1 /* 2 * Copyright (c) 1989 The Regents of the University of California. 3 * All rights reserved. 4 * 5 * %sccs.include.redist.c% 6 * 7 * @(#)kern_ktrace.c 7.13 (Berkeley) 04/15/91 8 */ 9 10 #ifdef KTRACE 11 12 #include "param.h" 13 #include "proc.h" 14 #include "file.h" 15 #include "namei.h" 16 #include "vnode.h" 17 #include "ktrace.h" 18 #include "malloc.h" 19 #include "syslog.h" 20 21 struct ktr_header * 22 ktrgetheader(type) 23 { 24 register struct ktr_header *kth; 25 struct proc *p = curproc; /* XXX */ 26 27 MALLOC(kth, struct ktr_header *, sizeof (struct ktr_header), 28 M_TEMP, M_WAITOK); 29 kth->ktr_type = type; 30 microtime(&kth->ktr_time); 31 kth->ktr_pid = p->p_pid; 32 bcopy(p->p_comm, kth->ktr_comm, MAXCOMLEN); 33 return (kth); 34 } 35 36 ktrsyscall(vp, code, narg, args) 37 struct vnode *vp; 38 int code, narg, args[]; 39 { 40 struct ktr_header *kth = ktrgetheader(KTR_SYSCALL); 41 struct ktr_syscall *ktp; 42 register len = sizeof(struct ktr_syscall) + (narg * sizeof(int)); 43 int *argp, i; 44 45 MALLOC(ktp, struct ktr_syscall *, len, M_TEMP, M_WAITOK); 46 ktp->ktr_code = code; 47 ktp->ktr_narg = narg; 48 argp = (int *)((char *)ktp + sizeof(struct ktr_syscall)); 49 for (i = 0; i < narg; i++) 50 *argp++ = args[i]; 51 kth->ktr_buf = (caddr_t)ktp; 52 kth->ktr_len = len; 53 ktrwrite(vp, kth); 54 FREE(ktp, M_TEMP); 55 FREE(kth, M_TEMP); 56 } 57 58 ktrsysret(vp, code, error, retval) 59 struct vnode *vp; 60 int code, error, retval; 61 { 62 struct ktr_header *kth = ktrgetheader(KTR_SYSRET); 63 struct ktr_sysret ktp; 64 65 ktp.ktr_code = code; 66 ktp.ktr_error = error; 67 ktp.ktr_retval = retval; /* what about val2 ? */ 68 69 kth->ktr_buf = (caddr_t)&ktp; 70 kth->ktr_len = sizeof(struct ktr_sysret); 71 72 ktrwrite(vp, kth); 73 FREE(kth, M_TEMP); 74 } 75 76 ktrnamei(vp, path) 77 struct vnode *vp; 78 char *path; 79 { 80 struct ktr_header *kth = ktrgetheader(KTR_NAMEI); 81 82 kth->ktr_len = strlen(path); 83 kth->ktr_buf = path; 84 85 ktrwrite(vp, kth); 86 FREE(kth, M_TEMP); 87 } 88 89 ktrgenio(vp, fd, rw, iov, len, error) 90 struct vnode *vp; 91 int fd; 92 enum uio_rw rw; 93 register struct iovec *iov; 94 { 95 struct ktr_header *kth = ktrgetheader(KTR_GENIO); 96 register struct ktr_genio *ktp; 97 register caddr_t cp; 98 register int resid = len, cnt; 99 100 if (error) 101 return; 102 MALLOC(ktp, struct ktr_genio *, sizeof(struct ktr_genio) + len, 103 M_TEMP, M_WAITOK); 104 ktp->ktr_fd = fd; 105 ktp->ktr_rw = rw; 106 cp = (caddr_t)((char *)ktp + sizeof (struct ktr_genio)); 107 while (resid > 0) { 108 if ((cnt = iov->iov_len) > resid) 109 cnt = resid; 110 if (copyin(iov->iov_base, cp, (unsigned)cnt)) 111 goto done; 112 cp += cnt; 113 resid -= cnt; 114 iov++; 115 } 116 kth->ktr_buf = (caddr_t)ktp; 117 kth->ktr_len = sizeof (struct ktr_genio) + len; 118 119 ktrwrite(vp, kth); 120 done: 121 FREE(kth, M_TEMP); 122 FREE(ktp, M_TEMP); 123 } 124 125 ktrpsig(vp, sig, action, mask, code) 126 struct vnode *vp; 127 sig_t action; 128 { 129 struct ktr_header *kth = ktrgetheader(KTR_PSIG); 130 struct ktr_psig kp; 131 132 kp.signo = (char)sig; 133 kp.action = action; 134 kp.mask = mask; 135 kp.code = code; 136 kth->ktr_buf = (caddr_t)&kp; 137 kth->ktr_len = sizeof (struct ktr_psig); 138 139 ktrwrite(vp, kth); 140 FREE(kth, M_TEMP); 141 } 142 143 /* Interface and common routines */ 144 145 /* 146 * ktrace system call 147 */ 148 /* ARGSUSED */ 149 ktrace(curp, uap, retval) 150 struct proc *curp; 151 register struct args { 152 char *fname; 153 int ops; 154 int facs; 155 int pid; 156 } *uap; 157 int *retval; 158 { 159 register struct vnode *vp = NULL; 160 register struct proc *p; 161 struct pgrp *pg; 162 int facs = uap->facs & ~KTRFAC_ROOT; 163 int ops = KTROP(uap->ops); 164 int descend = uap->ops & KTRFLAG_DESCEND; 165 int ret = 0; 166 int error = 0; 167 struct nameidata nd; 168 169 if (ops != KTROP_CLEAR) { 170 /* 171 * an operation which requires a file argument. 172 */ 173 nd.ni_segflg = UIO_USERSPACE; 174 nd.ni_dirp = uap->fname; 175 if (error = vn_open(&nd, curp, FREAD|FWRITE, 0)) 176 return (error); 177 vp = nd.ni_vp; 178 if (vp->v_type != VREG) { 179 vrele(vp); 180 return (EACCES); 181 } 182 } 183 /* 184 * Clear all uses of the tracefile 185 */ 186 if (ops == KTROP_CLEARFILE) { 187 for (p = allproc; p != NULL; p = p->p_nxt) { 188 if (p->p_tracep == vp) { 189 if (ktrcanset(curp, p)) { 190 p->p_tracep = NULL; 191 p->p_traceflag = 0; 192 vrele(vp); 193 } else 194 error = EPERM; 195 } 196 } 197 goto done; 198 } 199 /* 200 * need something to (un)trace (XXX - why is this here?) 201 */ 202 if (!facs) { 203 error = EINVAL; 204 goto done; 205 } 206 /* 207 * do it 208 */ 209 if (uap->pid < 0) { 210 /* 211 * by process group 212 */ 213 pg = pgfind(-uap->pid); 214 if (pg == NULL) { 215 error = ESRCH; 216 goto done; 217 } 218 for (p = pg->pg_mem; p != NULL; p = p->p_pgrpnxt) 219 if (descend) 220 ret |= ktrsetchildren(curp, p, ops, facs, vp); 221 else 222 ret |= ktrops(curp, p, ops, facs, vp); 223 224 } else { 225 /* 226 * by pid 227 */ 228 p = pfind(uap->pid); 229 if (p == NULL) { 230 error = ESRCH; 231 goto done; 232 } 233 if (descend) 234 ret |= ktrsetchildren(curp, p, ops, facs, vp); 235 else 236 ret |= ktrops(curp, p, ops, facs, vp); 237 } 238 if (!ret) 239 error = EPERM; 240 done: 241 if (vp != NULL) 242 vrele(vp); 243 return (error); 244 } 245 246 ktrops(curp, p, ops, facs, vp) 247 struct proc *curp, *p; 248 struct vnode *vp; 249 { 250 251 if (!ktrcanset(curp, p)) 252 return (0); 253 if (ops == KTROP_SET) { 254 if (p->p_tracep != vp) { 255 /* 256 * if trace file already in use, relinquish 257 */ 258 if (p->p_tracep != NULL) 259 vrele(p->p_tracep); 260 VREF(vp); 261 p->p_tracep = vp; 262 } 263 p->p_traceflag |= facs; 264 if (curp->p_ucred->cr_uid == 0) 265 p->p_traceflag |= KTRFAC_ROOT; 266 } else { 267 /* KTROP_CLEAR */ 268 if (((p->p_traceflag &= ~facs) & KTRFAC_MASK) == 0) { 269 /* no more tracing */ 270 p->p_traceflag = 0; 271 if (p->p_tracep != NULL) { 272 vrele(p->p_tracep); 273 p->p_tracep = NULL; 274 } 275 } 276 } 277 278 return (1); 279 } 280 281 ktrsetchildren(curp, top, ops, facs, vp) 282 struct proc *curp, *top; 283 struct vnode *vp; 284 { 285 register struct proc *p; 286 register int ret = 0; 287 288 p = top; 289 for (;;) { 290 ret |= ktrops(curp, p, ops, facs, vp); 291 /* 292 * If this process has children, descend to them next, 293 * otherwise do any siblings, and if done with this level, 294 * follow back up the tree (but not past top). 295 */ 296 if (p->p_cptr) 297 p = p->p_cptr; 298 else if (p == top) 299 return (ret); 300 else if (p->p_osptr) 301 p = p->p_osptr; 302 else for (;;) { 303 p = p->p_pptr; 304 if (p == top) 305 return (ret); 306 if (p->p_osptr) { 307 p = p->p_osptr; 308 break; 309 } 310 } 311 } 312 /*NOTREACHED*/ 313 } 314 315 ktrwrite(vp, kth) 316 struct vnode *vp; 317 register struct ktr_header *kth; 318 { 319 struct uio auio; 320 struct iovec aiov[2]; 321 register struct proc *p = curproc; /* XXX */ 322 int error; 323 324 if (vp == NULL) 325 return; 326 auio.uio_iov = &aiov[0]; 327 auio.uio_offset = 0; 328 auio.uio_segflg = UIO_SYSSPACE; 329 auio.uio_rw = UIO_WRITE; 330 aiov[0].iov_base = (caddr_t)kth; 331 aiov[0].iov_len = sizeof(struct ktr_header); 332 auio.uio_resid = sizeof(struct ktr_header); 333 auio.uio_iovcnt = 1; 334 auio.uio_procp = (struct proc *)0; 335 if (kth->ktr_len > 0) { 336 auio.uio_iovcnt++; 337 aiov[1].iov_base = kth->ktr_buf; 338 aiov[1].iov_len = kth->ktr_len; 339 auio.uio_resid += kth->ktr_len; 340 } 341 VOP_LOCK(vp); 342 error = VOP_WRITE(vp, &auio, IO_UNIT|IO_APPEND, p->p_ucred); 343 VOP_UNLOCK(vp); 344 if (!error) 345 return; 346 /* 347 * If error encountered, give up tracing on this vnode. 348 */ 349 log(LOG_NOTICE, "ktrace write failed, errno %d, tracing stopped\n", 350 error); 351 for (p = allproc; p != NULL; p = p->p_nxt) { 352 if (p->p_tracep == vp) { 353 p->p_tracep = NULL; 354 p->p_traceflag = 0; 355 vrele(vp); 356 } 357 } 358 } 359 360 /* 361 * Return true if caller has permission to set the ktracing state 362 * of target. Essentially, the target can't possess any 363 * more permissions than the caller. KTRFAC_ROOT signifies that 364 * root previously set the tracing status on the target process, and 365 * so, only root may further change it. 366 * 367 * TODO: check groups. use caller effective gid. 368 */ 369 ktrcanset(callp, targetp) 370 struct proc *callp, *targetp; 371 { 372 register struct pcred *caller = callp->p_cred; 373 register struct pcred *target = targetp->p_cred; 374 375 if ((caller->pc_ucred->cr_uid == target->p_ruid && 376 target->p_ruid == target->p_svuid && 377 caller->p_rgid == target->p_rgid && /* XXX */ 378 target->p_rgid == target->p_svgid && 379 (targetp->p_traceflag & KTRFAC_ROOT) == 0) || 380 caller->pc_ucred->cr_uid == 0) 381 return (1); 382 383 return (0); 384 } 385 386 #endif 387