sys/dev/filemon/filemon_wrapper.c

   1 /*-
   2  * Copyright (c) 2011, David E. O'Brien.
   3  * Copyright (c) 2009-2011, Juniper Networks, Inc.
   4  * All rights reserved.
   5  *
   6  * Redistribution and use in source and binary forms, with or without
   7  * modification, are permitted provided that the following conditions
   8  * are met:
   9  * 1. Redistributions of source code must retain the above copyright
  10  *    notice, this list of conditions and the following disclaimer.
  11  * 2. Redistributions in binary form must reproduce the above copyright
  12  *    notice, this list of conditions and the following disclaimer in the
  13  *    documentation and/or other materials provided with the distribution.
  14  *
  15  * THIS SOFTWARE IS PROVIDED BY JUNIPER NETWORKS AND CONTRIBUTORS ``AS IS'' AND
  16  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  17  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  18  * ARE DISCLAIMED. IN NO EVENT SHALL JUNIPER NETWORKS OR CONTRIBUTORS BE LIABLE
  19  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  20  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  21  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  22  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  23  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  24  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  25  * SUCH DAMAGE.
  26  */
  27
  28 #include <sys/cdefs.h>
  29 __FBSDID("$FreeBSD$");
  30
  31 #include <sys/sx.h>
  32
  33 #include "opt_compat.h"
  34
  35 #if __FreeBSD_version > 800032
  36 #define FILEMON_HAS_LINKAT
  37 #endif
  38
  39 #if __FreeBSD_version < 900044  /* r225617 (2011-09-16) failed to bump
  40                                    __FreeBSD_version.  This really should
  41                                    be based on "900045".  "900044" is r225469
  42                                    (2011-09-10) so this code is broken for
  43                                    9-CURRENT September 10th-16th. */
  44 #define sys_chdir       chdir
  45 #define sys_execve      execve
  46 #define sys_fork        fork
  47 #define sys_link        link
  48 #define sys_open        open
  49 #define sys_rename      rename
  50 #define sys_stat        stat
  51 #define sys_symlink     symlink
  52 #define sys_unlink      unlink
  53 #define sys_vfork       vfork
  54 #define sys_sys_exit    sys_exit
  55 #ifdef FILEMON_HAS_LINKAT
  56 #define sys_linkat      linkat
  57 #endif
  58 #endif  /* __FreeBSD_version */
  59
  60 static void
  61 filemon_output(struct filemon *filemon, char *msg, size_t len)
  62 {
  63         struct uio auio;
  64         struct iovec aiov;
  65
  66         if (filemon->fp == NULL)
  67                 return;
  68
  69         aiov.iov_base = msg;
  70         aiov.iov_len = len;
  71         auio.uio_iov = &aiov;
  72         auio.uio_iovcnt = 1;
  73         auio.uio_resid = len;
  74         auio.uio_segflg = UIO_SYSSPACE;
  75         auio.uio_rw = UIO_WRITE;
  76         auio.uio_td = curthread;
  77         auio.uio_offset = (off_t) -1;
  78
  79         bwillwrite();
  80
  81         fo_write(filemon->fp, &auio, curthread->td_ucred, 0, curthread);
  82 }
  83
  84 static struct filemon *
  85 filemon_pid_check(struct proc *p)
  86 {
  87         struct filemon *filemon;
  88
  89         sx_slock(&proctree_lock);
  90         while (p != initproc) {
  91                 TAILQ_FOREACH(filemon, &filemons_inuse, link) {
  92                         if (p->p_pid == filemon->pid) {
  93                                 sx_sunlock(&proctree_lock);
  94                                 return (filemon);
  95                         }
  96                 }
  97                 p = proc_realparent(p);
  98         }
  99         sx_sunlock(&proctree_lock);
 100         return (NULL);
 101 }
 102
 103 static void
 104 filemon_comment(struct filemon *filemon)
 105 {
 106         int len;
 107         struct timeval now;
 108
 109         /* Load timestamp before locking.  Less accurate but less contention. */
 110         getmicrotime(&now);
 111
 112         /* Grab a read lock on the filemon inuse list. */
 113         filemon_lock_read();
 114
 115         /* Lock the found filemon structure. */
 116         filemon_filemon_lock(filemon);
 117
 118         len = snprintf(filemon->msgbufr, sizeof(filemon->msgbufr),
 119             "# filemon version %d\n# Target pid %d\n# Start %ju.%06ju\nV %d\n",
 120             FILEMON_VERSION, curproc->p_pid, (uintmax_t)now.tv_sec,
 121             (uintmax_t)now.tv_usec, FILEMON_VERSION);
 122
 123         filemon_output(filemon, filemon->msgbufr, len);
 124
 125         /* Unlock the found filemon structure. */
 126         filemon_filemon_unlock(filemon);
 127
 128         /* Release the read lock. */
 129         filemon_unlock_read();
 130 }
 131
 132 static int
 133 filemon_wrapper_chdir(struct thread *td, struct chdir_args *uap)
 134 {
 135         int ret;
 136         size_t done;
 137         size_t len;
 138         struct filemon *filemon;
 139
 140         if ((ret = sys_chdir(td, uap)) == 0) {
 141                 /* Grab a read lock on the filemon inuse list. */
 142                 filemon_lock_read();
 143
 144                 if ((filemon = filemon_pid_check(curproc)) != NULL) {
 145                         /* Lock the found filemon structure. */
 146                         filemon_filemon_lock(filemon);
 147
 148                         copyinstr(uap->path, filemon->fname1,
 149                             sizeof(filemon->fname1), &done);
 150
 151                         len = snprintf(filemon->msgbufr,
 152                             sizeof(filemon->msgbufr), "C %d %s\n",
 153                             curproc->p_pid, filemon->fname1);
 154
 155                         filemon_output(filemon, filemon->msgbufr, len);
 156
 157                         /* Unlock the found filemon structure. */
 158                         filemon_filemon_unlock(filemon);
 159                 }
 160
 161                 /* Release the read lock. */
 162                 filemon_unlock_read();
 163         }
 164
 165         return (ret);
 166 }
 167
 168 static int
 169 filemon_wrapper_execve(struct thread *td, struct execve_args *uap)
 170 {
 171         char fname[MAXPATHLEN];
 172         int ret;
 173         size_t done;
 174         size_t len;
 175         struct filemon *filemon;
 176
 177         copyinstr(uap->fname, fname, sizeof(fname), &done);
 178
 179         if ((ret = sys_execve(td, uap)) == 0) {
 180                 /* Grab a read lock on the filemon inuse list. */
 181                 filemon_lock_read();
 182
 183                 if ((filemon = filemon_pid_check(curproc)) != NULL) {
 184                         /* Lock the found filemon structure. */
 185                         filemon_filemon_lock(filemon);
 186
 187                         len = snprintf(filemon->msgbufr,
 188                             sizeof(filemon->msgbufr), "E %d %s\n",
 189                             curproc->p_pid, fname);
 190
 191                         filemon_output(filemon, filemon->msgbufr, len);
 192
 193                         /* Unlock the found filemon structure. */
 194                         filemon_filemon_unlock(filemon);
 195                 }
 196
 197                 /* Release the read lock. */
 198                 filemon_unlock_read();
 199         }
 200
 201         return (ret);
 202 }
 203
 204 #if defined(COMPAT_IA32) || defined(COMPAT_FREEBSD32) || defined(COMPAT_ARCH32)
 205 static int
 206 filemon_wrapper_freebsd32_execve(struct thread *td,
 207     struct freebsd32_execve_args *uap)
 208 {
 209         char fname[MAXPATHLEN];
 210         int ret;
 211         size_t done;
 212         size_t len;
 213         struct filemon *filemon;
 214
 215         copyinstr(uap->fname, fname, sizeof(fname), &done);
 216
 217         if ((ret = freebsd32_execve(td, uap)) == 0) {
 218                 /* Grab a read lock on the filemon inuse list. */
 219                 filemon_lock_read();
 220
 221                 if ((filemon = filemon_pid_check(curproc)) != NULL) {
 222                         /* Lock the found filemon structure. */
 223                         filemon_filemon_lock(filemon);
 224
 225                         len = snprintf(filemon->msgbufr,
 226                             sizeof(filemon->msgbufr), "E %d %s\n",
 227                             curproc->p_pid, fname);
 228
 229                         filemon_output(filemon, filemon->msgbufr, len);
 230
 231                         /* Unlock the found filemon structure. */
 232                         filemon_filemon_unlock(filemon);
 233                 }
 234
 235                 /* Release the read lock. */
 236                 filemon_unlock_read();
 237         }
 238
 239         return (ret);
 240 }
 241 #endif
 242
 243 static int
 244 filemon_wrapper_fork(struct thread *td, struct fork_args *uap)
 245 {
 246         int ret;
 247         size_t len;
 248         struct filemon *filemon;
 249
 250         if ((ret = sys_fork(td, uap)) == 0) {
 251                 /* Grab a read lock on the filemon inuse list. */
 252                 filemon_lock_read();
 253
 254                 if ((filemon = filemon_pid_check(curproc)) != NULL) {
 255                         /* Lock the found filemon structure. */
 256                         filemon_filemon_lock(filemon);
 257
 258                         len = snprintf(filemon->msgbufr,
 259                             sizeof(filemon->msgbufr), "F %d %ld\n",
 260                             curproc->p_pid, (long)curthread->td_retval[0]);
 261
 262                         filemon_output(filemon, filemon->msgbufr, len);
 263
 264                         /* Unlock the found filemon structure. */
 265                         filemon_filemon_unlock(filemon);
 266                 }
 267
 268                 /* Release the read lock. */
 269                 filemon_unlock_read();
 270         }
 271
 272         return (ret);
 273 }
 274
 275 static int
 276 filemon_wrapper_open(struct thread *td, struct open_args *uap)
 277 {
 278         int ret;
 279         size_t done;
 280         size_t len;
 281         struct filemon *filemon;
 282
 283         if ((ret = sys_open(td, uap)) == 0) {
 284                 /* Grab a read lock on the filemon inuse list. */
 285                 filemon_lock_read();
 286
 287                 if ((filemon = filemon_pid_check(curproc)) != NULL) {
 288                         /* Lock the found filemon structure. */
 289                         filemon_filemon_lock(filemon);
 290
 291                         copyinstr(uap->path, filemon->fname1,
 292                             sizeof(filemon->fname1), &done);
 293
 294                         if (uap->flags & O_RDWR) {
 295                                 /*
 296                                  * We'll get the W record below, but need
 297                                  * to also output an R to distingish from
 298                                  * O_WRONLY.
 299                                  */
 300                                 len = snprintf(filemon->msgbufr,
 301                                     sizeof(filemon->msgbufr), "R %d %s\n",
 302                                     curproc->p_pid, filemon->fname1);
 303                                 filemon_output(filemon, filemon->msgbufr, len);
 304                         }
 305
 306
 307                         len = snprintf(filemon->msgbufr,
 308                             sizeof(filemon->msgbufr), "%c %d %s\n",
 309                             (uap->flags & O_ACCMODE) ? 'W':'R',
 310                             curproc->p_pid, filemon->fname1);
 311                         filemon_output(filemon, filemon->msgbufr, len);
 312
 313                         /* Unlock the found filemon structure. */
 314                         filemon_filemon_unlock(filemon);
 315                 }
 316
 317                 /* Release the read lock. */
 318                 filemon_unlock_read();
 319         }
 320
 321         return (ret);
 322 }
 323
 324 static int
 325 filemon_wrapper_openat(struct thread *td, struct openat_args *uap)
 326 {
 327         int ret;
 328         size_t done;
 329         size_t len;
 330         struct filemon *filemon;
 331
 332         if ((ret = sys_openat(td, uap)) == 0) {
 333                 /* Grab a read lock on the filemon inuse list. */
 334                 filemon_lock_read();
 335
 336                 if ((filemon = filemon_pid_check(curproc)) != NULL) {
 337                         /* Lock the found filemon structure. */
 338                         filemon_filemon_lock(filemon);
 339
 340                         copyinstr(uap->path, filemon->fname1,
 341                             sizeof(filemon->fname1), &done);
 342
 343                         filemon->fname2[0] = '\0';
 344                         if (filemon->fname1[0] != '/' && uap->fd != AT_FDCWD) {
 345                                 /*
 346                                  * rats - we cannot do too much about this.
 347                                  * the trace should show a dir we read
 348                                  * recently.. output an A record as a clue
 349                                  * until we can do better.
 350                                  */
 351                                 len = snprintf(filemon->msgbufr,
 352                                     sizeof(filemon->msgbufr), "A %d %s\n",
 353                                     curproc->p_pid, filemon->fname1);
 354                                 filemon_output(filemon, filemon->msgbufr, len);
 355                         }
 356                         if (uap->flag & O_RDWR) {
 357                                 /*
 358                                  * We'll get the W record below, but need
 359                                  * to also output an R to distingish from
 360                                  * O_WRONLY.
 361                                  */
 362                                 len = snprintf(filemon->msgbufr,
 363                                     sizeof(filemon->msgbufr), "R %d %s%s\n",
 364                                     curproc->p_pid, filemon->fname2, filemon->fname1);
 365                                 filemon_output(filemon, filemon->msgbufr, len);
 366                         }
 367
 368
 369                         len = snprintf(filemon->msgbufr,
 370                             sizeof(filemon->msgbufr), "%c %d %s%s\n",
 371                             (uap->flag & O_ACCMODE) ? 'W':'R',
 372                             curproc->p_pid, filemon->fname2, filemon->fname1);
 373                         filemon_output(filemon, filemon->msgbufr, len);
 374
 375                         /* Unlock the found filemon structure. */
 376                         filemon_filemon_unlock(filemon);
 377                 }
 378
 379                 /* Release the read lock. */
 380                 filemon_unlock_read();
 381         }
 382
 383         return (ret);
 384 }
 385
 386 static int
 387 filemon_wrapper_rename(struct thread *td, struct rename_args *uap)
 388 {
 389         int ret;
 390         size_t done;
 391         size_t len;
 392         struct filemon *filemon;
 393
 394         if ((ret = sys_rename(td, uap)) == 0) {
 395                 /* Grab a read lock on the filemon inuse list. */
 396                 filemon_lock_read();
 397
 398                 if ((filemon = filemon_pid_check(curproc)) != NULL) {
 399                         /* Lock the found filemon structure. */
 400                         filemon_filemon_lock(filemon);
 401
 402                         copyinstr(uap->from, filemon->fname1,
 403                             sizeof(filemon->fname1), &done);
 404                         copyinstr(uap->to, filemon->fname2,
 405                             sizeof(filemon->fname2), &done);
 406
 407                         len = snprintf(filemon->msgbufr,
 408                             sizeof(filemon->msgbufr), "M %d '%s' '%s'\n",
 409                             curproc->p_pid, filemon->fname1, filemon->fname2);
 410
 411                         filemon_output(filemon, filemon->msgbufr, len);
 412
 413                         /* Unlock the found filemon structure. */
 414                         filemon_filemon_unlock(filemon);
 415                 }
 416
 417                 /* Release the read lock. */
 418                 filemon_unlock_read();
 419         }
 420
 421         return (ret);
 422 }
 423
 424 static int
 425 filemon_wrapper_link(struct thread *td, struct link_args *uap)
 426 {
 427         int ret;
 428         size_t done;
 429         size_t len;
 430         struct filemon *filemon;
 431
 432         if ((ret = sys_link(td, uap)) == 0) {
 433                 /* Grab a read lock on the filemon inuse list. */
 434                 filemon_lock_read();
 435
 436                 if ((filemon = filemon_pid_check(curproc)) != NULL) {
 437                         /* Lock the found filemon structure. */
 438                         filemon_filemon_lock(filemon);
 439
 440                         copyinstr(uap->path, filemon->fname1,
 441                             sizeof(filemon->fname1), &done);
 442                         copyinstr(uap->link, filemon->fname2,
 443                             sizeof(filemon->fname2), &done);
 444
 445                         len = snprintf(filemon->msgbufr,
 446                             sizeof(filemon->msgbufr), "L %d '%s' '%s'\n",
 447                             curproc->p_pid, filemon->fname1, filemon->fname2);
 448
 449                         filemon_output(filemon, filemon->msgbufr, len);
 450
 451                         /* Unlock the found filemon structure. */
 452                         filemon_filemon_unlock(filemon);
 453                 }
 454
 455                 /* Release the read lock. */
 456                 filemon_unlock_read();
 457         }
 458
 459         return (ret);
 460 }
 461
 462 static int
 463 filemon_wrapper_symlink(struct thread *td, struct symlink_args *uap)
 464 {
 465         int ret;
 466         size_t done;
 467         size_t len;
 468         struct filemon *filemon;
 469
 470         if ((ret = sys_symlink(td, uap)) == 0) {
 471                 /* Grab a read lock on the filemon inuse list. */
 472                 filemon_lock_read();
 473
 474                 if ((filemon = filemon_pid_check(curproc)) != NULL) {
 475                         /* Lock the found filemon structure. */
 476                         filemon_filemon_lock(filemon);
 477
 478                         copyinstr(uap->path, filemon->fname1,
 479                             sizeof(filemon->fname1), &done);
 480                         copyinstr(uap->link, filemon->fname2,
 481                             sizeof(filemon->fname2), &done);
 482
 483                         len = snprintf(filemon->msgbufr,
 484                             sizeof(filemon->msgbufr), "L %d '%s' '%s'\n",
 485                             curproc->p_pid, filemon->fname1, filemon->fname2);
 486
 487                         filemon_output(filemon, filemon->msgbufr, len);
 488
 489                         /* Unlock the found filemon structure. */
 490                         filemon_filemon_unlock(filemon);
 491                 }
 492
 493                 /* Release the read lock. */
 494                 filemon_unlock_read();
 495         }
 496
 497         return (ret);
 498 }
 499
 500 #ifdef FILEMON_HAS_LINKAT
 501 static int
 502 filemon_wrapper_linkat(struct thread *td, struct linkat_args *uap)
 503 {
 504         int ret;
 505         size_t done;
 506         size_t len;
 507         struct filemon *filemon;
 508
 509         if ((ret = sys_linkat(td, uap)) == 0) {
 510                 /* Grab a read lock on the filemon inuse list. */
 511                 filemon_lock_read();
 512
 513                 if ((filemon = filemon_pid_check(curproc)) != NULL) {
 514                         /* Lock the found filemon structure. */
 515                         filemon_filemon_lock(filemon);
 516
 517                         copyinstr(uap->path1, filemon->fname1,
 518                             sizeof(filemon->fname1), &done);
 519                         copyinstr(uap->path2, filemon->fname2,
 520                             sizeof(filemon->fname2), &done);
 521
 522                         len = snprintf(filemon->msgbufr,
 523                             sizeof(filemon->msgbufr), "L %d '%s' '%s'\n",
 524                             curproc->p_pid, filemon->fname1, filemon->fname2);
 525
 526                         filemon_output(filemon, filemon->msgbufr, len);
 527
 528                         /* Unlock the found filemon structure. */
 529                         filemon_filemon_unlock(filemon);
 530                 }
 531
 532                 /* Release the read lock. */
 533                 filemon_unlock_read();
 534         }
 535
 536         return (ret);
 537 }
 538 #endif
 539
 540 static int
 541 filemon_wrapper_stat(struct thread *td, struct stat_args *uap)
 542 {
 543         int ret;
 544         size_t done;
 545         size_t len;
 546         struct filemon *filemon;
 547
 548         if ((ret = sys_stat(td, uap)) == 0) {
 549                 /* Grab a read lock on the filemon inuse list. */
 550                 filemon_lock_read();
 551
 552                 if ((filemon = filemon_pid_check(curproc)) != NULL) {
 553                         /* Lock the found filemon structure. */
 554                         filemon_filemon_lock(filemon);
 555
 556                         copyinstr(uap->path, filemon->fname1,
 557                             sizeof(filemon->fname1), &done);
 558
 559                         len = snprintf(filemon->msgbufr,
 560                             sizeof(filemon->msgbufr), "S %d %s\n",
 561                             curproc->p_pid, filemon->fname1);
 562
 563                         filemon_output(filemon, filemon->msgbufr, len);
 564
 565                         /* Unlock the found filemon structure. */
 566                         filemon_filemon_unlock(filemon);
 567                 }
 568
 569                 /* Release the read lock. */
 570                 filemon_unlock_read();
 571         }
 572
 573         return (ret);
 574 }
 575
 576 #if defined(COMPAT_IA32) || defined(COMPAT_FREEBSD32) || defined(COMPAT_ARCH32)
 577 static int
 578 filemon_wrapper_freebsd32_stat(struct thread *td,
 579     struct freebsd32_stat_args *uap)
 580 {
 581         int ret;
 582         size_t done;
 583         size_t len;
 584         struct filemon *filemon;
 585
 586         if ((ret = freebsd32_stat(td, uap)) == 0) {
 587                 /* Grab a read lock on the filemon inuse list. */
 588                 filemon_lock_read();
 589
 590                 if ((filemon = filemon_pid_check(curproc)) != NULL) {
 591                         /* Lock the found filemon structure. */
 592                         filemon_filemon_lock(filemon);
 593
 594                         copyinstr(uap->path, filemon->fname1,
 595                             sizeof(filemon->fname1), &done);
 596
 597                         len = snprintf(filemon->msgbufr,
 598                             sizeof(filemon->msgbufr), "S %d %s\n",
 599                             curproc->p_pid, filemon->fname1);
 600
 601                         filemon_output(filemon, filemon->msgbufr, len);
 602
 603                         /* Unlock the found filemon structure. */
 604                         filemon_filemon_unlock(filemon);
 605                 }
 606
 607                 /* Release the read lock. */
 608                 filemon_unlock_read();
 609         }
 610
 611         return (ret);
 612 }
 613 #endif
 614
 615 static void
 616 filemon_wrapper_sys_exit(struct thread *td, struct sys_exit_args *uap)
 617 {
 618         size_t len;
 619         struct filemon *filemon;
 620         struct timeval now;
 621
 622         /* Get timestamp before locking. */
 623         getmicrotime(&now);
 624
 625         /* Grab a read lock on the filemon inuse list. */
 626         filemon_lock_read();
 627
 628         if ((filemon = filemon_pid_check(curproc)) != NULL) {
 629                 /* Lock the found filemon structure. */
 630                 filemon_filemon_lock(filemon);
 631
 632                 len = snprintf(filemon->msgbufr, sizeof(filemon->msgbufr),
 633                     "X %d %d\n", curproc->p_pid, uap->rval);
 634
 635                 filemon_output(filemon, filemon->msgbufr, len);
 636
 637                 /* Check if the monitored process is about to exit. */
 638                 if (filemon->pid == curproc->p_pid) {
 639                         len = snprintf(filemon->msgbufr,
 640                             sizeof(filemon->msgbufr),
 641                             "# Stop %ju.%06ju\n# Bye bye\n",
 642                             (uintmax_t)now.tv_sec, (uintmax_t)now.tv_usec);
 643
 644                         filemon_output(filemon, filemon->msgbufr, len);
 645                         filemon->pid = -1;
 646                 }
 647
 648                 /* Unlock the found filemon structure. */
 649                 filemon_filemon_unlock(filemon);
 650         }
 651
 652         /* Release the read lock. */
 653         filemon_unlock_read();
 654
 655         sys_sys_exit(td, uap);
 656 }
 657
 658 static int
 659 filemon_wrapper_unlink(struct thread *td, struct unlink_args *uap)
 660 {
 661         int ret;
 662         size_t done;
 663         size_t len;
 664         struct filemon *filemon;
 665
 666         if ((ret = sys_unlink(td, uap)) == 0) {
 667                 /* Grab a read lock on the filemon inuse list. */
 668                 filemon_lock_read();
 669
 670                 if ((filemon = filemon_pid_check(curproc)) != NULL) {
 671                         /* Lock the found filemon structure. */
 672                         filemon_filemon_lock(filemon);
 673
 674                         copyinstr(uap->path, filemon->fname1,
 675                             sizeof(filemon->fname1), &done);
 676
 677                         len = snprintf(filemon->msgbufr,
 678                             sizeof(filemon->msgbufr), "D %d %s\n",
 679                             curproc->p_pid, filemon->fname1);
 680
 681                         filemon_output(filemon, filemon->msgbufr, len);
 682
 683                         /* Unlock the found filemon structure. */
 684                         filemon_filemon_unlock(filemon);
 685                 }
 686
 687                 /* Release the read lock. */
 688                 filemon_unlock_read();
 689         }
 690
 691         return (ret);
 692 }
 693
 694 static int
 695 filemon_wrapper_vfork(struct thread *td, struct vfork_args *uap)
 696 {
 697         int ret;
 698         size_t len;
 699         struct filemon *filemon;
 700
 701         if ((ret = sys_vfork(td, uap)) == 0) {
 702                 /* Grab a read lock on the filemon inuse list. */
 703                 filemon_lock_read();
 704
 705                 if ((filemon = filemon_pid_check(curproc)) != NULL) {
 706                         /* Lock the found filemon structure. */
 707                         filemon_filemon_lock(filemon);
 708
 709                         len = snprintf(filemon->msgbufr,
 710                             sizeof(filemon->msgbufr), "F %d %ld\n",
 711                             curproc->p_pid, (long)curthread->td_retval[0]);
 712
 713                         filemon_output(filemon, filemon->msgbufr, len);
 714
 715                         /* Unlock the found filemon structure. */
 716                         filemon_filemon_unlock(filemon);
 717                 }
 718
 719                 /* Release the read lock. */
 720                 filemon_unlock_read();
 721         }
 722
 723         return (ret);
 724 }
 725
 726 static void
 727 filemon_wrapper_install(void)
 728 {
 729 #if defined(__LP64__)
 730         struct sysent *sv_table = elf64_freebsd_sysvec.sv_table;
 731 #else
 732         struct sysent *sv_table = elf32_freebsd_sysvec.sv_table;
 733 #endif
 734
 735         sv_table[SYS_chdir].sy_call = (sy_call_t *) filemon_wrapper_chdir;
 736         sv_table[SYS_exit].sy_call = (sy_call_t *) filemon_wrapper_sys_exit;
 737         sv_table[SYS_execve].sy_call = (sy_call_t *) filemon_wrapper_execve;
 738         sv_table[SYS_fork].sy_call = (sy_call_t *) filemon_wrapper_fork;
 739         sv_table[SYS_open].sy_call = (sy_call_t *) filemon_wrapper_open;
 740         sv_table[SYS_openat].sy_call = (sy_call_t *) filemon_wrapper_openat;
 741         sv_table[SYS_rename].sy_call = (sy_call_t *) filemon_wrapper_rename;
 742         sv_table[SYS_stat].sy_call = (sy_call_t *) filemon_wrapper_stat;
 743         sv_table[SYS_unlink].sy_call = (sy_call_t *) filemon_wrapper_unlink;
 744         sv_table[SYS_vfork].sy_call = (sy_call_t *) filemon_wrapper_vfork;
 745         sv_table[SYS_link].sy_call = (sy_call_t *) filemon_wrapper_link;
 746         sv_table[SYS_symlink].sy_call = (sy_call_t *) filemon_wrapper_symlink;
 747 #ifdef FILEMON_HAS_LINKAT
 748         sv_table[SYS_linkat].sy_call = (sy_call_t *) filemon_wrapper_linkat;
 749 #endif
 750
 751 #if defined(COMPAT_IA32) || defined(COMPAT_FREEBSD32) || defined(COMPAT_ARCH32)
 752         sv_table = ia32_freebsd_sysvec.sv_table;
 753
 754         sv_table[FREEBSD32_SYS_chdir].sy_call = (sy_call_t *) filemon_wrapper_chdir;
 755         sv_table[FREEBSD32_SYS_exit].sy_call = (sy_call_t *) filemon_wrapper_sys_exit;
 756         sv_table[FREEBSD32_SYS_freebsd32_execve].sy_call = (sy_call_t *) filemon_wrapper_freebsd32_execve;
 757         sv_table[FREEBSD32_SYS_fork].sy_call = (sy_call_t *) filemon_wrapper_fork;
 758         sv_table[FREEBSD32_SYS_open].sy_call = (sy_call_t *) filemon_wrapper_open;
 759         sv_table[FREEBSD32_SYS_openat].sy_call = (sy_call_t *) filemon_wrapper_openat;
 760         sv_table[FREEBSD32_SYS_rename].sy_call = (sy_call_t *) filemon_wrapper_rename;
 761         sv_table[FREEBSD32_SYS_freebsd32_stat].sy_call = (sy_call_t *) filemon_wrapper_freebsd32_stat;
 762         sv_table[FREEBSD32_SYS_unlink].sy_call = (sy_call_t *) filemon_wrapper_unlink;
 763         sv_table[FREEBSD32_SYS_vfork].sy_call = (sy_call_t *) filemon_wrapper_vfork;
 764         sv_table[FREEBSD32_SYS_link].sy_call = (sy_call_t *) filemon_wrapper_link;
 765         sv_table[FREEBSD32_SYS_symlink].sy_call = (sy_call_t *) filemon_wrapper_symlink;
 766 #ifdef FILEMON_HAS_LINKAT
 767         sv_table[FREEBSD32_SYS_linkat].sy_call = (sy_call_t *) filemon_wrapper_linkat;
 768 #endif
 769 #endif  /* COMPAT_ARCH32 */
 770 }
 771
 772 static void
 773 filemon_wrapper_deinstall(void)
 774 {
 775 #if defined(__LP64__)
 776         struct sysent *sv_table = elf64_freebsd_sysvec.sv_table;
 777 #else
 778         struct sysent *sv_table = elf32_freebsd_sysvec.sv_table;
 779 #endif
 780
 781         sv_table[SYS_chdir].sy_call = (sy_call_t *)sys_chdir;
 782         sv_table[SYS_exit].sy_call = (sy_call_t *)sys_sys_exit;
 783         sv_table[SYS_execve].sy_call = (sy_call_t *)sys_execve;
 784         sv_table[SYS_fork].sy_call = (sy_call_t *)sys_fork;
 785         sv_table[SYS_open].sy_call = (sy_call_t *)sys_open;
 786         sv_table[SYS_openat].sy_call = (sy_call_t *)sys_openat;
 787         sv_table[SYS_rename].sy_call = (sy_call_t *)sys_rename;
 788         sv_table[SYS_stat].sy_call = (sy_call_t *)sys_stat;
 789         sv_table[SYS_unlink].sy_call = (sy_call_t *)sys_unlink;
 790         sv_table[SYS_vfork].sy_call = (sy_call_t *)sys_vfork;
 791         sv_table[SYS_link].sy_call = (sy_call_t *)sys_link;
 792         sv_table[SYS_symlink].sy_call = (sy_call_t *)sys_symlink;
 793 #ifdef FILEMON_HAS_LINKAT
 794         sv_table[SYS_linkat].sy_call = (sy_call_t *)sys_linkat;
 795 #endif
 796
 797 #if defined(COMPAT_IA32) || defined(COMPAT_FREEBSD32) || defined(COMPAT_ARCH32)
 798         sv_table = ia32_freebsd_sysvec.sv_table;
 799
 800         sv_table[FREEBSD32_SYS_chdir].sy_call = (sy_call_t *)sys_chdir;
 801         sv_table[FREEBSD32_SYS_exit].sy_call = (sy_call_t *)sys_sys_exit;
 802         sv_table[FREEBSD32_SYS_freebsd32_execve].sy_call = (sy_call_t *)freebsd32_execve;
 803         sv_table[FREEBSD32_SYS_fork].sy_call = (sy_call_t *)sys_fork;
 804         sv_table[FREEBSD32_SYS_open].sy_call = (sy_call_t *)sys_open;
 805         sv_table[FREEBSD32_SYS_openat].sy_call = (sy_call_t *)sys_openat;
 806         sv_table[FREEBSD32_SYS_rename].sy_call = (sy_call_t *)sys_rename;
 807         sv_table[FREEBSD32_SYS_freebsd32_stat].sy_call = (sy_call_t *)freebsd32_stat;
 808         sv_table[FREEBSD32_SYS_unlink].sy_call = (sy_call_t *)sys_unlink;
 809         sv_table[FREEBSD32_SYS_vfork].sy_call = (sy_call_t *)sys_vfork;
 810         sv_table[FREEBSD32_SYS_link].sy_call = (sy_call_t *)sys_link;
 811         sv_table[FREEBSD32_SYS_symlink].sy_call = (sy_call_t *)sys_symlink;
 812 #ifdef FILEMON_HAS_LINKAT
 813         sv_table[FREEBSD32_SYS_linkat].sy_call = (sy_call_t *)sys_linkat;
 814 #endif
 815 #endif  /* COMPAT_ARCH32 */
 816 }