sys/dev/filemon/filemon_wrapper.c

   1 /*-
   2  * Copyright (c) 2011, David E. O'Brien.
   3  * Copyright (c) 2009-2011, Juniper Networks, Inc.
   4  * All rights reserved.
   5  *
   6  * Redistribution and use in source and binary forms, with or without
   7  * modification, are permitted provided that the following conditions
   8  * are met:
   9  * 1. Redistributions of source code must retain the above copyright
  10  *    notice, this list of conditions and the following disclaimer.
  11  * 2. Redistributions in binary form must reproduce the above copyright
  12  *    notice, this list of conditions and the following disclaimer in the
  13  *    documentation and/or other materials provided with the distribution.
  14  *
  15  * THIS SOFTWARE IS PROVIDED BY JUNIPER NETWORKS AND CONTRIBUTORS ``AS IS'' AND
  16  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  17  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  18  * ARE DISCLAIMED. IN NO EVENT SHALL JUNIPER NETWORKS OR CONTRIBUTORS BE LIABLE
  19  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  20  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  21  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  22  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  23  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  24  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  25  * SUCH DAMAGE.
  26  */
  27
  28 #include <sys/cdefs.h>
  29 __FBSDID("$FreeBSD$");
  30
  31 #if __FreeBSD_version > 800032
  32 #define FILEMON_HAS_LINKAT
  33 #endif
  34
  35 #if __FreeBSD_version < 900044  /* r225617 (2011-09-16) failed to bump
  36                                    __FreeBSD_version.  This really should
  37                                    be based on "900045".  "900044" is r225469
  38                                    (2011-09-10) so this code is broken for
  39                                    9-CURRENT September 10th-16th. */
  40 #define sys_chdir       chdir
  41 #define sys_execve      execve
  42 #define sys_fork        fork
  43 #define sys_link        link
  44 #define sys_open        open
  45 #define sys_rename      rename
  46 #define sys_stat        stat
  47 #define sys_symlink     symlink
  48 #define sys_unlink      unlink
  49 #define sys_vfork       vfork
  50 #define sys_sys_exit    sys_exit
  51 #ifdef FILEMON_HAS_LINKAT
  52 #define sys_linkat      linkat
  53 #endif
  54 #endif  /* __FreeBSD_version */
  55
  56 static void
  57 filemon_output(struct filemon *filemon, char *msg, size_t len)
  58 {
  59         struct uio auio;
  60         struct iovec aiov;
  61
  62         if (filemon->fp == NULL)
  63                 return;
  64
  65         aiov.iov_base = msg;
  66         aiov.iov_len = len;
  67         auio.uio_iov = &aiov;
  68         auio.uio_iovcnt = 1;
  69         auio.uio_resid = len;
  70         auio.uio_segflg = UIO_SYSSPACE;
  71         auio.uio_rw = UIO_WRITE;
  72         auio.uio_td = curthread;
  73         auio.uio_offset = (off_t) -1;
  74
  75         bwillwrite();
  76
  77         fo_write(filemon->fp, &auio, curthread->td_ucred, 0, curthread);
  78 }
  79
  80 static struct filemon *
  81 filemon_pid_check(struct proc *p)
  82 {
  83         struct filemon *filemon;
  84
  85         TAILQ_FOREACH(filemon, &filemons_inuse, link) {
  86                 if (p->p_pid == filemon->pid)
  87                         return (filemon);
  88         }
  89
  90         if (p->p_pptr == NULL)
  91                 return (NULL);
  92
  93         return (filemon_pid_check(p->p_pptr));
  94 }
  95
  96 static void
  97 filemon_comment(struct filemon *filemon)
  98 {
  99         int len;
 100         struct timeval now;
 101
 102         /* Load timestamp before locking.  Less accurate but less contention. */
 103         getmicrotime(&now);
 104
 105         /* Grab a read lock on the filemon inuse list. */
 106         filemon_lock_read();
 107
 108         /* Lock the found filemon structure. */
 109         filemon_filemon_lock(filemon);
 110
 111         len = snprintf(filemon->msgbufr, sizeof(filemon->msgbufr),
 112             "# filemon version %d\n# Target pid %d\n# Start %ju.%06ju\nV %d\n",
 113             FILEMON_VERSION, curproc->p_pid, (uintmax_t)now.tv_sec,
 114             (uintmax_t)now.tv_usec, FILEMON_VERSION);
 115
 116         filemon_output(filemon, filemon->msgbufr, len);
 117
 118         /* Unlock the found filemon structure. */
 119         filemon_filemon_unlock(filemon);
 120
 121         /* Release the read lock. */
 122         filemon_unlock_read();
 123 }
 124
 125 static int
 126 filemon_wrapper_chdir(struct thread *td, struct chdir_args *uap)
 127 {
 128         int ret;
 129         size_t done;
 130         size_t len;
 131         struct filemon *filemon;
 132
 133         if ((ret = sys_chdir(td, uap)) == 0) {
 134                 /* Grab a read lock on the filemon inuse list. */
 135                 filemon_lock_read();
 136
 137                 if ((filemon = filemon_pid_check(curproc)) != NULL) {
 138                         /* Lock the found filemon structure. */
 139                         filemon_filemon_lock(filemon);
 140
 141                         copyinstr(uap->path, filemon->fname1,
 142                             sizeof(filemon->fname1), &done);
 143
 144                         len = snprintf(filemon->msgbufr,
 145                             sizeof(filemon->msgbufr), "C %d %s\n",
 146                             curproc->p_pid, filemon->fname1);
 147
 148                         filemon_output(filemon, filemon->msgbufr, len);
 149
 150                         /* Unlock the found filemon structure. */
 151                         filemon_filemon_unlock(filemon);
 152                 }
 153
 154                 /* Release the read lock. */
 155                 filemon_unlock_read();
 156         }
 157
 158         return (ret);
 159 }
 160
 161 static int
 162 filemon_wrapper_execve(struct thread *td, struct execve_args *uap)
 163 {
 164         char fname[MAXPATHLEN];
 165         int ret;
 166         size_t done;
 167         size_t len;
 168         struct filemon *filemon;
 169
 170         copyinstr(uap->fname, fname, sizeof(fname), &done);
 171
 172         if ((ret = sys_execve(td, uap)) == 0) {
 173                 /* Grab a read lock on the filemon inuse list. */
 174                 filemon_lock_read();
 175
 176                 if ((filemon = filemon_pid_check(curproc)) != NULL) {
 177                         /* Lock the found filemon structure. */
 178                         filemon_filemon_lock(filemon);
 179
 180                         len = snprintf(filemon->msgbufr,
 181                             sizeof(filemon->msgbufr), "E %d %s\n",
 182                             curproc->p_pid, fname);
 183
 184                         filemon_output(filemon, filemon->msgbufr, len);
 185
 186                         /* Unlock the found filemon structure. */
 187                         filemon_filemon_unlock(filemon);
 188                 }
 189
 190                 /* Release the read lock. */
 191                 filemon_unlock_read();
 192         }
 193
 194         return (ret);
 195 }
 196
 197 #if defined(COMPAT_IA32) || defined(COMPAT_FREEBSD32) || defined(COMPAT_ARCH32)
 198 static int
 199 filemon_wrapper_freebsd32_execve(struct thread *td,
 200     struct freebsd32_execve_args *uap)
 201 {
 202         char fname[MAXPATHLEN];
 203         int ret;
 204         size_t done;
 205         size_t len;
 206         struct filemon *filemon;
 207
 208         copyinstr(uap->fname, fname, sizeof(fname), &done);
 209
 210         if ((ret = freebsd32_execve(td, uap)) == 0) {
 211                 /* Grab a read lock on the filemon inuse list. */
 212                 filemon_lock_read();
 213
 214                 if ((filemon = filemon_pid_check(curproc)) != NULL) {
 215                         /* Lock the found filemon structure. */
 216                         filemon_filemon_lock(filemon);
 217
 218                         len = snprintf(filemon->msgbufr,
 219                             sizeof(filemon->msgbufr), "E %d %s\n",
 220                             curproc->p_pid, fname);
 221
 222                         filemon_output(filemon, filemon->msgbufr, len);
 223
 224                         /* Unlock the found filemon structure. */
 225                         filemon_filemon_unlock(filemon);
 226                 }
 227
 228                 /* Release the read lock. */
 229                 filemon_unlock_read();
 230         }
 231
 232         return (ret);
 233 }
 234 #endif
 235
 236 static int
 237 filemon_wrapper_fork(struct thread *td, struct fork_args *uap)
 238 {
 239         int ret;
 240         size_t len;
 241         struct filemon *filemon;
 242
 243         if ((ret = sys_fork(td, uap)) == 0) {
 244                 /* Grab a read lock on the filemon inuse list. */
 245                 filemon_lock_read();
 246
 247                 if ((filemon = filemon_pid_check(curproc)) != NULL) {
 248                         /* Lock the found filemon structure. */
 249                         filemon_filemon_lock(filemon);
 250
 251                         len = snprintf(filemon->msgbufr,
 252                             sizeof(filemon->msgbufr), "F %d %ld\n",
 253                             curproc->p_pid, (long)curthread->td_retval[0]);
 254
 255                         filemon_output(filemon, filemon->msgbufr, len);
 256
 257                         /* Unlock the found filemon structure. */
 258                         filemon_filemon_unlock(filemon);
 259                 }
 260
 261                 /* Release the read lock. */
 262                 filemon_unlock_read();
 263         }
 264
 265         return (ret);
 266 }
 267
 268 static int
 269 filemon_wrapper_open(struct thread *td, struct open_args *uap)
 270 {
 271         int ret;
 272         size_t done;
 273         size_t len;
 274         struct filemon *filemon;
 275
 276         if ((ret = sys_open(td, uap)) == 0) {
 277                 /* Grab a read lock on the filemon inuse list. */
 278                 filemon_lock_read();
 279
 280                 if ((filemon = filemon_pid_check(curproc)) != NULL) {
 281                         /* Lock the found filemon structure. */
 282                         filemon_filemon_lock(filemon);
 283
 284                         copyinstr(uap->path, filemon->fname1,
 285                             sizeof(filemon->fname1), &done);
 286
 287                         if (uap->flags & O_RDWR) {
 288                                 /*
 289                                  * We'll get the W record below, but need
 290                                  * to also output an R to distingish from
 291                                  * O_WRONLY.
 292                                  */
 293                                 len = snprintf(filemon->msgbufr,
 294                                     sizeof(filemon->msgbufr), "R %d %s\n",
 295                                     curproc->p_pid, filemon->fname1);
 296                                 filemon_output(filemon, filemon->msgbufr, len);
 297                         }
 298
 299
 300                         len = snprintf(filemon->msgbufr,
 301                             sizeof(filemon->msgbufr), "%c %d %s\n",
 302                             (uap->flags & O_ACCMODE) ? 'W':'R',
 303                             curproc->p_pid, filemon->fname1);
 304                         filemon_output(filemon, filemon->msgbufr, len);
 305
 306                         /* Unlock the found filemon structure. */
 307                         filemon_filemon_unlock(filemon);
 308                 }
 309
 310                 /* Release the read lock. */
 311                 filemon_unlock_read();
 312         }
 313
 314         return (ret);
 315 }
 316
 317 static int
 318 filemon_wrapper_rename(struct thread *td, struct rename_args *uap)
 319 {
 320         int ret;
 321         size_t done;
 322         size_t len;
 323         struct filemon *filemon;
 324
 325         if ((ret = sys_rename(td, uap)) == 0) {
 326                 /* Grab a read lock on the filemon inuse list. */
 327                 filemon_lock_read();
 328
 329                 if ((filemon = filemon_pid_check(curproc)) != NULL) {
 330                         /* Lock the found filemon structure. */
 331                         filemon_filemon_lock(filemon);
 332
 333                         copyinstr(uap->from, filemon->fname1,
 334                             sizeof(filemon->fname1), &done);
 335                         copyinstr(uap->to, filemon->fname2,
 336                             sizeof(filemon->fname2), &done);
 337
 338                         len = snprintf(filemon->msgbufr,
 339                             sizeof(filemon->msgbufr), "M %d '%s' '%s'\n",
 340                             curproc->p_pid, filemon->fname1, filemon->fname2);
 341
 342                         filemon_output(filemon, filemon->msgbufr, len);
 343
 344                         /* Unlock the found filemon structure. */
 345                         filemon_filemon_unlock(filemon);
 346                 }
 347
 348                 /* Release the read lock. */
 349                 filemon_unlock_read();
 350         }
 351
 352         return (ret);
 353 }
 354
 355 static int
 356 filemon_wrapper_link(struct thread *td, struct link_args *uap)
 357 {
 358         int ret;
 359         size_t done;
 360         size_t len;
 361         struct filemon *filemon;
 362
 363         if ((ret = sys_link(td, uap)) == 0) {
 364                 /* Grab a read lock on the filemon inuse list. */
 365                 filemon_lock_read();
 366
 367                 if ((filemon = filemon_pid_check(curproc)) != NULL) {
 368                         /* Lock the found filemon structure. */
 369                         filemon_filemon_lock(filemon);
 370
 371                         copyinstr(uap->path, filemon->fname1,
 372                             sizeof(filemon->fname1), &done);
 373                         copyinstr(uap->link, filemon->fname2,
 374                             sizeof(filemon->fname2), &done);
 375
 376                         len = snprintf(filemon->msgbufr,
 377                             sizeof(filemon->msgbufr), "L %d '%s' '%s'\n",
 378                             curproc->p_pid, filemon->fname1, filemon->fname2);
 379
 380                         filemon_output(filemon, filemon->msgbufr, len);
 381
 382                         /* Unlock the found filemon structure. */
 383                         filemon_filemon_unlock(filemon);
 384                 }
 385
 386                 /* Release the read lock. */
 387                 filemon_unlock_read();
 388         }
 389
 390         return (ret);
 391 }
 392
 393 static int
 394 filemon_wrapper_symlink(struct thread *td, struct symlink_args *uap)
 395 {
 396         int ret;
 397         size_t done;
 398         size_t len;
 399         struct filemon *filemon;
 400
 401         if ((ret = sys_symlink(td, uap)) == 0) {
 402                 /* Grab a read lock on the filemon inuse list. */
 403                 filemon_lock_read();
 404
 405                 if ((filemon = filemon_pid_check(curproc)) != NULL) {
 406                         /* Lock the found filemon structure. */
 407                         filemon_filemon_lock(filemon);
 408
 409                         copyinstr(uap->path, filemon->fname1,
 410                             sizeof(filemon->fname1), &done);
 411                         copyinstr(uap->link, filemon->fname2,
 412                             sizeof(filemon->fname2), &done);
 413
 414                         len = snprintf(filemon->msgbufr,
 415                             sizeof(filemon->msgbufr), "L %d '%s' '%s'\n",
 416                             curproc->p_pid, filemon->fname1, filemon->fname2);
 417
 418                         filemon_output(filemon, filemon->msgbufr, len);
 419
 420                         /* Unlock the found filemon structure. */
 421                         filemon_filemon_unlock(filemon);
 422                 }
 423
 424                 /* Release the read lock. */
 425                 filemon_unlock_read();
 426         }
 427
 428         return (ret);
 429 }
 430
 431 #ifdef FILEMON_HAS_LINKAT
 432 static int
 433 filemon_wrapper_linkat(struct thread *td, struct linkat_args *uap)
 434 {
 435         int ret;
 436         size_t done;
 437         size_t len;
 438         struct filemon *filemon;
 439
 440         if ((ret = sys_linkat(td, uap)) == 0) {
 441                 /* Grab a read lock on the filemon inuse list. */
 442                 filemon_lock_read();
 443
 444                 if ((filemon = filemon_pid_check(curproc)) != NULL) {
 445                         /* Lock the found filemon structure. */
 446                         filemon_filemon_lock(filemon);
 447
 448                         copyinstr(uap->path1, filemon->fname1,
 449                             sizeof(filemon->fname1), &done);
 450                         copyinstr(uap->path2, filemon->fname2,
 451                             sizeof(filemon->fname2), &done);
 452
 453                         len = snprintf(filemon->msgbufr,
 454                             sizeof(filemon->msgbufr), "L %d '%s' '%s'\n",
 455                             curproc->p_pid, filemon->fname1, filemon->fname2);
 456
 457                         filemon_output(filemon, filemon->msgbufr, len);
 458
 459                         /* Unlock the found filemon structure. */
 460                         filemon_filemon_unlock(filemon);
 461                 }
 462
 463                 /* Release the read lock. */
 464                 filemon_unlock_read();
 465         }
 466
 467         return (ret);
 468 }
 469 #endif
 470
 471 static int
 472 filemon_wrapper_stat(struct thread *td, struct stat_args *uap)
 473 {
 474         int ret;
 475         size_t done;
 476         size_t len;
 477         struct filemon *filemon;
 478
 479         if ((ret = sys_stat(td, uap)) == 0) {
 480                 /* Grab a read lock on the filemon inuse list. */
 481                 filemon_lock_read();
 482
 483                 if ((filemon = filemon_pid_check(curproc)) != NULL) {
 484                         /* Lock the found filemon structure. */
 485                         filemon_filemon_lock(filemon);
 486
 487                         copyinstr(uap->path, filemon->fname1,
 488                             sizeof(filemon->fname1), &done);
 489
 490                         len = snprintf(filemon->msgbufr,
 491                             sizeof(filemon->msgbufr), "S %d %s\n",
 492                             curproc->p_pid, filemon->fname1);
 493
 494                         filemon_output(filemon, filemon->msgbufr, len);
 495
 496                         /* Unlock the found filemon structure. */
 497                         filemon_filemon_unlock(filemon);
 498                 }
 499
 500                 /* Release the read lock. */
 501                 filemon_unlock_read();
 502         }
 503
 504         return (ret);
 505 }
 506
 507 #if defined(COMPAT_IA32) || defined(COMPAT_FREEBSD32) || defined(COMPAT_ARCH32)
 508 static int
 509 filemon_wrapper_freebsd32_stat(struct thread *td,
 510     struct freebsd32_stat_args *uap)
 511 {
 512         int ret;
 513         size_t done;
 514         size_t len;
 515         struct filemon *filemon;
 516
 517         if ((ret = freebsd32_stat(td, uap)) == 0) {
 518                 /* Grab a read lock on the filemon inuse list. */
 519                 filemon_lock_read();
 520
 521                 if ((filemon = filemon_pid_check(curproc)) != NULL) {
 522                         /* Lock the found filemon structure. */
 523                         filemon_filemon_lock(filemon);
 524
 525                         copyinstr(uap->path, filemon->fname1,
 526                             sizeof(filemon->fname1), &done);
 527
 528                         len = snprintf(filemon->msgbufr,
 529                             sizeof(filemon->msgbufr), "S %d %s\n",
 530                             curproc->p_pid, filemon->fname1);
 531
 532                         filemon_output(filemon, filemon->msgbufr, len);
 533
 534                         /* Unlock the found filemon structure. */
 535                         filemon_filemon_unlock(filemon);
 536                 }
 537
 538                 /* Release the read lock. */
 539                 filemon_unlock_read();
 540         }
 541
 542         return (ret);
 543 }
 544 #endif
 545
 546 static void
 547 filemon_wrapper_sys_exit(struct thread *td, struct sys_exit_args *uap)
 548 {
 549         size_t len;
 550         struct filemon *filemon;
 551         struct timeval now;
 552
 553         /* Get timestamp before locking. */
 554         getmicrotime(&now);
 555
 556         /* Grab a read lock on the filemon inuse list. */
 557         filemon_lock_read();
 558
 559         if ((filemon = filemon_pid_check(curproc)) != NULL) {
 560                 /* Lock the found filemon structure. */
 561                 filemon_filemon_lock(filemon);
 562
 563                 len = snprintf(filemon->msgbufr, sizeof(filemon->msgbufr),
 564                     "X %d %d\n", curproc->p_pid, uap->rval);
 565
 566                 filemon_output(filemon, filemon->msgbufr, len);
 567
 568                 /* Check if the monitored process is about to exit. */
 569                 if (filemon->pid == curproc->p_pid) {
 570                         len = snprintf(filemon->msgbufr,
 571                             sizeof(filemon->msgbufr),
 572                             "# Stop %ju.%06ju\n# Bye bye\n",
 573                             (uintmax_t)now.tv_sec, (uintmax_t)now.tv_usec);
 574
 575                         filemon_output(filemon, filemon->msgbufr, len);
 576                 }
 577
 578                 /* Unlock the found filemon structure. */
 579                 filemon_filemon_unlock(filemon);
 580         }
 581
 582         /* Release the read lock. */
 583         filemon_unlock_read();
 584
 585         sys_sys_exit(td, uap);
 586 }
 587
 588 static int
 589 filemon_wrapper_unlink(struct thread *td, struct unlink_args *uap)
 590 {
 591         int ret;
 592         size_t done;
 593         size_t len;
 594         struct filemon *filemon;
 595
 596         if ((ret = sys_unlink(td, uap)) == 0) {
 597                 /* Grab a read lock on the filemon inuse list. */
 598                 filemon_lock_read();
 599
 600                 if ((filemon = filemon_pid_check(curproc)) != NULL) {
 601                         /* Lock the found filemon structure. */
 602                         filemon_filemon_lock(filemon);
 603
 604                         copyinstr(uap->path, filemon->fname1,
 605                             sizeof(filemon->fname1), &done);
 606
 607                         len = snprintf(filemon->msgbufr,
 608                             sizeof(filemon->msgbufr), "D %d %s\n",
 609                             curproc->p_pid, filemon->fname1);
 610
 611                         filemon_output(filemon, filemon->msgbufr, len);
 612
 613                         /* Unlock the found filemon structure. */
 614                         filemon_filemon_unlock(filemon);
 615                 }
 616
 617                 /* Release the read lock. */
 618                 filemon_unlock_read();
 619         }
 620
 621         return (ret);
 622 }
 623
 624 static int
 625 filemon_wrapper_vfork(struct thread *td, struct vfork_args *uap)
 626 {
 627         int ret;
 628         size_t len;
 629         struct filemon *filemon;
 630
 631         if ((ret = sys_vfork(td, uap)) == 0) {
 632                 /* Grab a read lock on the filemon inuse list. */
 633                 filemon_lock_read();
 634
 635                 if ((filemon = filemon_pid_check(curproc)) != NULL) {
 636                         /* Lock the found filemon structure. */
 637                         filemon_filemon_lock(filemon);
 638
 639                         len = snprintf(filemon->msgbufr,
 640                             sizeof(filemon->msgbufr), "F %d %ld\n",
 641                             curproc->p_pid, (long)curthread->td_retval[0]);
 642
 643                         filemon_output(filemon, filemon->msgbufr, len);
 644
 645                         /* Unlock the found filemon structure. */
 646                         filemon_filemon_unlock(filemon);
 647                 }
 648
 649                 /* Release the read lock. */
 650                 filemon_unlock_read();
 651         }
 652
 653         return (ret);
 654 }
 655
 656 static void
 657 filemon_wrapper_install(void)
 658 {
 659 #if defined(__i386__)
 660         struct sysent *sv_table = elf32_freebsd_sysvec.sv_table;
 661 #elif defined(__amd64__)
 662         struct sysent *sv_table = elf64_freebsd_sysvec.sv_table;
 663 #else
 664 #error Machine type not supported
 665 #endif
 666
 667         sv_table[SYS_chdir].sy_call = (sy_call_t *) filemon_wrapper_chdir;
 668         sv_table[SYS_exit].sy_call = (sy_call_t *) filemon_wrapper_sys_exit;
 669         sv_table[SYS_execve].sy_call = (sy_call_t *) filemon_wrapper_execve;
 670         sv_table[SYS_fork].sy_call = (sy_call_t *) filemon_wrapper_fork;
 671         sv_table[SYS_open].sy_call = (sy_call_t *) filemon_wrapper_open;
 672         sv_table[SYS_rename].sy_call = (sy_call_t *) filemon_wrapper_rename;
 673         sv_table[SYS_stat].sy_call = (sy_call_t *) filemon_wrapper_stat;
 674         sv_table[SYS_unlink].sy_call = (sy_call_t *) filemon_wrapper_unlink;
 675         sv_table[SYS_vfork].sy_call = (sy_call_t *) filemon_wrapper_vfork;
 676         sv_table[SYS_link].sy_call = (sy_call_t *) filemon_wrapper_link;
 677         sv_table[SYS_symlink].sy_call = (sy_call_t *) filemon_wrapper_symlink;
 678 #ifdef FILEMON_HAS_LINKAT
 679         sv_table[SYS_linkat].sy_call = (sy_call_t *) filemon_wrapper_linkat;
 680 #endif
 681
 682 #if defined(COMPAT_IA32) || defined(COMPAT_FREEBSD32) || defined(COMPAT_ARCH32)
 683         sv_table = ia32_freebsd_sysvec.sv_table;
 684
 685         sv_table[FREEBSD32_SYS_chdir].sy_call = (sy_call_t *) filemon_wrapper_chdir;
 686         sv_table[FREEBSD32_SYS_exit].sy_call = (sy_call_t *) filemon_wrapper_sys_exit;
 687         sv_table[FREEBSD32_SYS_freebsd32_execve].sy_call = (sy_call_t *) filemon_wrapper_freebsd32_execve;
 688         sv_table[FREEBSD32_SYS_fork].sy_call = (sy_call_t *) filemon_wrapper_fork;
 689         sv_table[FREEBSD32_SYS_open].sy_call = (sy_call_t *) filemon_wrapper_open;
 690         sv_table[FREEBSD32_SYS_rename].sy_call = (sy_call_t *) filemon_wrapper_rename;
 691         sv_table[FREEBSD32_SYS_freebsd32_stat].sy_call = (sy_call_t *) filemon_wrapper_freebsd32_stat;
 692         sv_table[FREEBSD32_SYS_unlink].sy_call = (sy_call_t *) filemon_wrapper_unlink;
 693         sv_table[FREEBSD32_SYS_vfork].sy_call = (sy_call_t *) filemon_wrapper_vfork;
 694         sv_table[FREEBSD32_SYS_link].sy_call = (sy_call_t *) filemon_wrapper_link;
 695         sv_table[FREEBSD32_SYS_symlink].sy_call = (sy_call_t *) filemon_wrapper_symlink;
 696 #ifdef FILEMON_HAS_LINKAT
 697         sv_table[FREEBSD32_SYS_linkat].sy_call = (sy_call_t *) filemon_wrapper_linkat;
 698 #endif
 699 #endif  /* COMPAT_ARCH32 */
 700 }
 701
 702 static void
 703 filemon_wrapper_deinstall(void)
 704 {
 705 #if defined(__i386__)
 706         struct sysent *sv_table = elf32_freebsd_sysvec.sv_table;
 707 #elif defined(__amd64__)
 708         struct sysent *sv_table = elf64_freebsd_sysvec.sv_table;
 709 #else
 710 #error Machine type not supported
 711 #endif
 712
 713         sv_table[SYS_chdir].sy_call = (sy_call_t *)sys_chdir;
 714         sv_table[SYS_exit].sy_call = (sy_call_t *)sys_sys_exit;
 715         sv_table[SYS_execve].sy_call = (sy_call_t *)sys_execve;
 716         sv_table[SYS_fork].sy_call = (sy_call_t *)sys_fork;
 717         sv_table[SYS_open].sy_call = (sy_call_t *)sys_open;
 718         sv_table[SYS_rename].sy_call = (sy_call_t *)sys_rename;
 719         sv_table[SYS_stat].sy_call = (sy_call_t *)sys_stat;
 720         sv_table[SYS_unlink].sy_call = (sy_call_t *)sys_unlink;
 721         sv_table[SYS_vfork].sy_call = (sy_call_t *)sys_vfork;
 722         sv_table[SYS_link].sy_call = (sy_call_t *)sys_link;
 723         sv_table[SYS_symlink].sy_call = (sy_call_t *)sys_symlink;
 724 #ifdef FILEMON_HAS_LINKAT
 725         sv_table[SYS_linkat].sy_call = (sy_call_t *)sys_linkat;
 726 #endif
 727
 728 #if defined(COMPAT_IA32) || defined(COMPAT_FREEBSD32) || defined(COMPAT_ARCH32)
 729         sv_table = ia32_freebsd_sysvec.sv_table;
 730
 731         sv_table[FREEBSD32_SYS_chdir].sy_call = (sy_call_t *)sys_chdir;
 732         sv_table[FREEBSD32_SYS_exit].sy_call = (sy_call_t *)sys_sys_exit;
 733         sv_table[FREEBSD32_SYS_freebsd32_execve].sy_call = (sy_call_t *)freebsd32_execve;
 734         sv_table[FREEBSD32_SYS_fork].sy_call = (sy_call_t *)sys_fork;
 735         sv_table[FREEBSD32_SYS_open].sy_call = (sy_call_t *)sys_open;
 736         sv_table[FREEBSD32_SYS_rename].sy_call = (sy_call_t *)sys_rename;
 737         sv_table[FREEBSD32_SYS_freebsd32_stat].sy_call = (sy_call_t *)freebsd32_stat;
 738         sv_table[FREEBSD32_SYS_unlink].sy_call = (sy_call_t *)sys_unlink;
 739         sv_table[FREEBSD32_SYS_vfork].sy_call = (sy_call_t *)sys_vfork;
 740         sv_table[FREEBSD32_SYS_link].sy_call = (sy_call_t *)sys_link;
 741         sv_table[FREEBSD32_SYS_symlink].sy_call = (sy_call_t *)sys_symlink;
 742 #ifdef FILEMON_HAS_LINKAT
 743         sv_table[FREEBSD32_SYS_linkat].sy_call = (sy_call_t *)sys_linkat;
 744 #endif
 745 #endif  /* COMPAT_ARCH32 */
 746 }