2 * SPDX-License-Identifier: BSD-2-Clause-FreeBSD
4 * Copyright (c) 2011, David E. O'Brien.
5 * Copyright (c) 2009-2011, Juniper Networks, Inc.
6 * Copyright (c) 2015-2016, EMC Corp.
9 * Redistribution and use in source and binary forms, with or without
10 * modification, are permitted provided that the following conditions
12 * 1. Redistributions of source code must retain the above copyright
13 * notice, this list of conditions and the following disclaimer.
14 * 2. Redistributions in binary form must reproduce the above copyright
15 * notice, this list of conditions and the following disclaimer in the
16 * documentation and/or other materials provided with the distribution.
18 * THIS SOFTWARE IS PROVIDED BY JUNIPER NETWORKS AND CONTRIBUTORS ``AS IS'' AND
19 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
20 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
21 * ARE DISCLAIMED. IN NO EVENT SHALL JUNIPER NETWORKS OR CONTRIBUTORS BE LIABLE
22 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
23 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
24 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
25 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
26 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
27 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
31 #include <sys/cdefs.h>
32 __FBSDID("$FreeBSD$");
34 #include <sys/param.h>
36 #include <sys/systm.h>
38 #include <sys/capsicum.h>
39 #include <sys/condvar.h>
41 #include <sys/fcntl.h>
42 #include <sys/ioccom.h>
43 #include <sys/kernel.h>
45 #include <sys/malloc.h>
46 #include <sys/module.h>
50 #include <sys/syscall.h>
51 #include <sys/sysent.h>
52 #include <sys/sysproto.h>
57 #if defined(COMPAT_FREEBSD32)
58 #include <compat/freebsd32/freebsd32_syscall.h>
59 #include <compat/freebsd32/freebsd32_proto.h>
60 #include <compat/freebsd32/freebsd32_util.h>
63 static d_close_t filemon_close;
64 static d_ioctl_t filemon_ioctl;
65 static d_open_t filemon_open;
67 static struct cdevsw filemon_cdevsw = {
68 .d_version = D_VERSION,
69 .d_close = filemon_close,
70 .d_ioctl = filemon_ioctl,
71 .d_open = filemon_open,
75 MALLOC_DECLARE(M_FILEMON);
76 MALLOC_DEFINE(M_FILEMON, "filemon", "File access monitor");
79 * The filemon->lock protects several things currently:
80 * - fname1/fname2/msgbufr are pre-allocated and used per syscall
81 * for logging and copyins rather than stack variables.
82 * - Serializing the filemon's log output.
83 * - Preventing inheritance or removal of the filemon into proc.p_filemon.
86 struct sx lock; /* Lock for this filemon. */
87 struct file *fp; /* Output file pointer. */
88 struct ucred *cred; /* Credential of tracer. */
89 char fname1[MAXPATHLEN]; /* Temporary filename buffer. */
90 char fname2[MAXPATHLEN]; /* Temporary filename buffer. */
91 char msgbufr[2*MAXPATHLEN + 100]; /* Output message buffer. */
92 int error; /* Log write error, returned on close(2). */
93 u_int refcnt; /* Pointer reference count. */
94 u_int proccnt; /* Process count. */
97 static struct cdev *filemon_dev;
98 static void filemon_output(struct filemon *filemon, char *msg, size_t len);
100 static __inline struct filemon *
101 filemon_acquire(struct filemon *filemon)
105 refcount_acquire(&filemon->refcnt);
110 * Release a reference and free on the last one.
113 filemon_release(struct filemon *filemon)
116 if (refcount_release(&filemon->refcnt) == 0)
119 * There are valid cases of releasing while locked, such as in
120 * filemon_untrack_processes, but none which are done where there
121 * is not at least 1 reference remaining.
123 sx_assert(&filemon->lock, SA_UNLOCKED);
125 if (filemon->cred != NULL)
126 crfree(filemon->cred);
127 sx_destroy(&filemon->lock);
128 free(filemon, M_FILEMON);
132 * Acquire the proc's p_filemon reference and lock the filemon.
133 * The proc's p_filemon may not match this filemon on return.
135 static struct filemon *
136 filemon_proc_get(struct proc *p)
138 struct filemon *filemon;
140 if (p->p_filemon == NULL)
143 filemon = filemon_acquire(p->p_filemon);
149 * The p->p_filemon may have changed by now. That case is handled
150 * by the exit and fork hooks and filemon_attach_proc specially.
152 sx_xlock(&filemon->lock);
156 /* Remove and release the filemon on the given process. */
158 filemon_proc_drop(struct proc *p)
160 struct filemon *filemon;
162 KASSERT(p->p_filemon != NULL, ("%s: proc %p NULL p_filemon",
164 sx_assert(&p->p_filemon->lock, SA_XLOCKED);
166 filemon = p->p_filemon;
171 * This should not be the last reference yet. filemon_release()
172 * cannot be called with filemon locked, which the caller expects
175 KASSERT(filemon->refcnt > 1, ("%s: proc %p dropping filemon %p "
176 "with last reference", __func__, p, filemon));
177 filemon_release(filemon);
180 /* Unlock and release the filemon. */
182 filemon_drop(struct filemon *filemon)
185 sx_xunlock(&filemon->lock);
186 filemon_release(filemon);
189 #include "filemon_wrapper.c"
192 filemon_write_header(struct filemon *filemon)
199 len = snprintf(filemon->msgbufr, sizeof(filemon->msgbufr),
200 "# filemon version %d\n# Target pid %d\n# Start %ju.%06ju\nV %d\n",
201 FILEMON_VERSION, curproc->p_pid, (uintmax_t)now.tv_sec,
202 (uintmax_t)now.tv_usec, FILEMON_VERSION);
203 if (len < sizeof(filemon->msgbufr))
204 filemon_output(filemon, filemon->msgbufr, len);
208 * Invalidate the passed filemon in all processes.
211 filemon_untrack_processes(struct filemon *filemon)
215 sx_assert(&filemon->lock, SA_XLOCKED);
217 /* Avoid allproc loop if there is no need. */
218 if (filemon->proccnt == 0)
222 * Processes in this list won't go away while here since
223 * filemon_event_process_exit() will lock on filemon->lock
226 sx_slock(&allproc_lock);
227 FOREACH_PROC_IN_SYSTEM(p) {
229 * No PROC_LOCK is needed to compare here since it is
230 * guaranteed to not change since we have its filemon
231 * locked. Everything that changes this p_filemon will
234 if (p->p_filemon == filemon)
235 filemon_proc_drop(p);
237 sx_sunlock(&allproc_lock);
240 * It's possible some references were acquired but will be
241 * dropped shortly as they are restricted from being
242 * inherited. There is at least the reference in cdevpriv remaining.
244 KASSERT(filemon->refcnt > 0, ("%s: filemon %p should have "
245 "references still.", __func__, filemon));
246 KASSERT(filemon->proccnt == 0, ("%s: filemon %p should not have "
247 "attached procs still.", __func__, filemon));
254 filemon_close_log(struct filemon *filemon)
260 sx_assert(&filemon->lock, SA_XLOCKED);
261 if (filemon->fp == NULL)
266 len = snprintf(filemon->msgbufr,
267 sizeof(filemon->msgbufr),
268 "# Stop %ju.%06ju\n# Bye bye\n",
269 (uintmax_t)now.tv_sec, (uintmax_t)now.tv_usec);
271 if (len < sizeof(filemon->msgbufr))
272 filemon_output(filemon, filemon->msgbufr, len);
276 sx_xunlock(&filemon->lock);
277 fdrop(fp, curthread);
278 sx_xlock(&filemon->lock);
282 * The devfs file is being closed. Untrace all processes. It is possible
283 * filemon_close/close(2) was not called.
286 filemon_dtr(void *data)
288 struct filemon *filemon = data;
293 sx_xlock(&filemon->lock);
295 * Detach the filemon. It cannot be inherited after this.
297 filemon_untrack_processes(filemon);
298 filemon_close_log(filemon);
299 filemon_drop(filemon);
302 /* Attach the filemon to the process. */
304 filemon_attach_proc(struct filemon *filemon, struct proc *p)
306 struct filemon *filemon2;
308 sx_assert(&filemon->lock, SA_XLOCKED);
309 PROC_LOCK_ASSERT(p, MA_OWNED);
310 KASSERT((p->p_flag & P_WEXIT) == 0,
311 ("%s: filemon %p attaching to exiting process %p",
312 __func__, filemon, p));
313 KASSERT((p->p_flag & P_INEXEC) == 0,
314 ("%s: filemon %p attaching to execing process %p",
315 __func__, filemon, p));
317 if (p->p_filemon == filemon)
320 * Don't allow truncating other process traces. It is
321 * not really intended to trace procs other than curproc
324 if (p->p_filemon != NULL && p != curproc)
327 * Historic behavior of filemon has been to let a child initiate
328 * tracing on itself and cease existing tracing. Bmake
329 * .META + .MAKE relies on this. It is only relevant for attaching to
332 while (p->p_filemon != NULL) {
334 sx_xunlock(&filemon->lock);
335 while ((filemon2 = filemon_proc_get(p)) != NULL) {
336 /* It may have changed. */
337 if (p->p_filemon == filemon2)
338 filemon_proc_drop(p);
339 filemon_drop(filemon2);
341 sx_xlock(&filemon->lock);
344 * It may have been attached to, though unlikely.
345 * Try again if needed.
349 KASSERT(p->p_filemon == NULL,
350 ("%s: proc %p didn't detach filemon %p", __func__, p,
352 p->p_filemon = filemon_acquire(filemon);
359 filemon_ioctl(struct cdev *dev, u_long cmd, caddr_t data, int flag __unused,
363 struct filemon *filemon;
366 if ((error = devfs_get_cdevpriv((void **) &filemon)) != 0)
369 sx_xlock(&filemon->lock);
372 /* Set the output file descriptor. */
374 if (filemon->fp != NULL) {
379 error = fget_write(td, *(int *)data,
383 /* Write the file header. */
384 filemon_write_header(filemon);
387 /* Set the monitored process ID. */
388 case FILEMON_SET_PID:
389 /* Invalidate any existing processes already set. */
390 filemon_untrack_processes(filemon);
392 error = pget(*((pid_t *)data),
393 PGET_CANDEBUG | PGET_NOTWEXIT | PGET_NOTINEXEC, &p);
395 KASSERT(p->p_filemon != filemon,
396 ("%s: proc %p didn't untrack filemon %p",
397 __func__, p, filemon));
398 error = filemon_attach_proc(filemon, p);
408 sx_xunlock(&filemon->lock);
413 filemon_open(struct cdev *dev, int oflags __unused, int devtype __unused,
417 struct filemon *filemon;
419 filemon = malloc(sizeof(*filemon), M_FILEMON,
421 sx_init(&filemon->lock, "filemon");
422 refcount_init(&filemon->refcnt, 1);
423 filemon->cred = crhold(td->td_ucred);
425 error = devfs_set_cdevpriv(filemon, filemon_dtr);
427 filemon_release(filemon);
432 /* Called on close of last devfs file handle, before filemon_dtr(). */
434 filemon_close(struct cdev *dev __unused, int flag __unused, int fmt __unused,
435 struct thread *td __unused)
437 struct filemon *filemon;
440 if ((error = devfs_get_cdevpriv((void **) &filemon)) != 0)
443 sx_xlock(&filemon->lock);
444 filemon_close_log(filemon);
445 error = filemon->error;
446 sx_xunlock(&filemon->lock);
448 * Processes are still being traced but won't log anything
449 * now. After this call returns filemon_dtr() is called which
450 * will detach processes.
457 filemon_load(void *dummy __unused)
460 /* Install the syscall wrappers. */
461 filemon_wrapper_install();
463 filemon_dev = make_dev(&filemon_cdevsw, 0, UID_ROOT, GID_WHEEL, 0666,
471 destroy_dev(filemon_dev);
472 filemon_wrapper_deinstall();
478 filemon_modevent(module_t mod __unused, int type, void *data)
488 error = filemon_unload();
493 * The wrapper implementation is unsafe for reliable unload.
494 * Require forcing an unload.
511 DEV_MODULE(filemon, filemon_modevent, NULL);
512 MODULE_VERSION(filemon, 1);