 auio.uio_resid += kth->ktr_len; 488 } 489 vn_lock(vp, LK_EXCLUSIVE | LK_RETRY, p); 490 error = VOP_WRITE(vp, &auio, IO_UNIT|IO_APPEND, p->p_ucred); 491 VOP_UNLOCK(vp, 0, p); 492 if (!error) 493 return; 494 /* 495 * If error encountered, give up tracing on this vnode. 496 */ 497 log(LOG_NOTICE, "ktrace write failed, errno %d, tracing stopped\n", 498 error); 499 for (p = allproc.lh_first; p != 0; p = p->p_list.le_next) { 500 if (p->p_tracep == vp) { 501 p->p_tracep = NULL; 502 p->p_traceflag = 0; 503 vrele(vp); 504 } 505 } 506} 507 508/* 509 * Return true if caller has permission to set the ktracing state 510 * of target. Essentially, the target can't possess any 511 * more permissions than the caller. KTRFAC_ROOT signifies that 512 * root previously set the tracing status on the target process, and 513 * so, only root may further change it. 514 * 515 * TODO: check groups. use caller effective gid. 516 */ 517static int 518ktrcanset(callp, targetp) 519 struct proc *callp, *targetp; 520{ 521 register struct pcred *caller = callp->p_cred; 522 register struct pcred *target = targetp->p_cred; 523 524 if (!PRISON_CHECK(callp, targetp)) 525 return (0); 526 if ((caller->pc_ucred->cr_uid == target->p_ruid && 527 target->p_ruid == target->p_svuid && 528 caller->p_rgid == target->p_rgid && /* XXX */ 529 target->p_rgid == target->p_svgid && 530 (targetp->p_traceflag & KTRFAC_ROOT) == 0) || 531 caller->pc_ucred->cr_uid == 0) 532 return (1); 533 534 return (0); 535} 536 537#endif /* KTRACE */ 538