sys/kern/kern_ktrace.c

   1 /*
   2  * Copyright (c) 1989, 1993
   3  *      The Regents of the University of California.  All rights reserved.
   4  *
   5  * Redistribution and use in source and binary forms, with or without
   6  * modification, are permitted provided that the following conditions
   7  * are met:
   8  * 1. Redistributions of source code must retain the above copyright
   9  *    notice, this list of conditions and the following disclaimer.
  10  * 2. Redistributions in binary form must reproduce the above copyright
  11  *    notice, this list of conditions and the following disclaimer in the
  12  *    documentation and/or other materials provided with the distribution.
  13  * 3. All advertising materials mentioning features or use of this software
  14  *    must display the following acknowledgement:
  15  *      This product includes software developed by the University of
  16  *      California, Berkeley and its contributors.
  17  * 4. Neither the name of the University nor the names of its contributors
  18  *    may be used to endorse or promote products derived from this software
  19  *    without specific prior written permission.
  20  *
  21  * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
  22  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  23  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  24  * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
  25  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  26  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  27  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  28  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  29  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  30  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  31  * SUCH DAMAGE.
  32  *
  33  *      @(#)kern_ktrace.c       8.2 (Berkeley) 9/23/93
  34  * $FreeBSD: src/sys/kern/kern_ktrace.c,v 1.35.2.6 2002/07/05 22:36:38 darrenr Exp $
  35  * $DragonFly: src/sys/kern/kern_ktrace.c,v 1.19 2005/07/28 18:10:23 dillon Exp $
  36  */
  37
  38 #include "opt_ktrace.h"
  39
  40 #include <sys/param.h>
  41 #include <sys/systm.h>
  42 #include <sys/sysproto.h>
  43 #include <sys/kernel.h>
  44 #include <sys/proc.h>
  45 #include <sys/fcntl.h>
  46 #include <sys/lock.h>
  47 #include <sys/nlookup.h>
  48 #include <sys/vnode.h>
  49 #include <sys/ktrace.h>
  50 #include <sys/malloc.h>
  51 #include <sys/syslog.h>
  52 #include <sys/sysent.h>
  53
  54 #include <vm/vm_zone.h>
  55 static MALLOC_DEFINE(M_KTRACE, "KTRACE", "KTRACE");
  56
  57 #ifdef KTRACE
  58 static struct ktr_header *ktrgetheader (int type);
  59 static void ktrwrite (struct vnode *, struct ktr_header *, struct uio *);
  60 static int ktrcanset (struct proc *,struct proc *);
  61 static int ktrsetchildren (struct proc *,struct proc *,int,int,struct vnode *);
  62 static int ktrops (struct proc *,struct proc *,int,int,struct vnode *);
  63
  64
  65 static struct ktr_header *
  66 ktrgetheader(int type)
  67 {
  68         struct ktr_header *kth;
  69         struct proc *p = curproc;       /* XXX */
  70
  71         MALLOC(kth, struct ktr_header *, sizeof (struct ktr_header),
  72                 M_KTRACE, M_WAITOK);
  73         kth->ktr_type = type;
  74         microtime(&kth->ktr_time);
  75         kth->ktr_pid = p->p_pid;
  76         bcopy(p->p_comm, kth->ktr_comm, MAXCOMLEN + 1);
  77         return (kth);
  78 }
  79
  80 void
  81 ktrsyscall(struct vnode *vp, int code, int narg, register_t args[])
  82 {
  83         struct  ktr_header *kth;
  84         struct  ktr_syscall *ktp;
  85         int len = offsetof(struct ktr_syscall, ktr_args) +
  86             (narg * sizeof(register_t));
  87         struct proc *p = curproc;       /* XXX */
  88         register_t *argp;
  89         int i;
  90
  91         p->p_traceflag |= KTRFAC_ACTIVE;
  92         kth = ktrgetheader(KTR_SYSCALL);
  93         MALLOC(ktp, struct ktr_syscall *, len, M_KTRACE, M_WAITOK);
  94         ktp->ktr_code = code;
  95         ktp->ktr_narg = narg;
  96         argp = &ktp->ktr_args[0];
  97         for (i = 0; i < narg; i++)
  98                 *argp++ = args[i];
  99         kth->ktr_buf = (caddr_t)ktp;
 100         kth->ktr_len = len;
 101         ktrwrite(vp, kth, NULL);
 102         FREE(ktp, M_KTRACE);
 103         FREE(kth, M_KTRACE);
 104         p->p_traceflag &= ~KTRFAC_ACTIVE;
 105 }
 106
 107 void
 108 ktrsysret(struct vnode *vp, int code, int error, register_t retval)
 109 {
 110         struct ktr_header *kth;
 111         struct ktr_sysret ktp;
 112         struct proc *p = curproc;       /* XXX */
 113
 114         p->p_traceflag |= KTRFAC_ACTIVE;
 115         kth = ktrgetheader(KTR_SYSRET);
 116         ktp.ktr_code = code;
 117         ktp.ktr_error = error;
 118         ktp.ktr_retval = retval;                /* what about val2 ? */
 119
 120         kth->ktr_buf = (caddr_t)&ktp;
 121         kth->ktr_len = sizeof(struct ktr_sysret);
 122
 123         ktrwrite(vp, kth, NULL);
 124         FREE(kth, M_KTRACE);
 125         p->p_traceflag &= ~KTRFAC_ACTIVE;
 126 }
 127
 128 void
 129 ktrnamei(struct vnode *vp, char *path)
 130 {
 131         struct ktr_header *kth;
 132         struct proc *p = curproc;       /* XXX */
 133
 134         /*
 135          * don't let vp get ripped out from under us
 136          */
 137         if (vp)
 138                 vref(vp);
 139         p->p_traceflag |= KTRFAC_ACTIVE;
 140         kth = ktrgetheader(KTR_NAMEI);
 141         kth->ktr_len = strlen(path);
 142         kth->ktr_buf = path;
 143
 144         ktrwrite(vp, kth, NULL);
 145         if (vp)
 146                 vrele(vp);
 147         FREE(kth, M_KTRACE);
 148         p->p_traceflag &= ~KTRFAC_ACTIVE;
 149 }
 150
 151 void
 152 ktrgenio(struct vnode *vp, int fd, enum uio_rw rw, struct uio *uio, int error)
 153 {
 154         struct ktr_header *kth;
 155         struct ktr_genio ktg;
 156         struct proc *p = curproc;       /* XXX */
 157
 158         if (error)
 159                 return;
 160         /*
 161          * don't let p_tracep get ripped out from under us
 162          */
 163         if (vp)
 164                 vref(vp);
 165         p->p_traceflag |= KTRFAC_ACTIVE;
 166         kth = ktrgetheader(KTR_GENIO);
 167         ktg.ktr_fd = fd;
 168         ktg.ktr_rw = rw;
 169         kth->ktr_buf = (caddr_t)&ktg;
 170         kth->ktr_len = sizeof(struct ktr_genio);
 171         uio->uio_offset = 0;
 172         uio->uio_rw = UIO_WRITE;
 173
 174         ktrwrite(vp, kth, uio);
 175         if (vp)
 176                 vrele(vp);
 177         FREE(kth, M_KTRACE);
 178         p->p_traceflag &= ~KTRFAC_ACTIVE;
 179 }
 180
 181 void
 182 ktrpsig(struct vnode *vp, int sig, sig_t action, sigset_t *mask, int code)
 183 {
 184         struct ktr_header *kth;
 185         struct ktr_psig kp;
 186         struct proc *p = curproc;       /* XXX */
 187
 188         /*
 189          * don't let vp get ripped out from under us
 190          */
 191         if (vp)
 192                 vref(vp);
 193         p->p_traceflag |= KTRFAC_ACTIVE;
 194         kth = ktrgetheader(KTR_PSIG);
 195         kp.signo = (char)sig;
 196         kp.action = action;
 197         kp.mask = *mask;
 198         kp.code = code;
 199         kth->ktr_buf = (caddr_t)&kp;
 200         kth->ktr_len = sizeof (struct ktr_psig);
 201
 202         ktrwrite(vp, kth, NULL);
 203         if (vp)
 204                 vrele(vp);
 205         FREE(kth, M_KTRACE);
 206         p->p_traceflag &= ~KTRFAC_ACTIVE;
 207 }
 208
 209 void
 210 ktrcsw(struct vnode *vp, int out, int user)
 211 {
 212         struct ktr_header *kth;
 213         struct  ktr_csw kc;
 214         struct proc *p = curproc;       /* XXX */
 215
 216         /*
 217          * don't let vp get ripped out from under us
 218          */
 219         if (vp)
 220                 vref(vp);
 221         p->p_traceflag |= KTRFAC_ACTIVE;
 222         kth = ktrgetheader(KTR_CSW);
 223         kc.out = out;
 224         kc.user = user;
 225         kth->ktr_buf = (caddr_t)&kc;
 226         kth->ktr_len = sizeof (struct ktr_csw);
 227
 228         ktrwrite(vp, kth, NULL);
 229         if (vp)
 230                 vrele(vp);
 231         FREE(kth, M_KTRACE);
 232         p->p_traceflag &= ~KTRFAC_ACTIVE;
 233 }
 234 #endif
 235
 236 /* Interface and common routines */
 237
 238 /*
 239  * ktrace system call
 240  */
 241 /* ARGSUSED */
 242 int
 243 ktrace(struct ktrace_args *uap)
 244 {
 245 #ifdef KTRACE
 246         struct thread *td = curthread;
 247         struct proc *curp = td->td_proc;
 248         struct vnode *vp = NULL;
 249         struct proc *p;
 250         struct pgrp *pg;
 251         int facs = uap->facs & ~KTRFAC_ROOT;
 252         int ops = KTROP(uap->ops);
 253         int descend = uap->ops & KTRFLAG_DESCEND;
 254         int ret = 0;
 255         int error = 0;
 256         struct nlookupdata nd;
 257
 258         curp->p_traceflag |= KTRFAC_ACTIVE;
 259         if (ops != KTROP_CLEAR) {
 260                 /*
 261                  * an operation which requires a file argument.
 262                  */
 263                 error = nlookup_init(&nd, uap->fname,
 264                                         UIO_USERSPACE, NLC_LOCKVP);
 265                 if (error == 0)
 266                         error = vn_open(&nd, NULL, FREAD|FWRITE|O_NOFOLLOW, 0);
 267                 if (error == 0 && nd.nl_open_vp->v_type != VREG)
 268                         error = EACCES;
 269                 if (error) {
 270                         curp->p_traceflag &= ~KTRFAC_ACTIVE;
 271                         nlookup_done(&nd);
 272                         return (error);
 273                 }
 274                 vp = nd.nl_open_vp;
 275                 nd.nl_open_vp = NULL;
 276                 nlookup_done(&nd);
 277                 VOP_UNLOCK(vp, 0, td);
 278         }
 279         /*
 280          * Clear all uses of the tracefile.  XXX umm, what happens to the
 281          * loop if vn_close() blocks?
 282          */
 283         if (ops == KTROP_CLEARFILE) {
 284                 FOREACH_PROC_IN_SYSTEM(p) {
 285                         if (p->p_tracep == vp) {
 286                                 if (ktrcanset(curp, p) && p->p_tracep == vp) {
 287                                         p->p_tracep = NULL;
 288                                         p->p_traceflag = 0;
 289                                         vn_close(vp, FREAD|FWRITE, td);
 290                                 } else {
 291                                         error = EPERM;
 292                                 }
 293                         }
 294                 }
 295                 goto done;
 296         }
 297         /*
 298          * need something to (un)trace (XXX - why is this here?)
 299          */
 300         if (!facs) {
 301                 error = EINVAL;
 302                 goto done;
 303         }
 304         /*
 305          * do it
 306          */
 307         if (uap->pid < 0) {
 308                 /*
 309                  * by process group
 310                  */
 311                 pg = pgfind(-uap->pid);
 312                 if (pg == NULL) {
 313                         error = ESRCH;
 314                         goto done;
 315                 }
 316                 LIST_FOREACH(p, &pg->pg_members, p_pglist) {
 317                         if (descend)
 318                                 ret |= ktrsetchildren(curp, p, ops, facs, vp);
 319                         else
 320                                 ret |= ktrops(curp, p, ops, facs, vp);
 321                 }
 322         } else {
 323                 /*
 324                  * by pid
 325                  */
 326                 p = pfind(uap->pid);
 327                 if (p == NULL) {
 328                         error = ESRCH;
 329                         goto done;
 330                 }
 331                 if (descend)
 332                         ret |= ktrsetchildren(curp, p, ops, facs, vp);
 333                 else
 334                         ret |= ktrops(curp, p, ops, facs, vp);
 335         }
 336         if (!ret)
 337                 error = EPERM;
 338 done:
 339         if (vp != NULL)
 340                 vn_close(vp, FWRITE, td);
 341         curp->p_traceflag &= ~KTRFAC_ACTIVE;
 342         return (error);
 343 #else
 344         return ENOSYS;
 345 #endif
 346 }
 347
 348 /*
 349  * utrace system call
 350  */
 351 /* ARGSUSED */
 352 int
 353 utrace(struct utrace_args *uap)
 354 {
 355 #ifdef KTRACE
 356         struct ktr_header *kth;
 357         struct thread *td = curthread;  /* XXX */
 358         struct proc *p = td->td_proc;
 359         struct vnode *vp;
 360         caddr_t cp;
 361
 362         if (!KTRPOINT(td, KTR_USER))
 363                 return (0);
 364         if (uap->len > KTR_USER_MAXLEN)
 365                 return (EINVAL);
 366         p->p_traceflag |= KTRFAC_ACTIVE;
 367         /*
 368          * don't let p_tracep get ripped out from under us while we are
 369          * writing.
 370          */
 371         if ((vp = p->p_tracep) != NULL)
 372                 vref(vp);
 373         kth = ktrgetheader(KTR_USER);
 374         MALLOC(cp, caddr_t, uap->len, M_KTRACE, M_WAITOK);
 375         if (!copyin(uap->addr, cp, uap->len)) {
 376                 kth->ktr_buf = cp;
 377                 kth->ktr_len = uap->len;
 378                 ktrwrite(vp, kth, NULL);
 379         }
 380         if (vp)
 381                 vrele(vp);
 382         FREE(kth, M_KTRACE);
 383         FREE(cp, M_KTRACE);
 384         p->p_traceflag &= ~KTRFAC_ACTIVE;
 385
 386         return (0);
 387 #else
 388         return (ENOSYS);
 389 #endif
 390 }
 391
 392 #ifdef KTRACE
 393 static int
 394 ktrops(struct proc *curp, struct proc *p, int ops, int facs, struct vnode *vp)
 395 {
 396
 397         if (!ktrcanset(curp, p))
 398                 return (0);
 399         if (ops == KTROP_SET) {
 400                 if (p->p_tracep != vp) {
 401                         struct vnode *vtmp;
 402
 403                         /*
 404                          * if trace file already in use, relinquish
 405                          */
 406                         vref(vp);
 407                         while ((vtmp = p->p_tracep) != NULL) {
 408                                 p->p_tracep = NULL;
 409                                 vrele(vtmp);
 410                         }
 411                         p->p_tracep = vp;
 412                 }
 413                 p->p_traceflag |= facs;
 414                 if (curp->p_ucred->cr_uid == 0)
 415                         p->p_traceflag |= KTRFAC_ROOT;
 416         } else {
 417                 /* KTROP_CLEAR */
 418                 if (((p->p_traceflag &= ~facs) & KTRFAC_MASK) == 0) {
 419                         struct vnode *vtmp;
 420
 421                         /* no more tracing */
 422                         p->p_traceflag = 0;
 423                         if ((vtmp = p->p_tracep) != NULL) {
 424                                 p->p_tracep = NULL;
 425                                 vrele(vtmp);
 426                         }
 427                 }
 428         }
 429
 430         return (1);
 431 }
 432
 433 static int
 434 ktrsetchildren(struct proc *curp, struct proc *top, int ops, int facs,
 435                struct vnode *vp)
 436 {
 437         struct proc *p;
 438         int ret = 0;
 439
 440         p = top;
 441         for (;;) {
 442                 ret |= ktrops(curp, p, ops, facs, vp);
 443                 /*
 444                  * If this process has children, descend to them next,
 445                  * otherwise do any siblings, and if done with this level,
 446                  * follow back up the tree (but not past top).
 447                  */
 448                 if (!LIST_EMPTY(&p->p_children))
 449                         p = LIST_FIRST(&p->p_children);
 450                 else for (;;) {
 451                         if (p == top)
 452                                 return (ret);
 453                         if (LIST_NEXT(p, p_sibling)) {
 454                                 p = LIST_NEXT(p, p_sibling);
 455                                 break;
 456                         }
 457                         p = p->p_pptr;
 458                 }
 459         }
 460         /*NOTREACHED*/
 461 }
 462
 463 static void
 464 ktrwrite(struct vnode *vp, struct ktr_header *kth, struct uio *uio)
 465 {
 466         struct uio auio;
 467         struct iovec aiov[2];
 468         struct thread *td = curthread;
 469         struct proc *p = td->td_proc;   /* XXX */
 470         int error;
 471
 472         /*
 473          * Since multiple processes may be trying to ktrace, we must vref
 474          * the vnode to prevent it from being ripped out from under us in
 475          * case another process gets a write error while ktracing and removes
 476          * the reference from the proc.
 477          */
 478         if (vp == NULL)
 479                 return;
 480         vref(vp);
 481         auio.uio_iov = &aiov[0];
 482         auio.uio_offset = 0;
 483         auio.uio_segflg = UIO_SYSSPACE;
 484         auio.uio_rw = UIO_WRITE;
 485         aiov[0].iov_base = (caddr_t)kth;
 486         aiov[0].iov_len = sizeof(struct ktr_header);
 487         auio.uio_resid = sizeof(struct ktr_header);
 488         auio.uio_iovcnt = 1;
 489         auio.uio_td = curthread;
 490         if (kth->ktr_len > 0) {
 491                 auio.uio_iovcnt++;
 492                 aiov[1].iov_base = kth->ktr_buf;
 493                 aiov[1].iov_len = kth->ktr_len;
 494                 auio.uio_resid += kth->ktr_len;
 495                 if (uio != NULL)
 496                         kth->ktr_len += uio->uio_resid;
 497         }
 498         VOP_LEASE(vp, td, p->p_ucred, LEASE_WRITE);
 499         vn_lock(vp, LK_EXCLUSIVE | LK_RETRY, td);
 500         error = VOP_WRITE(vp, &auio, IO_UNIT | IO_APPEND, p->p_ucred);
 501         if (error == 0 && uio != NULL) {
 502                 VOP_LEASE(vp, td, p->p_ucred, LEASE_WRITE);
 503                 error = VOP_WRITE(vp, uio, IO_UNIT | IO_APPEND, p->p_ucred);
 504         }
 505         VOP_UNLOCK(vp, 0, td);
 506         vrele(vp);
 507         if (!error)
 508                 return;
 509         /*
 510          * If error encountered, give up tracing on this vnode.  XXX what
 511          * happens to the loop if vrele() blocks?
 512          */
 513         log(LOG_NOTICE, "ktrace write failed, errno %d, tracing stopped\n",
 514             error);
 515         FOREACH_PROC_IN_SYSTEM(p) {
 516                 if (p->p_tracep == vp) {
 517                         p->p_tracep = NULL;
 518                         p->p_traceflag = 0;
 519                         vrele(vp);
 520                 }
 521         }
 522 }
 523
 524 /*
 525  * Return true if caller has permission to set the ktracing state
 526  * of target.  Essentially, the target can't possess any
 527  * more permissions than the caller.  KTRFAC_ROOT signifies that
 528  * root previously set the tracing status on the target process, and
 529  * so, only root may further change it.
 530  *
 531  * TODO: check groups.  use caller effective gid.
 532  */
 533 static int
 534 ktrcanset(struct proc *callp, struct proc *targetp)
 535 {
 536         struct ucred *caller = callp->p_ucred;
 537         struct ucred *target = targetp->p_ucred;
 538
 539         if (!PRISON_CHECK(caller, target))
 540                 return (0);
 541         if ((caller->cr_uid == target->cr_ruid &&
 542              target->cr_ruid == target->cr_svuid &&
 543              caller->cr_rgid == target->cr_rgid &&      /* XXX */
 544              target->cr_rgid == target->cr_svgid &&
 545              (targetp->p_traceflag & KTRFAC_ROOT) == 0 &&
 546              (targetp->p_flag & P_SUGID) == 0) ||
 547              caller->cr_uid == 0)
 548                 return (1);
 549
 550         return (0);
 551 }
 552
 553 #endif /* KTRACE */