freebsd-dev/usr.bin/procstat/procstat_files.c
Pawel Jakub Dawidek 2609222ab4 Merge Capsicum overhaul:
- Capability is no longer separate descriptor type. Now every descriptor
  has set of its own capability rights.

- The cap_new(2) system call is left, but it is no longer documented and
  should not be used in new code.

- The new syscall cap_rights_limit(2) should be used instead of
  cap_new(2), which limits capability rights of the given descriptor
  without creating a new one.

- The cap_getrights(2) syscall is renamed to cap_rights_get(2).

- If CAP_IOCTL capability right is present we can further reduce allowed
  ioctls list with the new cap_ioctls_limit(2) syscall. List of allowed
  ioctls can be retrived with cap_ioctls_get(2) syscall.

- If CAP_FCNTL capability right is present we can further reduce fcntls
  that can be used with the new cap_fcntls_limit(2) syscall and retrive
  them with cap_fcntls_get(2).

- To support ioctl and fcntl white-listing the filedesc structure was
  heavly modified.

- The audit subsystem, kdump and procstat tools were updated to
  recognize new syscalls.

- Capability rights were revised and eventhough I tried hard to provide
  backward API and ABI compatibility there are some incompatible changes
  that are described in detail below:

	CAP_CREATE old behaviour:
	- Allow for openat(2)+O_CREAT.
	- Allow for linkat(2).
	- Allow for symlinkat(2).
	CAP_CREATE new behaviour:
	- Allow for openat(2)+O_CREAT.

	Added CAP_LINKAT:
	- Allow for linkat(2). ABI: Reuses CAP_RMDIR bit.
	- Allow to be target for renameat(2).

	Added CAP_SYMLINKAT:
	- Allow for symlinkat(2).

	Removed CAP_DELETE. Old behaviour:
	- Allow for unlinkat(2) when removing non-directory object.
	- Allow to be source for renameat(2).

	Removed CAP_RMDIR. Old behaviour:
	- Allow for unlinkat(2) when removing directory.

	Added CAP_RENAMEAT:
	- Required for source directory for the renameat(2) syscall.

	Added CAP_UNLINKAT (effectively it replaces CAP_DELETE and CAP_RMDIR):
	- Allow for unlinkat(2) on any object.
	- Required if target of renameat(2) exists and will be removed by this
	  call.

	Removed CAP_MAPEXEC.

	CAP_MMAP old behaviour:
	- Allow for mmap(2) with any combination of PROT_NONE, PROT_READ and
	  PROT_WRITE.
	CAP_MMAP new behaviour:
	- Allow for mmap(2)+PROT_NONE.

	Added CAP_MMAP_R:
	- Allow for mmap(PROT_READ).
	Added CAP_MMAP_W:
	- Allow for mmap(PROT_WRITE).
	Added CAP_MMAP_X:
	- Allow for mmap(PROT_EXEC).
	Added CAP_MMAP_RW:
	- Allow for mmap(PROT_READ | PROT_WRITE).
	Added CAP_MMAP_RX:
	- Allow for mmap(PROT_READ | PROT_EXEC).
	Added CAP_MMAP_WX:
	- Allow for mmap(PROT_WRITE | PROT_EXEC).
	Added CAP_MMAP_RWX:
	- Allow for mmap(PROT_READ | PROT_WRITE | PROT_EXEC).

	Renamed CAP_MKDIR to CAP_MKDIRAT.
	Renamed CAP_MKFIFO to CAP_MKFIFOAT.
	Renamed CAP_MKNODE to CAP_MKNODEAT.

	CAP_READ old behaviour:
	- Allow pread(2).
	- Disallow read(2), readv(2) (if there is no CAP_SEEK).
	CAP_READ new behaviour:
	- Allow read(2), readv(2).
	- Disallow pread(2) (CAP_SEEK was also required).

	CAP_WRITE old behaviour:
	- Allow pwrite(2).
	- Disallow write(2), writev(2) (if there is no CAP_SEEK).
	CAP_WRITE new behaviour:
	- Allow write(2), writev(2).
	- Disallow pwrite(2) (CAP_SEEK was also required).

	Added convinient defines:

	#define	CAP_PREAD		(CAP_SEEK | CAP_READ)
	#define	CAP_PWRITE		(CAP_SEEK | CAP_WRITE)
	#define	CAP_MMAP_R		(CAP_MMAP | CAP_SEEK | CAP_READ)
	#define	CAP_MMAP_W		(CAP_MMAP | CAP_SEEK | CAP_WRITE)
	#define	CAP_MMAP_X		(CAP_MMAP | CAP_SEEK | 0x0000000000000008ULL)
	#define	CAP_MMAP_RW		(CAP_MMAP_R | CAP_MMAP_W)
	#define	CAP_MMAP_RX		(CAP_MMAP_R | CAP_MMAP_X)
	#define	CAP_MMAP_WX		(CAP_MMAP_W | CAP_MMAP_X)
	#define	CAP_MMAP_RWX		(CAP_MMAP_R | CAP_MMAP_W | CAP_MMAP_X)
	#define	CAP_RECV		CAP_READ
	#define	CAP_SEND		CAP_WRITE

	#define	CAP_SOCK_CLIENT \
		(CAP_CONNECT | CAP_GETPEERNAME | CAP_GETSOCKNAME | CAP_GETSOCKOPT | \
		 CAP_PEELOFF | CAP_RECV | CAP_SEND | CAP_SETSOCKOPT | CAP_SHUTDOWN)
	#define	CAP_SOCK_SERVER \
		(CAP_ACCEPT | CAP_BIND | CAP_GETPEERNAME | CAP_GETSOCKNAME | \
		 CAP_GETSOCKOPT | CAP_LISTEN | CAP_PEELOFF | CAP_RECV | CAP_SEND | \
		 CAP_SETSOCKOPT | CAP_SHUTDOWN)

	Added defines for backward API compatibility:

	#define	CAP_MAPEXEC		CAP_MMAP_X
	#define	CAP_DELETE		CAP_UNLINKAT
	#define	CAP_MKDIR		CAP_MKDIRAT
	#define	CAP_RMDIR		CAP_UNLINKAT
	#define	CAP_MKFIFO		CAP_MKFIFOAT
	#define	CAP_MKNOD		CAP_MKNODAT
	#define	CAP_SOCK_ALL		(CAP_SOCK_CLIENT | CAP_SOCK_SERVER)

Sponsored by:	The FreeBSD Foundation
Reviewed by:	Christoph Mallon <christoph.mallon@gmx.de>
Many aspects discussed with:	rwatson, benl, jonathan
ABI compatibility discussed with:	kib
2013-03-02 00:53:12 +00:00

498 lines
11 KiB
C

/*-
* Copyright (c) 2007-2011 Robert N. M. Watson
* All rights reserved.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
* are met:
* 1. Redistributions of source code must retain the above copyright
* notice, this list of conditions and the following disclaimer.
* 2. Redistributions in binary form must reproduce the above copyright
* notice, this list of conditions and the following disclaimer in the
* documentation and/or other materials provided with the distribution.
*
* THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
* ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
* FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
* OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
* LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
* OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
* SUCH DAMAGE.
*
* $FreeBSD$
*/
#include <sys/param.h>
#include <sys/capability.h>
#include <sys/socket.h>
#include <sys/sysctl.h>
#include <sys/un.h>
#include <sys/user.h>
#include <netinet/in.h>
#include <arpa/inet.h>
#include <err.h>
#include <libprocstat.h>
#include <inttypes.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include "procstat.h"
static const char *
protocol_to_string(int domain, int type, int protocol)
{
switch (domain) {
case AF_INET:
case AF_INET6:
switch (protocol) {
case IPPROTO_TCP:
return ("TCP");
case IPPROTO_UDP:
return ("UDP");
case IPPROTO_ICMP:
return ("ICM");
case IPPROTO_RAW:
return ("RAW");
case IPPROTO_SCTP:
return ("SCT");
case IPPROTO_DIVERT:
return ("IPD");
default:
return ("IP?");
}
case AF_LOCAL:
switch (type) {
case SOCK_STREAM:
return ("UDS");
case SOCK_DGRAM:
return ("UDD");
default:
return ("UD?");
}
default:
return ("?");
}
}
static void
addr_to_string(struct sockaddr_storage *ss, char *buffer, int buflen)
{
char buffer2[INET6_ADDRSTRLEN];
struct sockaddr_in6 *sin6;
struct sockaddr_in *sin;
struct sockaddr_un *sun;
switch (ss->ss_family) {
case AF_LOCAL:
sun = (struct sockaddr_un *)ss;
if (strlen(sun->sun_path) == 0)
strlcpy(buffer, "-", buflen);
else
strlcpy(buffer, sun->sun_path, buflen);
break;
case AF_INET:
sin = (struct sockaddr_in *)ss;
snprintf(buffer, buflen, "%s:%d", inet_ntoa(sin->sin_addr),
ntohs(sin->sin_port));
break;
case AF_INET6:
sin6 = (struct sockaddr_in6 *)ss;
if (inet_ntop(AF_INET6, &sin6->sin6_addr, buffer2,
sizeof(buffer2)) != NULL)
snprintf(buffer, buflen, "%s.%d", buffer2,
ntohs(sin6->sin6_port));
else
strlcpy(buffer, "-", sizeof(buffer));
break;
default:
strlcpy(buffer, "", buflen);
break;
}
}
static void
print_address(struct sockaddr_storage *ss)
{
char addr[PATH_MAX];
addr_to_string(ss, addr, sizeof(addr));
printf("%s", addr);
}
static struct cap_desc {
cap_rights_t cd_right;
const char *cd_desc;
} cap_desc[] = {
/* General file I/O. */
{ CAP_READ, "rd" },
{ CAP_WRITE, "wr" },
{ CAP_SEEK, "se" },
{ CAP_MMAP, "mm" },
{ CAP_CREATE, "cr" },
{ CAP_FEXECVE, "fe" },
{ CAP_FSYNC, "fy" },
{ CAP_FTRUNCATE, "ft" },
/* VFS methods. */
{ CAP_FCHDIR, "cd" },
{ CAP_FCHFLAGS, "cf" },
{ CAP_FCHMOD, "cm" },
{ CAP_FCHOWN, "cn" },
{ CAP_FCNTL, "fc" },
{ CAP_FLOCK, "fl" },
{ CAP_FPATHCONF, "fp" },
{ CAP_FSCK, "fk" },
{ CAP_FSTAT, "fs" },
{ CAP_FSTATFS, "sf" },
{ CAP_FUTIMES, "fu" },
{ CAP_LINKAT, "li" },
{ CAP_MKDIRAT, "md" },
{ CAP_MKFIFOAT, "mf" },
{ CAP_MKNODAT, "mn" },
{ CAP_RENAMEAT, "rn" },
{ CAP_SYMLINKAT, "sl" },
{ CAP_UNLINKAT, "un" },
/* Lookups - used to constrain *at() calls. */
{ CAP_LOOKUP, "lo" },
/* Extended attributes. */
{ CAP_EXTATTR_GET, "eg" },
{ CAP_EXTATTR_SET, "es" },
{ CAP_EXTATTR_DELETE, "ed" },
{ CAP_EXTATTR_LIST, "el" },
/* Access Control Lists. */
{ CAP_ACL_GET, "ag" },
{ CAP_ACL_SET, "as" },
{ CAP_ACL_DELETE, "ad" },
{ CAP_ACL_CHECK, "ac" },
/* Socket operations. */
{ CAP_ACCEPT, "at" },
{ CAP_BIND, "bd" },
{ CAP_CONNECT, "co" },
{ CAP_GETPEERNAME, "pn" },
{ CAP_GETSOCKNAME, "sn" },
{ CAP_GETSOCKOPT, "gs" },
{ CAP_LISTEN, "ln" },
{ CAP_PEELOFF, "pf" },
{ CAP_SETSOCKOPT, "ss" },
{ CAP_SHUTDOWN, "sh" },
/* Mandatory Access Control. */
{ CAP_MAC_GET, "mg" },
{ CAP_MAC_SET, "ms" },
/* Methods on semaphores. */
{ CAP_SEM_GETVALUE, "sg" },
{ CAP_SEM_POST, "sp" },
{ CAP_SEM_WAIT, "sw" },
/* Event monitoring and posting. */
{ CAP_POLL_EVENT, "po" },
{ CAP_POST_EVENT, "ev" },
/* Strange and powerful rights that should not be given lightly. */
{ CAP_IOCTL, "io" },
{ CAP_TTYHOOK, "ty" },
/* Process management via process descriptors. */
{ CAP_PDGETPID, "pg" },
{ CAP_PDWAIT, "pw" },
{ CAP_PDKILL, "pk" },
/* Aliases and defines that combine multiple rights. */
{ CAP_PREAD, "prd" },
{ CAP_PWRITE, "pwr" },
{ CAP_MMAP_R, "mmr" },
{ CAP_MMAP_W, "mmw" },
{ CAP_MMAP_X, "mmx" },
{ CAP_MMAP_RW, "mrw" },
{ CAP_MMAP_RX, "mrx" },
{ CAP_MMAP_WX, "mwx" },
{ CAP_MMAP_RWX, "mma" },
{ CAP_RECV, "re" },
{ CAP_SEND, "sd" },
{ CAP_SOCK_CLIENT, "scl" },
{ CAP_SOCK_SERVER, "ssr" },
};
static const u_int cap_desc_count = sizeof(cap_desc) /
sizeof(cap_desc[0]);
static u_int
width_capability(cap_rights_t rights)
{
u_int count, i, width;
count = 0;
width = 0;
for (i = 0; i < cap_desc_count; i++) {
if ((cap_desc[i].cd_right & ~rights) == 0) {
width += strlen(cap_desc[i].cd_desc);
if (count)
width++;
count++;
}
}
return (width);
}
static void
print_capability(cap_rights_t rights, u_int capwidth)
{
u_int count, i, width;
count = 0;
width = 0;
for (i = width_capability(rights); i < capwidth; i++) {
if (rights || i != 0)
printf(" ");
else
printf("-");
}
for (i = 0; i < cap_desc_count; i++) {
if ((cap_desc[i].cd_right & ~rights) == 0) {
printf("%s%s", count ? "," : "", cap_desc[i].cd_desc);
width += strlen(cap_desc[i].cd_desc);
if (count)
width++;
count++;
}
}
}
void
procstat_files(struct procstat *procstat, struct kinfo_proc *kipp)
{
struct sockstat sock;
struct filestat_list *head;
struct filestat *fst;
const char *str;
struct vnstat vn;
u_int capwidth, width;
int error;
/*
* To print the header in capability mode, we need to know the width
* of the widest capability string. Even if we get no processes
* back, we will print the header, so we defer aborting due to a lack
* of processes until after the header logic.
*/
capwidth = 0;
head = procstat_getfiles(procstat, kipp, 0);
if (head != NULL && Cflag) {
STAILQ_FOREACH(fst, head, next) {
width = width_capability(fst->fs_cap_rights);
if (width > capwidth)
capwidth = width;
}
if (capwidth < strlen("CAPABILITIES"))
capwidth = strlen("CAPABILITIES");
}
if (!hflag) {
if (Cflag)
printf("%5s %-16s %4s %1s %-9s %-*s "
"%-3s %-12s\n", "PID", "COMM", "FD", "T",
"FLAGS", capwidth, "CAPABILITIES", "PRO",
"NAME");
else
printf("%5s %-16s %4s %1s %1s %-9s "
"%3s %7s %-3s %-12s\n", "PID", "COMM", "FD", "T",
"V", "FLAGS", "REF", "OFFSET", "PRO", "NAME");
}
if (head == NULL)
return;
STAILQ_FOREACH(fst, head, next) {
printf("%5d ", kipp->ki_pid);
printf("%-16s ", kipp->ki_comm);
if (fst->fs_uflags & PS_FST_UFLAG_CTTY)
printf("ctty ");
else if (fst->fs_uflags & PS_FST_UFLAG_CDIR)
printf(" cwd ");
else if (fst->fs_uflags & PS_FST_UFLAG_JAIL)
printf("jail ");
else if (fst->fs_uflags & PS_FST_UFLAG_RDIR)
printf("root ");
else if (fst->fs_uflags & PS_FST_UFLAG_TEXT)
printf("text ");
else if (fst->fs_uflags & PS_FST_UFLAG_TRACE)
printf("trace ");
else
printf("%4d ", fst->fs_fd);
switch (fst->fs_type) {
case PS_FST_TYPE_VNODE:
str = "v";
break;
case PS_FST_TYPE_SOCKET:
str = "s";
break;
case PS_FST_TYPE_PIPE:
str = "p";
break;
case PS_FST_TYPE_FIFO:
str = "f";
break;
case PS_FST_TYPE_KQUEUE:
str = "k";
break;
case PS_FST_TYPE_CRYPTO:
str = "c";
break;
case PS_FST_TYPE_MQUEUE:
str = "m";
break;
case PS_FST_TYPE_SHM:
str = "h";
break;
case PS_FST_TYPE_PTS:
str = "t";
break;
case PS_FST_TYPE_SEM:
str = "e";
break;
case PS_FST_TYPE_NONE:
case PS_FST_TYPE_UNKNOWN:
default:
str = "?";
break;
}
printf("%1s ", str);
if (!Cflag) {
str = "-";
if (fst->fs_type == PS_FST_TYPE_VNODE) {
error = procstat_get_vnode_info(procstat, fst,
&vn, NULL);
switch (vn.vn_type) {
case PS_FST_VTYPE_VREG:
str = "r";
break;
case PS_FST_VTYPE_VDIR:
str = "d";
break;
case PS_FST_VTYPE_VBLK:
str = "b";
break;
case PS_FST_VTYPE_VCHR:
str = "c";
break;
case PS_FST_VTYPE_VLNK:
str = "l";
break;
case PS_FST_VTYPE_VSOCK:
str = "s";
break;
case PS_FST_VTYPE_VFIFO:
str = "f";
break;
case PS_FST_VTYPE_VBAD:
str = "x";
break;
case PS_FST_VTYPE_VNON:
case PS_FST_VTYPE_UNKNOWN:
default:
str = "?";
break;
}
}
printf("%1s ", str);
}
printf("%s", fst->fs_fflags & PS_FST_FFLAG_READ ? "r" : "-");
printf("%s", fst->fs_fflags & PS_FST_FFLAG_WRITE ? "w" : "-");
printf("%s", fst->fs_fflags & PS_FST_FFLAG_APPEND ? "a" : "-");
printf("%s", fst->fs_fflags & PS_FST_FFLAG_ASYNC ? "s" : "-");
printf("%s", fst->fs_fflags & PS_FST_FFLAG_SYNC ? "f" : "-");
printf("%s", fst->fs_fflags & PS_FST_FFLAG_NONBLOCK ? "n" : "-");
printf("%s", fst->fs_fflags & PS_FST_FFLAG_DIRECT ? "d" : "-");
printf("%s", fst->fs_fflags & PS_FST_FFLAG_HASLOCK ? "l" : "-");
if (!Cflag) {
if (fst->fs_ref_count > -1)
printf("%3d ", fst->fs_ref_count);
else
printf("%3c ", '-');
if (fst->fs_offset > -1)
printf("%7jd ", (intmax_t)fst->fs_offset);
else
printf("%7c ", '-');
}
if (Cflag) {
print_capability(fst->fs_cap_rights, capwidth);
printf(" ");
}
switch (fst->fs_type) {
case PS_FST_TYPE_SOCKET:
error = procstat_get_socket_info(procstat, fst, &sock, NULL);
if (error != 0)
break;
printf("%-3s ",
protocol_to_string(sock.dom_family,
sock.type, sock.proto));
/*
* While generally we like to print two addresses,
* local and peer, for sockets, it turns out to be
* more useful to print the first non-nul address for
* local sockets, as typically they aren't bound and
* connected, and the path strings can get long.
*/
if (sock.dom_family == AF_LOCAL) {
struct sockaddr_un *sun =
(struct sockaddr_un *)&sock.sa_local;
if (sun->sun_path[0] != 0)
print_address(&sock.sa_local);
else
print_address(&sock.sa_peer);
} else {
print_address(&sock.sa_local);
printf(" ");
print_address(&sock.sa_peer);
}
break;
default:
printf("%-3s ", "-");
printf("%-18s", fst->fs_path != NULL ? fst->fs_path : "-");
}
printf("\n");
}
procstat_freefiles(procstat, head);
}