d/freebsd-skq
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
33d2b813c3
freebsd-skq/sys/dev/filemon/filemon_wrapper.c

489 lines
14 KiB
C
Raw Normal View History

Add the 'filemon' device. 'filemon' is a kernel module that provides a device interface for processes to record system calls of its children. Submitted by: Juniper Networks.
2012-06-04 22:54:19 +00:00
/*-
* Copyright (c) 2011, David E. O'Brien.
* Copyright (c) 2009-2011, Juniper Networks, Inc.
Track filemon usage via a proc.p_filemon pointer rather than its own lists. - proc.p_filemon is added which is protected by PROC_LOCK. This improves performance and avoids double-fork issues, taking allproc_lock while in syscalls, and walking the process tree in syscalls. A particular proc.p_filemon can only be changed to NULL or another filemon, or the filemon inherited, while the filemon->lock is held. - Filemon are reference counted. On the last reference the log will be closed. - When closing the devfs file handle, the filemon will be detached from all processes and inheritance prevented. - Disallow attaching to a process already being traced since filemon is typically intended to be used on children only. This is allowed for curproc as bmake relies on this behavior for rare cases when combining .MAKE with .META. - Detach any previously tracked process on ioctl(FILEMON_SET_PID). - Handle error from devfs_set_cdevpriv() in filemon_open(). - The global filemon lock and lists are removed. - A free list is no longer kept. Previously this list was forever-expanding and never garbage cleaned. - No longer loses track of double-forks. If the process holding the filemon handle closes it will close the log rather than wait on a daemonized process, but it will log all activity until it closes its handle. The filemon will be removed from the process and not inherited. - A separate process count is kept only as an optimization for forced detachment to avoid taking allproc_lock and walking the entire process tree. - struct filemon access is protected by sx(9) filemon->lock as it was before. - Add more comments and KASSERTS. MFC after: 2 weeks Reviewed by: kib, mjg, markj (all on previous versions) Sponsored by: EMC / Isilon Storage Division Differential Revision: https://reviews.freebsd.org/D5520
2016-03-21 20:29:27 +00:00
* Copyright (c) 2015-2016, EMC Corp.
Add the 'filemon' device. 'filemon' is a kernel module that provides a device interface for processes to record system calls of its children. Submitted by: Juniper Networks.
2012-06-04 22:54:19 +00:00
* All rights reserved.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
* are met:
* 1. Redistributions of source code must retain the above copyright
* notice, this list of conditions and the following disclaimer.
* 2. Redistributions in binary form must reproduce the above copyright
* notice, this list of conditions and the following disclaimer in the
* documentation and/or other materials provided with the distribution.
*
* THIS SOFTWARE IS PROVIDED BY JUNIPER NETWORKS AND CONTRIBUTORS ``AS IS'' AND
* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
* ARE DISCLAIMED. IN NO EVENT SHALL JUNIPER NETWORKS OR CONTRIBUTORS BE LIABLE
* FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
* OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
* LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
* OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
* SUCH DAMAGE.
*/
#include <sys/cdefs.h>
__FBSDID("$FreeBSD$");
filemon: Use process_exec EVENTHANDLER to capture sys_execve. MFC after: 2 weeks Sponsored by: EMC / Isilon Storage Division
2016-01-28 21:45:25 +00:00
#include <sys/imgact.h>
filemon: Use process_exit EVENTHANDLER to capture process exit. This fixes some cases where a process could exit without being untracked by filemon. Reported by: mjg MFC after: 2 weeks Sponsored by: EMC / Isilon Storage Division
2016-01-28 00:51:17 +00:00
#include <sys/eventhandler.h>
filemon_pid_check needs to hold proctree_lock Reviewed by: kib MFC after: few days
2015-06-19 17:19:20 +00:00
#include <sys/sx.h>
filemon: Use process_exec EVENTHANDLER to capture sys_execve. MFC after: 2 weeks Sponsored by: EMC / Isilon Storage Division
2016-01-28 21:45:25 +00:00
#include <sys/vnode.h>
filemon_pid_check needs to hold proctree_lock Reviewed by: kib MFC after: few days
2015-06-19 17:19:20 +00:00
Match the options of the kernel.
2013-06-04 06:38:01 +00:00
#include "opt_compat.h"
filemon: Use process_exec EVENTHANDLER to capture sys_execve. MFC after: 2 weeks Sponsored by: EMC / Isilon Storage Division
2016-01-28 21:45:25 +00:00
static eventhandler_tag filemon_exec_tag;
filemon: Use process_exit EVENTHANDLER to capture process exit. This fixes some cases where a process could exit without being untracked by filemon. Reported by: mjg MFC after: 2 weeks Sponsored by: EMC / Isilon Storage Division
2016-01-28 00:51:17 +00:00
static eventhandler_tag filemon_exit_tag;
filemon: Trace fork via process_fork event. This avoids needing ugly hooks and needing both a vfork and fork handler. MFC after: 2 weeks Sponsored by: EMC / Isilon Storage Division
2016-01-28 01:17:55 +00:00
static eventhandler_tag filemon_fork_tag;
filemon: Use process_exit EVENTHANDLER to capture process exit. This fixes some cases where a process could exit without being untracked by filemon. Reported by: mjg MFC after: 2 weeks Sponsored by: EMC / Isilon Storage Division
2016-01-28 00:51:17 +00:00
Add the 'filemon' device. 'filemon' is a kernel module that provides a device interface for processes to record system calls of its children. Submitted by: Juniper Networks.
2012-06-04 22:54:19 +00:00
static void
filemon_output(struct filemon *filemon, char *msg, size_t len)
{
struct uio auio;
struct iovec aiov;
if (filemon->fp == NULL)
return;
aiov.iov_base = msg;
aiov.iov_len = len;
auio.uio_iov = &aiov;
auio.uio_iovcnt = 1;
auio.uio_resid = len;
auio.uio_segflg = UIO_SYSSPACE;
auio.uio_rw = UIO_WRITE;
auio.uio_td = curthread;
auio.uio_offset = (off_t) -1;
Only call bwillwrite() for logging to vnodes, as other fo_write() calls do. MFC after: 1 week Sponsored by: EMC / Isilon Storage Division
2016-03-07 21:10:19 +00:00
if (filemon->fp->f_type == DTYPE_VNODE)
bwillwrite();
Add the 'filemon' device. 'filemon' is a kernel module that provides a device interface for processes to record system calls of its children. Submitted by: Juniper Networks.
2012-06-04 22:54:19 +00:00
fo_write(filemon->fp, &auio, curthread->td_ucred, 0, curthread);
}
static int
filemon_wrapper_chdir(struct thread *td, struct chdir_args *uap)
{
int ret;
size_t done;
size_t len;
struct filemon *filemon;
if ((ret = sys_chdir(td, uap)) == 0) {
Track filemon usage via a proc.p_filemon pointer rather than its own lists. - proc.p_filemon is added which is protected by PROC_LOCK. This improves performance and avoids double-fork issues, taking allproc_lock while in syscalls, and walking the process tree in syscalls. A particular proc.p_filemon can only be changed to NULL or another filemon, or the filemon inherited, while the filemon->lock is held. - Filemon are reference counted. On the last reference the log will be closed. - When closing the devfs file handle, the filemon will be detached from all processes and inheritance prevented. - Disallow attaching to a process already being traced since filemon is typically intended to be used on children only. This is allowed for curproc as bmake relies on this behavior for rare cases when combining .MAKE with .META. - Detach any previously tracked process on ioctl(FILEMON_SET_PID). - Handle error from devfs_set_cdevpriv() in filemon_open(). - The global filemon lock and lists are removed. - A free list is no longer kept. Previously this list was forever-expanding and never garbage cleaned. - No longer loses track of double-forks. If the process holding the filemon handle closes it will close the log rather than wait on a daemonized process, but it will log all activity until it closes its handle. The filemon will be removed from the process and not inherited. - A separate process count is kept only as an optimization for forced detachment to avoid taking allproc_lock and walking the entire process tree. - struct filemon access is protected by sx(9) filemon->lock as it was before. - Add more comments and KASSERTS. MFC after: 2 weeks Reviewed by: kib, mjg, markj (all on previous versions) Sponsored by: EMC / Isilon Storage Division Differential Revision: https://reviews.freebsd.org/D5520
2016-03-21 20:29:27 +00:00
if ((filemon = filemon_proc_get(curproc)) != NULL) {
Add the 'filemon' device. 'filemon' is a kernel module that provides a device interface for processes to record system calls of its children. Submitted by: Juniper Networks.
2012-06-04 22:54:19 +00:00
copyinstr(uap->path, filemon->fname1,
sizeof(filemon->fname1), &done);
len = snprintf(filemon->msgbufr,
sizeof(filemon->msgbufr), "C %d %s\n",
curproc->p_pid, filemon->fname1);
filemon_output(filemon, filemon->msgbufr, len);
Track filemon usage via a proc.p_filemon pointer rather than its own lists. - proc.p_filemon is added which is protected by PROC_LOCK. This improves performance and avoids double-fork issues, taking allproc_lock while in syscalls, and walking the process tree in syscalls. A particular proc.p_filemon can only be changed to NULL or another filemon, or the filemon inherited, while the filemon->lock is held. - Filemon are reference counted. On the last reference the log will be closed. - When closing the devfs file handle, the filemon will be detached from all processes and inheritance prevented. - Disallow attaching to a process already being traced since filemon is typically intended to be used on children only. This is allowed for curproc as bmake relies on this behavior for rare cases when combining .MAKE with .META. - Detach any previously tracked process on ioctl(FILEMON_SET_PID). - Handle error from devfs_set_cdevpriv() in filemon_open(). - The global filemon lock and lists are removed. - A free list is no longer kept. Previously this list was forever-expanding and never garbage cleaned. - No longer loses track of double-forks. If the process holding the filemon handle closes it will close the log rather than wait on a daemonized process, but it will log all activity until it closes its handle. The filemon will be removed from the process and not inherited. - A separate process count is kept only as an optimization for forced detachment to avoid taking allproc_lock and walking the entire process tree. - struct filemon access is protected by sx(9) filemon->lock as it was before. - Add more comments and KASSERTS. MFC after: 2 weeks Reviewed by: kib, mjg, markj (all on previous versions) Sponsored by: EMC / Isilon Storage Division Differential Revision: https://reviews.freebsd.org/D5520
2016-03-21 20:29:27 +00:00
filemon_drop(filemon);
Add the 'filemon' device. 'filemon' is a kernel module that provides a device interface for processes to record system calls of its children. Submitted by: Juniper Networks.
2012-06-04 22:54:19 +00:00
}
}
return (ret);
}
filemon: Use process_exec EVENTHANDLER to capture sys_execve. MFC after: 2 weeks Sponsored by: EMC / Isilon Storage Division
2016-01-28 21:45:25 +00:00
static void
filemon_event_process_exec(void *arg __unused, struct proc *p,
struct image_params *imgp)
Add the 'filemon' device. 'filemon' is a kernel module that provides a device interface for processes to record system calls of its children. Submitted by: Juniper Networks.
2012-06-04 22:54:19 +00:00
{
struct filemon *filemon;
filemon: Use process_exec EVENTHANDLER to capture sys_execve. MFC after: 2 weeks Sponsored by: EMC / Isilon Storage Division
2016-01-28 21:45:25 +00:00
char *fullpath, *freepath;
size_t len;
Add the 'filemon' device. 'filemon' is a kernel module that provides a device interface for processes to record system calls of its children. Submitted by: Juniper Networks.
2012-06-04 22:54:19 +00:00
Track filemon usage via a proc.p_filemon pointer rather than its own lists. - proc.p_filemon is added which is protected by PROC_LOCK. This improves performance and avoids double-fork issues, taking allproc_lock while in syscalls, and walking the process tree in syscalls. A particular proc.p_filemon can only be changed to NULL or another filemon, or the filemon inherited, while the filemon->lock is held. - Filemon are reference counted. On the last reference the log will be closed. - When closing the devfs file handle, the filemon will be detached from all processes and inheritance prevented. - Disallow attaching to a process already being traced since filemon is typically intended to be used on children only. This is allowed for curproc as bmake relies on this behavior for rare cases when combining .MAKE with .META. - Detach any previously tracked process on ioctl(FILEMON_SET_PID). - Handle error from devfs_set_cdevpriv() in filemon_open(). - The global filemon lock and lists are removed. - A free list is no longer kept. Previously this list was forever-expanding and never garbage cleaned. - No longer loses track of double-forks. If the process holding the filemon handle closes it will close the log rather than wait on a daemonized process, but it will log all activity until it closes its handle. The filemon will be removed from the process and not inherited. - A separate process count is kept only as an optimization for forced detachment to avoid taking allproc_lock and walking the entire process tree. - struct filemon access is protected by sx(9) filemon->lock as it was before. - Add more comments and KASSERTS. MFC after: 2 weeks Reviewed by: kib, mjg, markj (all on previous versions) Sponsored by: EMC / Isilon Storage Division Differential Revision: https://reviews.freebsd.org/D5520
2016-03-21 20:29:27 +00:00
if ((filemon = filemon_proc_get(p)) != NULL) {
filemon: Use process_exec EVENTHANDLER to capture sys_execve. MFC after: 2 weeks Sponsored by: EMC / Isilon Storage Division
2016-01-28 21:45:25 +00:00
fullpath = "<unknown>";
freepath = NULL;
Add the 'filemon' device. 'filemon' is a kernel module that provides a device interface for processes to record system calls of its children. Submitted by: Juniper Networks.
2012-06-04 22:54:19 +00:00
filemon: Use process_exec EVENTHANDLER to capture sys_execve. MFC after: 2 weeks Sponsored by: EMC / Isilon Storage Division
2016-01-28 21:45:25 +00:00
vn_fullpath(FIRST_THREAD_IN_PROC(p), imgp->vp, &fullpath,
&freepath);
Add the 'filemon' device. 'filemon' is a kernel module that provides a device interface for processes to record system calls of its children. Submitted by: Juniper Networks.
2012-06-04 22:54:19 +00:00
filemon: Use process_exec EVENTHANDLER to capture sys_execve. MFC after: 2 weeks Sponsored by: EMC / Isilon Storage Division
2016-01-28 21:45:25 +00:00
len = snprintf(filemon->msgbufr,
sizeof(filemon->msgbufr), "E %d %s\n",
p->p_pid, fullpath);
Add the 'filemon' device. 'filemon' is a kernel module that provides a device interface for processes to record system calls of its children. Submitted by: Juniper Networks.
2012-06-04 22:54:19 +00:00
filemon: Use process_exec EVENTHANDLER to capture sys_execve. MFC after: 2 weeks Sponsored by: EMC / Isilon Storage Division
2016-01-28 21:45:25 +00:00
filemon_output(filemon, filemon->msgbufr, len);
Add the 'filemon' device. 'filemon' is a kernel module that provides a device interface for processes to record system calls of its children. Submitted by: Juniper Networks.
2012-06-04 22:54:19 +00:00
Track filemon usage via a proc.p_filemon pointer rather than its own lists. - proc.p_filemon is added which is protected by PROC_LOCK. This improves performance and avoids double-fork issues, taking allproc_lock while in syscalls, and walking the process tree in syscalls. A particular proc.p_filemon can only be changed to NULL or another filemon, or the filemon inherited, while the filemon->lock is held. - Filemon are reference counted. On the last reference the log will be closed. - When closing the devfs file handle, the filemon will be detached from all processes and inheritance prevented. - Disallow attaching to a process already being traced since filemon is typically intended to be used on children only. This is allowed for curproc as bmake relies on this behavior for rare cases when combining .MAKE with .META. - Detach any previously tracked process on ioctl(FILEMON_SET_PID). - Handle error from devfs_set_cdevpriv() in filemon_open(). - The global filemon lock and lists are removed. - A free list is no longer kept. Previously this list was forever-expanding and never garbage cleaned. - No longer loses track of double-forks. If the process holding the filemon handle closes it will close the log rather than wait on a daemonized process, but it will log all activity until it closes its handle. The filemon will be removed from the process and not inherited. - A separate process count is kept only as an optimization for forced detachment to avoid taking allproc_lock and walking the entire process tree. - struct filemon access is protected by sx(9) filemon->lock as it was before. - Add more comments and KASSERTS. MFC after: 2 weeks Reviewed by: kib, mjg, markj (all on previous versions) Sponsored by: EMC / Isilon Storage Division Differential Revision: https://reviews.freebsd.org/D5520
2016-03-21 20:29:27 +00:00
filemon_drop(filemon);
Add the 'filemon' device. 'filemon' is a kernel module that provides a device interface for processes to record system calls of its children. Submitted by: Juniper Networks.
2012-06-04 22:54:19 +00:00
filemon: Use process_exec EVENTHANDLER to capture sys_execve. MFC after: 2 weeks Sponsored by: EMC / Isilon Storage Division
2016-01-28 21:45:25 +00:00
free(freepath, M_TEMP);
Add the 'filemon' device. 'filemon' is a kernel module that provides a device interface for processes to record system calls of its children. Submitted by: Juniper Networks.
2012-06-04 22:54:19 +00:00
}
}
static int
filemon_wrapper_open(struct thread *td, struct open_args *uap)
{
int ret;
size_t done;
size_t len;
struct filemon *filemon;
if ((ret = sys_open(td, uap)) == 0) {
Track filemon usage via a proc.p_filemon pointer rather than its own lists. - proc.p_filemon is added which is protected by PROC_LOCK. This improves performance and avoids double-fork issues, taking allproc_lock while in syscalls, and walking the process tree in syscalls. A particular proc.p_filemon can only be changed to NULL or another filemon, or the filemon inherited, while the filemon->lock is held. - Filemon are reference counted. On the last reference the log will be closed. - When closing the devfs file handle, the filemon will be detached from all processes and inheritance prevented. - Disallow attaching to a process already being traced since filemon is typically intended to be used on children only. This is allowed for curproc as bmake relies on this behavior for rare cases when combining .MAKE with .META. - Detach any previously tracked process on ioctl(FILEMON_SET_PID). - Handle error from devfs_set_cdevpriv() in filemon_open(). - The global filemon lock and lists are removed. - A free list is no longer kept. Previously this list was forever-expanding and never garbage cleaned. - No longer loses track of double-forks. If the process holding the filemon handle closes it will close the log rather than wait on a daemonized process, but it will log all activity until it closes its handle. The filemon will be removed from the process and not inherited. - A separate process count is kept only as an optimization for forced detachment to avoid taking allproc_lock and walking the entire process tree. - struct filemon access is protected by sx(9) filemon->lock as it was before. - Add more comments and KASSERTS. MFC after: 2 weeks Reviewed by: kib, mjg, markj (all on previous versions) Sponsored by: EMC / Isilon Storage Division Differential Revision: https://reviews.freebsd.org/D5520
2016-03-21 20:29:27 +00:00
if ((filemon = filemon_proc_get(curproc)) != NULL) {
Add the 'filemon' device. 'filemon' is a kernel module that provides a device interface for processes to record system calls of its children. Submitted by: Juniper Networks.
2012-06-04 22:54:19 +00:00
copyinstr(uap->path, filemon->fname1,
sizeof(filemon->fname1), &done);
if (uap->flags & O_RDWR) {
/*
* We'll get the W record below, but need
* to also output an R to distingish from
* O_WRONLY.
*/
len = snprintf(filemon->msgbufr,
sizeof(filemon->msgbufr), "R %d %s\n",
curproc->p_pid, filemon->fname1);
filemon_output(filemon, filemon->msgbufr, len);
}
len = snprintf(filemon->msgbufr,
sizeof(filemon->msgbufr), "%c %d %s\n",
(uap->flags & O_ACCMODE) ? 'W':'R',
curproc->p_pid, filemon->fname1);
filemon_output(filemon, filemon->msgbufr, len);
Track filemon usage via a proc.p_filemon pointer rather than its own lists. - proc.p_filemon is added which is protected by PROC_LOCK. This improves performance and avoids double-fork issues, taking allproc_lock while in syscalls, and walking the process tree in syscalls. A particular proc.p_filemon can only be changed to NULL or another filemon, or the filemon inherited, while the filemon->lock is held. - Filemon are reference counted. On the last reference the log will be closed. - When closing the devfs file handle, the filemon will be detached from all processes and inheritance prevented. - Disallow attaching to a process already being traced since filemon is typically intended to be used on children only. This is allowed for curproc as bmake relies on this behavior for rare cases when combining .MAKE with .META. - Detach any previously tracked process on ioctl(FILEMON_SET_PID). - Handle error from devfs_set_cdevpriv() in filemon_open(). - The global filemon lock and lists are removed. - A free list is no longer kept. Previously this list was forever-expanding and never garbage cleaned. - No longer loses track of double-forks. If the process holding the filemon handle closes it will close the log rather than wait on a daemonized process, but it will log all activity until it closes its handle. The filemon will be removed from the process and not inherited. - A separate process count is kept only as an optimization for forced detachment to avoid taking allproc_lock and walking the entire process tree. - struct filemon access is protected by sx(9) filemon->lock as it was before. - Add more comments and KASSERTS. MFC after: 2 weeks Reviewed by: kib, mjg, markj (all on previous versions) Sponsored by: EMC / Isilon Storage Division Differential Revision: https://reviews.freebsd.org/D5520
2016-03-21 20:29:27 +00:00
filemon_drop(filemon);
Add the 'filemon' device. 'filemon' is a kernel module that provides a device interface for processes to record system calls of its children. Submitted by: Juniper Networks.
2012-06-04 22:54:19 +00:00
}
}
return (ret);
}
Latest clang uses openat(2). If the pathname is absolute or dirfd is AT_FDCWD we can handle it exactly like open(2). Otherwise we output an A record to indicate that the path of an open directory needs to be used (earlier in the trace). Differential Revision: D2810 Reviewed by: jhb MFC after: a bit
2015-06-14 16:31:06 +00:00
static int
filemon_wrapper_openat(struct thread *td, struct openat_args *uap)
{
int ret;
size_t done;
size_t len;
struct filemon *filemon;
if ((ret = sys_openat(td, uap)) == 0) {
Track filemon usage via a proc.p_filemon pointer rather than its own lists. - proc.p_filemon is added which is protected by PROC_LOCK. This improves performance and avoids double-fork issues, taking allproc_lock while in syscalls, and walking the process tree in syscalls. A particular proc.p_filemon can only be changed to NULL or another filemon, or the filemon inherited, while the filemon->lock is held. - Filemon are reference counted. On the last reference the log will be closed. - When closing the devfs file handle, the filemon will be detached from all processes and inheritance prevented. - Disallow attaching to a process already being traced since filemon is typically intended to be used on children only. This is allowed for curproc as bmake relies on this behavior for rare cases when combining .MAKE with .META. - Detach any previously tracked process on ioctl(FILEMON_SET_PID). - Handle error from devfs_set_cdevpriv() in filemon_open(). - The global filemon lock and lists are removed. - A free list is no longer kept. Previously this list was forever-expanding and never garbage cleaned. - No longer loses track of double-forks. If the process holding the filemon handle closes it will close the log rather than wait on a daemonized process, but it will log all activity until it closes its handle. The filemon will be removed from the process and not inherited. - A separate process count is kept only as an optimization for forced detachment to avoid taking allproc_lock and walking the entire process tree. - struct filemon access is protected by sx(9) filemon->lock as it was before. - Add more comments and KASSERTS. MFC after: 2 weeks Reviewed by: kib, mjg, markj (all on previous versions) Sponsored by: EMC / Isilon Storage Division Differential Revision: https://reviews.freebsd.org/D5520
2016-03-21 20:29:27 +00:00
if ((filemon = filemon_proc_get(curproc)) != NULL) {
Latest clang uses openat(2). If the pathname is absolute or dirfd is AT_FDCWD we can handle it exactly like open(2). Otherwise we output an A record to indicate that the path of an open directory needs to be used (earlier in the trace). Differential Revision: D2810 Reviewed by: jhb MFC after: a bit
2015-06-14 16:31:06 +00:00
copyinstr(uap->path, filemon->fname1,
sizeof(filemon->fname1), &done);
filemon->fname2[0] = '\0';
if (filemon->fname1[0] != '/' && uap->fd != AT_FDCWD) {
/*
* rats - we cannot do too much about this.
* the trace should show a dir we read
* recently.. output an A record as a clue
* until we can do better.
*/
len = snprintf(filemon->msgbufr,
sizeof(filemon->msgbufr), "A %d %s\n",
curproc->p_pid, filemon->fname1);
filemon_output(filemon, filemon->msgbufr, len);
}
if (uap->flag & O_RDWR) {
/*
* We'll get the W record below, but need
* to also output an R to distingish from
* O_WRONLY.
*/
len = snprintf(filemon->msgbufr,
sizeof(filemon->msgbufr), "R %d %s%s\n",
curproc->p_pid, filemon->fname2, filemon->fname1);
filemon_output(filemon, filemon->msgbufr, len);
}
len = snprintf(filemon->msgbufr,
sizeof(filemon->msgbufr), "%c %d %s%s\n",
(uap->flag & O_ACCMODE) ? 'W':'R',
curproc->p_pid, filemon->fname2, filemon->fname1);
filemon_output(filemon, filemon->msgbufr, len);
Track filemon usage via a proc.p_filemon pointer rather than its own lists. - proc.p_filemon is added which is protected by PROC_LOCK. This improves performance and avoids double-fork issues, taking allproc_lock while in syscalls, and walking the process tree in syscalls. A particular proc.p_filemon can only be changed to NULL or another filemon, or the filemon inherited, while the filemon->lock is held. - Filemon are reference counted. On the last reference the log will be closed. - When closing the devfs file handle, the filemon will be detached from all processes and inheritance prevented. - Disallow attaching to a process already being traced since filemon is typically intended to be used on children only. This is allowed for curproc as bmake relies on this behavior for rare cases when combining .MAKE with .META. - Detach any previously tracked process on ioctl(FILEMON_SET_PID). - Handle error from devfs_set_cdevpriv() in filemon_open(). - The global filemon lock and lists are removed. - A free list is no longer kept. Previously this list was forever-expanding and never garbage cleaned. - No longer loses track of double-forks. If the process holding the filemon handle closes it will close the log rather than wait on a daemonized process, but it will log all activity until it closes its handle. The filemon will be removed from the process and not inherited. - A separate process count is kept only as an optimization for forced detachment to avoid taking allproc_lock and walking the entire process tree. - struct filemon access is protected by sx(9) filemon->lock as it was before. - Add more comments and KASSERTS. MFC after: 2 weeks Reviewed by: kib, mjg, markj (all on previous versions) Sponsored by: EMC / Isilon Storage Division Differential Revision: https://reviews.freebsd.org/D5520
2016-03-21 20:29:27 +00:00
filemon_drop(filemon);
Latest clang uses openat(2). If the pathname is absolute or dirfd is AT_FDCWD we can handle it exactly like open(2). Otherwise we output an A record to indicate that the path of an open directory needs to be used (earlier in the trace). Differential Revision: D2810 Reviewed by: jhb MFC after: a bit
2015-06-14 16:31:06 +00:00
}
}
return (ret);
}
Add the 'filemon' device. 'filemon' is a kernel module that provides a device interface for processes to record system calls of its children. Submitted by: Juniper Networks.
2012-06-04 22:54:19 +00:00
static int
filemon_wrapper_rename(struct thread *td, struct rename_args *uap)
{
int ret;
size_t done;
size_t len;
struct filemon *filemon;
if ((ret = sys_rename(td, uap)) == 0) {
Track filemon usage via a proc.p_filemon pointer rather than its own lists. - proc.p_filemon is added which is protected by PROC_LOCK. This improves performance and avoids double-fork issues, taking allproc_lock while in syscalls, and walking the process tree in syscalls. A particular proc.p_filemon can only be changed to NULL or another filemon, or the filemon inherited, while the filemon->lock is held. - Filemon are reference counted. On the last reference the log will be closed. - When closing the devfs file handle, the filemon will be detached from all processes and inheritance prevented. - Disallow attaching to a process already being traced since filemon is typically intended to be used on children only. This is allowed for curproc as bmake relies on this behavior for rare cases when combining .MAKE with .META. - Detach any previously tracked process on ioctl(FILEMON_SET_PID). - Handle error from devfs_set_cdevpriv() in filemon_open(). - The global filemon lock and lists are removed. - A free list is no longer kept. Previously this list was forever-expanding and never garbage cleaned. - No longer loses track of double-forks. If the process holding the filemon handle closes it will close the log rather than wait on a daemonized process, but it will log all activity until it closes its handle. The filemon will be removed from the process and not inherited. - A separate process count is kept only as an optimization for forced detachment to avoid taking allproc_lock and walking the entire process tree. - struct filemon access is protected by sx(9) filemon->lock as it was before. - Add more comments and KASSERTS. MFC after: 2 weeks Reviewed by: kib, mjg, markj (all on previous versions) Sponsored by: EMC / Isilon Storage Division Differential Revision: https://reviews.freebsd.org/D5520
2016-03-21 20:29:27 +00:00
if ((filemon = filemon_proc_get(curproc)) != NULL) {
Add the 'filemon' device. 'filemon' is a kernel module that provides a device interface for processes to record system calls of its children. Submitted by: Juniper Networks.
2012-06-04 22:54:19 +00:00
copyinstr(uap->from, filemon->fname1,
sizeof(filemon->fname1), &done);
copyinstr(uap->to, filemon->fname2,
sizeof(filemon->fname2), &done);
len = snprintf(filemon->msgbufr,
sizeof(filemon->msgbufr), "M %d '%s' '%s'\n",
curproc->p_pid, filemon->fname1, filemon->fname2);
filemon_output(filemon, filemon->msgbufr, len);
Track filemon usage via a proc.p_filemon pointer rather than its own lists. - proc.p_filemon is added which is protected by PROC_LOCK. This improves performance and avoids double-fork issues, taking allproc_lock while in syscalls, and walking the process tree in syscalls. A particular proc.p_filemon can only be changed to NULL or another filemon, or the filemon inherited, while the filemon->lock is held. - Filemon are reference counted. On the last reference the log will be closed. - When closing the devfs file handle, the filemon will be detached from all processes and inheritance prevented. - Disallow attaching to a process already being traced since filemon is typically intended to be used on children only. This is allowed for curproc as bmake relies on this behavior for rare cases when combining .MAKE with .META. - Detach any previously tracked process on ioctl(FILEMON_SET_PID). - Handle error from devfs_set_cdevpriv() in filemon_open(). - The global filemon lock and lists are removed. - A free list is no longer kept. Previously this list was forever-expanding and never garbage cleaned. - No longer loses track of double-forks. If the process holding the filemon handle closes it will close the log rather than wait on a daemonized process, but it will log all activity until it closes its handle. The filemon will be removed from the process and not inherited. - A separate process count is kept only as an optimization for forced detachment to avoid taking allproc_lock and walking the entire process tree. - struct filemon access is protected by sx(9) filemon->lock as it was before. - Add more comments and KASSERTS. MFC after: 2 weeks Reviewed by: kib, mjg, markj (all on previous versions) Sponsored by: EMC / Isilon Storage Division Differential Revision: https://reviews.freebsd.org/D5520
2016-03-21 20:29:27 +00:00
filemon_drop(filemon);
Add the 'filemon' device. 'filemon' is a kernel module that provides a device interface for processes to record system calls of its children. Submitted by: Juniper Networks.
2012-06-04 22:54:19 +00:00
}
}
return (ret);
}
static int
filemon_wrapper_link(struct thread *td, struct link_args *uap)
{
int ret;
size_t done;
size_t len;
struct filemon *filemon;
if ((ret = sys_link(td, uap)) == 0) {
Track filemon usage via a proc.p_filemon pointer rather than its own lists. - proc.p_filemon is added which is protected by PROC_LOCK. This improves performance and avoids double-fork issues, taking allproc_lock while in syscalls, and walking the process tree in syscalls. A particular proc.p_filemon can only be changed to NULL or another filemon, or the filemon inherited, while the filemon->lock is held. - Filemon are reference counted. On the last reference the log will be closed. - When closing the devfs file handle, the filemon will be detached from all processes and inheritance prevented. - Disallow attaching to a process already being traced since filemon is typically intended to be used on children only. This is allowed for curproc as bmake relies on this behavior for rare cases when combining .MAKE with .META. - Detach any previously tracked process on ioctl(FILEMON_SET_PID). - Handle error from devfs_set_cdevpriv() in filemon_open(). - The global filemon lock and lists are removed. - A free list is no longer kept. Previously this list was forever-expanding and never garbage cleaned. - No longer loses track of double-forks. If the process holding the filemon handle closes it will close the log rather than wait on a daemonized process, but it will log all activity until it closes its handle. The filemon will be removed from the process and not inherited. - A separate process count is kept only as an optimization for forced detachment to avoid taking allproc_lock and walking the entire process tree. - struct filemon access is protected by sx(9) filemon->lock as it was before. - Add more comments and KASSERTS. MFC after: 2 weeks Reviewed by: kib, mjg, markj (all on previous versions) Sponsored by: EMC / Isilon Storage Division Differential Revision: https://reviews.freebsd.org/D5520
2016-03-21 20:29:27 +00:00
if ((filemon = filemon_proc_get(curproc)) != NULL) {
Add the 'filemon' device. 'filemon' is a kernel module that provides a device interface for processes to record system calls of its children. Submitted by: Juniper Networks.
2012-06-04 22:54:19 +00:00
copyinstr(uap->path, filemon->fname1,
sizeof(filemon->fname1), &done);
copyinstr(uap->link, filemon->fname2,
sizeof(filemon->fname2), &done);
len = snprintf(filemon->msgbufr,
sizeof(filemon->msgbufr), "L %d '%s' '%s'\n",
curproc->p_pid, filemon->fname1, filemon->fname2);
filemon_output(filemon, filemon->msgbufr, len);
Track filemon usage via a proc.p_filemon pointer rather than its own lists. - proc.p_filemon is added which is protected by PROC_LOCK. This improves performance and avoids double-fork issues, taking allproc_lock while in syscalls, and walking the process tree in syscalls. A particular proc.p_filemon can only be changed to NULL or another filemon, or the filemon inherited, while the filemon->lock is held. - Filemon are reference counted. On the last reference the log will be closed. - When closing the devfs file handle, the filemon will be detached from all processes and inheritance prevented. - Disallow attaching to a process already being traced since filemon is typically intended to be used on children only. This is allowed for curproc as bmake relies on this behavior for rare cases when combining .MAKE with .META. - Detach any previously tracked process on ioctl(FILEMON_SET_PID). - Handle error from devfs_set_cdevpriv() in filemon_open(). - The global filemon lock and lists are removed. - A free list is no longer kept. Previously this list was forever-expanding and never garbage cleaned. - No longer loses track of double-forks. If the process holding the filemon handle closes it will close the log rather than wait on a daemonized process, but it will log all activity until it closes its handle. The filemon will be removed from the process and not inherited. - A separate process count is kept only as an optimization for forced detachment to avoid taking allproc_lock and walking the entire process tree. - struct filemon access is protected by sx(9) filemon->lock as it was before. - Add more comments and KASSERTS. MFC after: 2 weeks Reviewed by: kib, mjg, markj (all on previous versions) Sponsored by: EMC / Isilon Storage Division Differential Revision: https://reviews.freebsd.org/D5520
2016-03-21 20:29:27 +00:00
filemon_drop(filemon);
Add the 'filemon' device. 'filemon' is a kernel module that provides a device interface for processes to record system calls of its children. Submitted by: Juniper Networks.
2012-06-04 22:54:19 +00:00
}
}
return (ret);
}
static int
filemon_wrapper_symlink(struct thread *td, struct symlink_args *uap)
{
int ret;
size_t done;
size_t len;
struct filemon *filemon;
if ((ret = sys_symlink(td, uap)) == 0) {
Track filemon usage via a proc.p_filemon pointer rather than its own lists. - proc.p_filemon is added which is protected by PROC_LOCK. This improves performance and avoids double-fork issues, taking allproc_lock while in syscalls, and walking the process tree in syscalls. A particular proc.p_filemon can only be changed to NULL or another filemon, or the filemon inherited, while the filemon->lock is held. - Filemon are reference counted. On the last reference the log will be closed. - When closing the devfs file handle, the filemon will be detached from all processes and inheritance prevented. - Disallow attaching to a process already being traced since filemon is typically intended to be used on children only. This is allowed for curproc as bmake relies on this behavior for rare cases when combining .MAKE with .META. - Detach any previously tracked process on ioctl(FILEMON_SET_PID). - Handle error from devfs_set_cdevpriv() in filemon_open(). - The global filemon lock and lists are removed. - A free list is no longer kept. Previously this list was forever-expanding and never garbage cleaned. - No longer loses track of double-forks. If the process holding the filemon handle closes it will close the log rather than wait on a daemonized process, but it will log all activity until it closes its handle. The filemon will be removed from the process and not inherited. - A separate process count is kept only as an optimization for forced detachment to avoid taking allproc_lock and walking the entire process tree. - struct filemon access is protected by sx(9) filemon->lock as it was before. - Add more comments and KASSERTS. MFC after: 2 weeks Reviewed by: kib, mjg, markj (all on previous versions) Sponsored by: EMC / Isilon Storage Division Differential Revision: https://reviews.freebsd.org/D5520
2016-03-21 20:29:27 +00:00
if ((filemon = filemon_proc_get(curproc)) != NULL) {
Add the 'filemon' device. 'filemon' is a kernel module that provides a device interface for processes to record system calls of its children. Submitted by: Juniper Networks.
2012-06-04 22:54:19 +00:00
copyinstr(uap->path, filemon->fname1,
sizeof(filemon->fname1), &done);
copyinstr(uap->link, filemon->fname2,
sizeof(filemon->fname2), &done);
len = snprintf(filemon->msgbufr,
sizeof(filemon->msgbufr), "L %d '%s' '%s'\n",
curproc->p_pid, filemon->fname1, filemon->fname2);
filemon_output(filemon, filemon->msgbufr, len);
Track filemon usage via a proc.p_filemon pointer rather than its own lists. - proc.p_filemon is added which is protected by PROC_LOCK. This improves performance and avoids double-fork issues, taking allproc_lock while in syscalls, and walking the process tree in syscalls. A particular proc.p_filemon can only be changed to NULL or another filemon, or the filemon inherited, while the filemon->lock is held. - Filemon are reference counted. On the last reference the log will be closed. - When closing the devfs file handle, the filemon will be detached from all processes and inheritance prevented. - Disallow attaching to a process already being traced since filemon is typically intended to be used on children only. This is allowed for curproc as bmake relies on this behavior for rare cases when combining .MAKE with .META. - Detach any previously tracked process on ioctl(FILEMON_SET_PID). - Handle error from devfs_set_cdevpriv() in filemon_open(). - The global filemon lock and lists are removed. - A free list is no longer kept. Previously this list was forever-expanding and never garbage cleaned. - No longer loses track of double-forks. If the process holding the filemon handle closes it will close the log rather than wait on a daemonized process, but it will log all activity until it closes its handle. The filemon will be removed from the process and not inherited. - A separate process count is kept only as an optimization for forced detachment to avoid taking allproc_lock and walking the entire process tree. - struct filemon access is protected by sx(9) filemon->lock as it was before. - Add more comments and KASSERTS. MFC after: 2 weeks Reviewed by: kib, mjg, markj (all on previous versions) Sponsored by: EMC / Isilon Storage Division Differential Revision: https://reviews.freebsd.org/D5520
2016-03-21 20:29:27 +00:00
filemon_drop(filemon);
Add the 'filemon' device. 'filemon' is a kernel module that provides a device interface for processes to record system calls of its children. Submitted by: Juniper Networks.
2012-06-04 22:54:19 +00:00
}
}
return (ret);
}
static int
filemon_wrapper_linkat(struct thread *td, struct linkat_args *uap)
{
int ret;
size_t done;
size_t len;
struct filemon *filemon;
if ((ret = sys_linkat(td, uap)) == 0) {
Track filemon usage via a proc.p_filemon pointer rather than its own lists. - proc.p_filemon is added which is protected by PROC_LOCK. This improves performance and avoids double-fork issues, taking allproc_lock while in syscalls, and walking the process tree in syscalls. A particular proc.p_filemon can only be changed to NULL or another filemon, or the filemon inherited, while the filemon->lock is held. - Filemon are reference counted. On the last reference the log will be closed. - When closing the devfs file handle, the filemon will be detached from all processes and inheritance prevented. - Disallow attaching to a process already being traced since filemon is typically intended to be used on children only. This is allowed for curproc as bmake relies on this behavior for rare cases when combining .MAKE with .META. - Detach any previously tracked process on ioctl(FILEMON_SET_PID). - Handle error from devfs_set_cdevpriv() in filemon_open(). - The global filemon lock and lists are removed. - A free list is no longer kept. Previously this list was forever-expanding and never garbage cleaned. - No longer loses track of double-forks. If the process holding the filemon handle closes it will close the log rather than wait on a daemonized process, but it will log all activity until it closes its handle. The filemon will be removed from the process and not inherited. - A separate process count is kept only as an optimization for forced detachment to avoid taking allproc_lock and walking the entire process tree. - struct filemon access is protected by sx(9) filemon->lock as it was before. - Add more comments and KASSERTS. MFC after: 2 weeks Reviewed by: kib, mjg, markj (all on previous versions) Sponsored by: EMC / Isilon Storage Division Differential Revision: https://reviews.freebsd.org/D5520
2016-03-21 20:29:27 +00:00
if ((filemon = filemon_proc_get(curproc)) != NULL) {
Add the 'filemon' device. 'filemon' is a kernel module that provides a device interface for processes to record system calls of its children. Submitted by: Juniper Networks.
2012-06-04 22:54:19 +00:00
copyinstr(uap->path1, filemon->fname1,
sizeof(filemon->fname1), &done);
copyinstr(uap->path2, filemon->fname2,
sizeof(filemon->fname2), &done);
len = snprintf(filemon->msgbufr,
sizeof(filemon->msgbufr), "L %d '%s' '%s'\n",
curproc->p_pid, filemon->fname1, filemon->fname2);
filemon_output(filemon, filemon->msgbufr, len);
Track filemon usage via a proc.p_filemon pointer rather than its own lists. - proc.p_filemon is added which is protected by PROC_LOCK. This improves performance and avoids double-fork issues, taking allproc_lock while in syscalls, and walking the process tree in syscalls. A particular proc.p_filemon can only be changed to NULL or another filemon, or the filemon inherited, while the filemon->lock is held. - Filemon are reference counted. On the last reference the log will be closed. - When closing the devfs file handle, the filemon will be detached from all processes and inheritance prevented. - Disallow attaching to a process already being traced since filemon is typically intended to be used on children only. This is allowed for curproc as bmake relies on this behavior for rare cases when combining .MAKE with .META. - Detach any previously tracked process on ioctl(FILEMON_SET_PID). - Handle error from devfs_set_cdevpriv() in filemon_open(). - The global filemon lock and lists are removed. - A free list is no longer kept. Previously this list was forever-expanding and never garbage cleaned. - No longer loses track of double-forks. If the process holding the filemon handle closes it will close the log rather than wait on a daemonized process, but it will log all activity until it closes its handle. The filemon will be removed from the process and not inherited. - A separate process count is kept only as an optimization for forced detachment to avoid taking allproc_lock and walking the entire process tree. - struct filemon access is protected by sx(9) filemon->lock as it was before. - Add more comments and KASSERTS. MFC after: 2 weeks Reviewed by: kib, mjg, markj (all on previous versions) Sponsored by: EMC / Isilon Storage Division Differential Revision: https://reviews.freebsd.org/D5520
2016-03-21 20:29:27 +00:00
filemon_drop(filemon);
Add the 'filemon' device. 'filemon' is a kernel module that provides a device interface for processes to record system calls of its children. Submitted by: Juniper Networks.
2012-06-04 22:54:19 +00:00
}
}
return (ret);
}
static void
filemon: Use process_exit EVENTHANDLER to capture process exit. This fixes some cases where a process could exit without being untracked by filemon. Reported by: mjg MFC after: 2 weeks Sponsored by: EMC / Isilon Storage Division
2016-01-28 00:51:17 +00:00
filemon_event_process_exit(void *arg __unused, struct proc *p)
Add the 'filemon' device. 'filemon' is a kernel module that provides a device interface for processes to record system calls of its children. Submitted by: Juniper Networks.
2012-06-04 22:54:19 +00:00
{
size_t len;
struct filemon *filemon;
Track filemon usage via a proc.p_filemon pointer rather than its own lists. - proc.p_filemon is added which is protected by PROC_LOCK. This improves performance and avoids double-fork issues, taking allproc_lock while in syscalls, and walking the process tree in syscalls. A particular proc.p_filemon can only be changed to NULL or another filemon, or the filemon inherited, while the filemon->lock is held. - Filemon are reference counted. On the last reference the log will be closed. - When closing the devfs file handle, the filemon will be detached from all processes and inheritance prevented. - Disallow attaching to a process already being traced since filemon is typically intended to be used on children only. This is allowed for curproc as bmake relies on this behavior for rare cases when combining .MAKE with .META. - Detach any previously tracked process on ioctl(FILEMON_SET_PID). - Handle error from devfs_set_cdevpriv() in filemon_open(). - The global filemon lock and lists are removed. - A free list is no longer kept. Previously this list was forever-expanding and never garbage cleaned. - No longer loses track of double-forks. If the process holding the filemon handle closes it will close the log rather than wait on a daemonized process, but it will log all activity until it closes its handle. The filemon will be removed from the process and not inherited. - A separate process count is kept only as an optimization for forced detachment to avoid taking allproc_lock and walking the entire process tree. - struct filemon access is protected by sx(9) filemon->lock as it was before. - Add more comments and KASSERTS. MFC after: 2 weeks Reviewed by: kib, mjg, markj (all on previous versions) Sponsored by: EMC / Isilon Storage Division Differential Revision: https://reviews.freebsd.org/D5520
2016-03-21 20:29:27 +00:00
if ((filemon = filemon_proc_get(p)) != NULL) {
Add the 'filemon' device. 'filemon' is a kernel module that provides a device interface for processes to record system calls of its children. Submitted by: Juniper Networks.
2012-06-04 22:54:19 +00:00
len = snprintf(filemon->msgbufr, sizeof(filemon->msgbufr),
filemon: Use process_exit EVENTHANDLER to capture process exit. This fixes some cases where a process could exit without being untracked by filemon. Reported by: mjg MFC after: 2 weeks Sponsored by: EMC / Isilon Storage Division
2016-01-28 00:51:17 +00:00
"X %d %d %d\n", p->p_pid, p->p_xexit, p->p_xsig);
Add the 'filemon' device. 'filemon' is a kernel module that provides a device interface for processes to record system calls of its children. Submitted by: Juniper Networks.
2012-06-04 22:54:19 +00:00
filemon_output(filemon, filemon->msgbufr, len);
Track filemon usage via a proc.p_filemon pointer rather than its own lists. - proc.p_filemon is added which is protected by PROC_LOCK. This improves performance and avoids double-fork issues, taking allproc_lock while in syscalls, and walking the process tree in syscalls. A particular proc.p_filemon can only be changed to NULL or another filemon, or the filemon inherited, while the filemon->lock is held. - Filemon are reference counted. On the last reference the log will be closed. - When closing the devfs file handle, the filemon will be detached from all processes and inheritance prevented. - Disallow attaching to a process already being traced since filemon is typically intended to be used on children only. This is allowed for curproc as bmake relies on this behavior for rare cases when combining .MAKE with .META. - Detach any previously tracked process on ioctl(FILEMON_SET_PID). - Handle error from devfs_set_cdevpriv() in filemon_open(). - The global filemon lock and lists are removed. - A free list is no longer kept. Previously this list was forever-expanding and never garbage cleaned. - No longer loses track of double-forks. If the process holding the filemon handle closes it will close the log rather than wait on a daemonized process, but it will log all activity until it closes its handle. The filemon will be removed from the process and not inherited. - A separate process count is kept only as an optimization for forced detachment to avoid taking allproc_lock and walking the entire process tree. - struct filemon access is protected by sx(9) filemon->lock as it was before. - Add more comments and KASSERTS. MFC after: 2 weeks Reviewed by: kib, mjg, markj (all on previous versions) Sponsored by: EMC / Isilon Storage Division Differential Revision: https://reviews.freebsd.org/D5520
2016-03-21 20:29:27 +00:00
/*
* filemon_untrack_processes() may have dropped this p_filemon
* already while in filemon_proc_get() before acquiring the
* filemon lock.
*/
KASSERT(p->p_filemon == NULL || p->p_filemon == filemon,
("%s: p %p was attached while exiting, expected "
"filemon %p or NULL", __func__, p, filemon));
if (p->p_filemon == filemon)
filemon_proc_drop(p);
filemon_drop(filemon);
Add the 'filemon' device. 'filemon' is a kernel module that provides a device interface for processes to record system calls of its children. Submitted by: Juniper Networks.
2012-06-04 22:54:19 +00:00
}
}
static int
filemon_wrapper_unlink(struct thread *td, struct unlink_args *uap)
{
int ret;
size_t done;
size_t len;
struct filemon *filemon;
if ((ret = sys_unlink(td, uap)) == 0) {
Track filemon usage via a proc.p_filemon pointer rather than its own lists. - proc.p_filemon is added which is protected by PROC_LOCK. This improves performance and avoids double-fork issues, taking allproc_lock while in syscalls, and walking the process tree in syscalls. A particular proc.p_filemon can only be changed to NULL or another filemon, or the filemon inherited, while the filemon->lock is held. - Filemon are reference counted. On the last reference the log will be closed. - When closing the devfs file handle, the filemon will be detached from all processes and inheritance prevented. - Disallow attaching to a process already being traced since filemon is typically intended to be used on children only. This is allowed for curproc as bmake relies on this behavior for rare cases when combining .MAKE with .META. - Detach any previously tracked process on ioctl(FILEMON_SET_PID). - Handle error from devfs_set_cdevpriv() in filemon_open(). - The global filemon lock and lists are removed. - A free list is no longer kept. Previously this list was forever-expanding and never garbage cleaned. - No longer loses track of double-forks. If the process holding the filemon handle closes it will close the log rather than wait on a daemonized process, but it will log all activity until it closes its handle. The filemon will be removed from the process and not inherited. - A separate process count is kept only as an optimization for forced detachment to avoid taking allproc_lock and walking the entire process tree. - struct filemon access is protected by sx(9) filemon->lock as it was before. - Add more comments and KASSERTS. MFC after: 2 weeks Reviewed by: kib, mjg, markj (all on previous versions) Sponsored by: EMC / Isilon Storage Division Differential Revision: https://reviews.freebsd.org/D5520
2016-03-21 20:29:27 +00:00
if ((filemon = filemon_proc_get(curproc)) != NULL) {
Add the 'filemon' device. 'filemon' is a kernel module that provides a device interface for processes to record system calls of its children. Submitted by: Juniper Networks.
2012-06-04 22:54:19 +00:00
copyinstr(uap->path, filemon->fname1,
sizeof(filemon->fname1), &done);
len = snprintf(filemon->msgbufr,
sizeof(filemon->msgbufr), "D %d %s\n",
curproc->p_pid, filemon->fname1);
filemon_output(filemon, filemon->msgbufr, len);
Track filemon usage via a proc.p_filemon pointer rather than its own lists. - proc.p_filemon is added which is protected by PROC_LOCK. This improves performance and avoids double-fork issues, taking allproc_lock while in syscalls, and walking the process tree in syscalls. A particular proc.p_filemon can only be changed to NULL or another filemon, or the filemon inherited, while the filemon->lock is held. - Filemon are reference counted. On the last reference the log will be closed. - When closing the devfs file handle, the filemon will be detached from all processes and inheritance prevented. - Disallow attaching to a process already being traced since filemon is typically intended to be used on children only. This is allowed for curproc as bmake relies on this behavior for rare cases when combining .MAKE with .META. - Detach any previously tracked process on ioctl(FILEMON_SET_PID). - Handle error from devfs_set_cdevpriv() in filemon_open(). - The global filemon lock and lists are removed. - A free list is no longer kept. Previously this list was forever-expanding and never garbage cleaned. - No longer loses track of double-forks. If the process holding the filemon handle closes it will close the log rather than wait on a daemonized process, but it will log all activity until it closes its handle. The filemon will be removed from the process and not inherited. - A separate process count is kept only as an optimization for forced detachment to avoid taking allproc_lock and walking the entire process tree. - struct filemon access is protected by sx(9) filemon->lock as it was before. - Add more comments and KASSERTS. MFC after: 2 weeks Reviewed by: kib, mjg, markj (all on previous versions) Sponsored by: EMC / Isilon Storage Division Differential Revision: https://reviews.freebsd.org/D5520
2016-03-21 20:29:27 +00:00
filemon_drop(filemon);
Add the 'filemon' device. 'filemon' is a kernel module that provides a device interface for processes to record system calls of its children. Submitted by: Juniper Networks.
2012-06-04 22:54:19 +00:00
}
}
return (ret);
}
filemon: Trace fork via process_fork event. This avoids needing ugly hooks and needing both a vfork and fork handler. MFC after: 2 weeks Sponsored by: EMC / Isilon Storage Division
2016-01-28 01:17:55 +00:00
static void
filemon_event_process_fork(void *arg __unused, struct proc *p1,
Follow-up r294967: Mark flags unused. X-MFC-With: r294967 MFC after: 2 weeks Sponsored by: EMC / Isilon Storage Division
2016-01-28 01:19:19 +00:00
struct proc *p2, int flags __unused)
Add the 'filemon' device. 'filemon' is a kernel module that provides a device interface for processes to record system calls of its children. Submitted by: Juniper Networks.
2012-06-04 22:54:19 +00:00
{
size_t len;
struct filemon *filemon;
Track filemon usage via a proc.p_filemon pointer rather than its own lists. - proc.p_filemon is added which is protected by PROC_LOCK. This improves performance and avoids double-fork issues, taking allproc_lock while in syscalls, and walking the process tree in syscalls. A particular proc.p_filemon can only be changed to NULL or another filemon, or the filemon inherited, while the filemon->lock is held. - Filemon are reference counted. On the last reference the log will be closed. - When closing the devfs file handle, the filemon will be detached from all processes and inheritance prevented. - Disallow attaching to a process already being traced since filemon is typically intended to be used on children only. This is allowed for curproc as bmake relies on this behavior for rare cases when combining .MAKE with .META. - Detach any previously tracked process on ioctl(FILEMON_SET_PID). - Handle error from devfs_set_cdevpriv() in filemon_open(). - The global filemon lock and lists are removed. - A free list is no longer kept. Previously this list was forever-expanding and never garbage cleaned. - No longer loses track of double-forks. If the process holding the filemon handle closes it will close the log rather than wait on a daemonized process, but it will log all activity until it closes its handle. The filemon will be removed from the process and not inherited. - A separate process count is kept only as an optimization for forced detachment to avoid taking allproc_lock and walking the entire process tree. - struct filemon access is protected by sx(9) filemon->lock as it was before. - Add more comments and KASSERTS. MFC after: 2 weeks Reviewed by: kib, mjg, markj (all on previous versions) Sponsored by: EMC / Isilon Storage Division Differential Revision: https://reviews.freebsd.org/D5520
2016-03-21 20:29:27 +00:00
if ((filemon = filemon_proc_get(p1)) != NULL) {
filemon: Trace fork via process_fork event. This avoids needing ugly hooks and needing both a vfork and fork handler. MFC after: 2 weeks Sponsored by: EMC / Isilon Storage Division
2016-01-28 01:17:55 +00:00
len = snprintf(filemon->msgbufr,
sizeof(filemon->msgbufr), "F %d %d\n",
p1->p_pid, p2->p_pid);
Add the 'filemon' device. 'filemon' is a kernel module that provides a device interface for processes to record system calls of its children. Submitted by: Juniper Networks.
2012-06-04 22:54:19 +00:00
filemon: Trace fork via process_fork event. This avoids needing ugly hooks and needing both a vfork and fork handler. MFC after: 2 weeks Sponsored by: EMC / Isilon Storage Division
2016-01-28 01:17:55 +00:00
filemon_output(filemon, filemon->msgbufr, len);
Add the 'filemon' device. 'filemon' is a kernel module that provides a device interface for processes to record system calls of its children. Submitted by: Juniper Networks.
2012-06-04 22:54:19 +00:00
Track filemon usage via a proc.p_filemon pointer rather than its own lists. - proc.p_filemon is added which is protected by PROC_LOCK. This improves performance and avoids double-fork issues, taking allproc_lock while in syscalls, and walking the process tree in syscalls. A particular proc.p_filemon can only be changed to NULL or another filemon, or the filemon inherited, while the filemon->lock is held. - Filemon are reference counted. On the last reference the log will be closed. - When closing the devfs file handle, the filemon will be detached from all processes and inheritance prevented. - Disallow attaching to a process already being traced since filemon is typically intended to be used on children only. This is allowed for curproc as bmake relies on this behavior for rare cases when combining .MAKE with .META. - Detach any previously tracked process on ioctl(FILEMON_SET_PID). - Handle error from devfs_set_cdevpriv() in filemon_open(). - The global filemon lock and lists are removed. - A free list is no longer kept. Previously this list was forever-expanding and never garbage cleaned. - No longer loses track of double-forks. If the process holding the filemon handle closes it will close the log rather than wait on a daemonized process, but it will log all activity until it closes its handle. The filemon will be removed from the process and not inherited. - A separate process count is kept only as an optimization for forced detachment to avoid taking allproc_lock and walking the entire process tree. - struct filemon access is protected by sx(9) filemon->lock as it was before. - Add more comments and KASSERTS. MFC after: 2 weeks Reviewed by: kib, mjg, markj (all on previous versions) Sponsored by: EMC / Isilon Storage Division Differential Revision: https://reviews.freebsd.org/D5520
2016-03-21 20:29:27 +00:00
/*
* filemon_untrack_processes() or
* filemon_ioctl(FILEMON_SET_PID) may have changed the parent's
* p_filemon while in filemon_proc_get() before acquiring the
* filemon lock. Only inherit if the parent is still traced by
* this filemon.
*/
if (p1->p_filemon == filemon) {
PROC_LOCK(p2);
/*
* It may have been attached to already by a new
* filemon.
*/
if (p2->p_filemon == NULL) {
p2->p_filemon = filemon_acquire(filemon);
++filemon->proccnt;
}
PROC_UNLOCK(p2);
}
filemon_drop(filemon);
Add the 'filemon' device. 'filemon' is a kernel module that provides a device interface for processes to record system calls of its children. Submitted by: Juniper Networks.
2012-06-04 22:54:19 +00:00
}
}
static void
filemon_wrapper_install(void)
{
There's no need to make filemon specific to i386 and amd64. All LP64 architectures define elf64_freebsd_sysvec and all ILP32 architectures define elf32_freebsd_sysvec.
2012-07-02 20:36:26 +00:00
#if defined(__LP64__)
Add the 'filemon' device. 'filemon' is a kernel module that provides a device interface for processes to record system calls of its children. Submitted by: Juniper Networks.
2012-06-04 22:54:19 +00:00
struct sysent *sv_table = elf64_freebsd_sysvec.sv_table;
#else
There's no need to make filemon specific to i386 and amd64. All LP64 architectures define elf64_freebsd_sysvec and all ILP32 architectures define elf32_freebsd_sysvec.
2012-07-02 20:36:26 +00:00
struct sysent *sv_table = elf32_freebsd_sysvec.sv_table;
Add the 'filemon' device. 'filemon' is a kernel module that provides a device interface for processes to record system calls of its children. Submitted by: Juniper Networks.
2012-06-04 22:54:19 +00:00
#endif
sv_table[SYS_chdir].sy_call = (sy_call_t *) filemon_wrapper_chdir;
sv_table[SYS_open].sy_call = (sy_call_t *) filemon_wrapper_open;
Latest clang uses openat(2). If the pathname is absolute or dirfd is AT_FDCWD we can handle it exactly like open(2). Otherwise we output an A record to indicate that the path of an open directory needs to be used (earlier in the trace). Differential Revision: D2810 Reviewed by: jhb MFC after: a bit
2015-06-14 16:31:06 +00:00
sv_table[SYS_openat].sy_call = (sy_call_t *) filemon_wrapper_openat;
Add the 'filemon' device. 'filemon' is a kernel module that provides a device interface for processes to record system calls of its children. Submitted by: Juniper Networks.
2012-06-04 22:54:19 +00:00
sv_table[SYS_rename].sy_call = (sy_call_t *) filemon_wrapper_rename;
sv_table[SYS_unlink].sy_call = (sy_call_t *) filemon_wrapper_unlink;
sv_table[SYS_link].sy_call = (sy_call_t *) filemon_wrapper_link;
sv_table[SYS_symlink].sy_call = (sy_call_t *) filemon_wrapper_symlink;
sv_table[SYS_linkat].sy_call = (sy_call_t *) filemon_wrapper_linkat;
#if defined(COMPAT_IA32) || defined(COMPAT_FREEBSD32) || defined(COMPAT_ARCH32)
sv_table = ia32_freebsd_sysvec.sv_table;
sv_table[FREEBSD32_SYS_chdir].sy_call = (sy_call_t *) filemon_wrapper_chdir;
sv_table[FREEBSD32_SYS_open].sy_call = (sy_call_t *) filemon_wrapper_open;
Latest clang uses openat(2). If the pathname is absolute or dirfd is AT_FDCWD we can handle it exactly like open(2). Otherwise we output an A record to indicate that the path of an open directory needs to be used (earlier in the trace). Differential Revision: D2810 Reviewed by: jhb MFC after: a bit
2015-06-14 16:31:06 +00:00
sv_table[FREEBSD32_SYS_openat].sy_call = (sy_call_t *) filemon_wrapper_openat;
Add the 'filemon' device. 'filemon' is a kernel module that provides a device interface for processes to record system calls of its children. Submitted by: Juniper Networks.
2012-06-04 22:54:19 +00:00
sv_table[FREEBSD32_SYS_rename].sy_call = (sy_call_t *) filemon_wrapper_rename;
sv_table[FREEBSD32_SYS_unlink].sy_call = (sy_call_t *) filemon_wrapper_unlink;
sv_table[FREEBSD32_SYS_link].sy_call = (sy_call_t *) filemon_wrapper_link;
sv_table[FREEBSD32_SYS_symlink].sy_call = (sy_call_t *) filemon_wrapper_symlink;
sv_table[FREEBSD32_SYS_linkat].sy_call = (sy_call_t *) filemon_wrapper_linkat;
#endif /* COMPAT_ARCH32 */
filemon: Use process_exit EVENTHANDLER to capture process exit. This fixes some cases where a process could exit without being untracked by filemon. Reported by: mjg MFC after: 2 weeks Sponsored by: EMC / Isilon Storage Division
2016-01-28 00:51:17 +00:00
filemon: Use process_exec EVENTHANDLER to capture sys_execve. MFC after: 2 weeks Sponsored by: EMC / Isilon Storage Division
2016-01-28 21:45:25 +00:00
filemon_exec_tag = EVENTHANDLER_REGISTER(process_exec,
filemon_event_process_exec, NULL, EVENTHANDLER_PRI_LAST);
filemon: Use process_exit EVENTHANDLER to capture process exit. This fixes some cases where a process could exit without being untracked by filemon. Reported by: mjg MFC after: 2 weeks Sponsored by: EMC / Isilon Storage Division
2016-01-28 00:51:17 +00:00
filemon_exit_tag = EVENTHANDLER_REGISTER(process_exit,
filemon_event_process_exit, NULL, EVENTHANDLER_PRI_LAST);
filemon: Trace fork via process_fork event. This avoids needing ugly hooks and needing both a vfork and fork handler. MFC after: 2 weeks Sponsored by: EMC / Isilon Storage Division
2016-01-28 01:17:55 +00:00
filemon_fork_tag = EVENTHANDLER_REGISTER(process_fork,
filemon_event_process_fork, NULL, EVENTHANDLER_PRI_LAST);
Add the 'filemon' device. 'filemon' is a kernel module that provides a device interface for processes to record system calls of its children. Submitted by: Juniper Networks.
2012-06-04 22:54:19 +00:00
}
static void
filemon_wrapper_deinstall(void)
{
There's no need to make filemon specific to i386 and amd64. All LP64 architectures define elf64_freebsd_sysvec and all ILP32 architectures define elf32_freebsd_sysvec.
2012-07-02 20:36:26 +00:00
#if defined(__LP64__)
Add the 'filemon' device. 'filemon' is a kernel module that provides a device interface for processes to record system calls of its children. Submitted by: Juniper Networks.
2012-06-04 22:54:19 +00:00
struct sysent *sv_table = elf64_freebsd_sysvec.sv_table;
#else
There's no need to make filemon specific to i386 and amd64. All LP64 architectures define elf64_freebsd_sysvec and all ILP32 architectures define elf32_freebsd_sysvec.
2012-07-02 20:36:26 +00:00
struct sysent *sv_table = elf32_freebsd_sysvec.sv_table;
Add the 'filemon' device. 'filemon' is a kernel module that provides a device interface for processes to record system calls of its children. Submitted by: Juniper Networks.
2012-06-04 22:54:19 +00:00
#endif
sv_table[SYS_chdir].sy_call = (sy_call_t *)sys_chdir;
sv_table[SYS_open].sy_call = (sy_call_t *)sys_open;
Latest clang uses openat(2). If the pathname is absolute or dirfd is AT_FDCWD we can handle it exactly like open(2). Otherwise we output an A record to indicate that the path of an open directory needs to be used (earlier in the trace). Differential Revision: D2810 Reviewed by: jhb MFC after: a bit
2015-06-14 16:31:06 +00:00
sv_table[SYS_openat].sy_call = (sy_call_t *)sys_openat;
Add the 'filemon' device. 'filemon' is a kernel module that provides a device interface for processes to record system calls of its children. Submitted by: Juniper Networks.
2012-06-04 22:54:19 +00:00
sv_table[SYS_rename].sy_call = (sy_call_t *)sys_rename;
sv_table[SYS_unlink].sy_call = (sy_call_t *)sys_unlink;
sv_table[SYS_link].sy_call = (sy_call_t *)sys_link;
sv_table[SYS_symlink].sy_call = (sy_call_t *)sys_symlink;
sv_table[SYS_linkat].sy_call = (sy_call_t *)sys_linkat;
#if defined(COMPAT_IA32) || defined(COMPAT_FREEBSD32) || defined(COMPAT_ARCH32)
sv_table = ia32_freebsd_sysvec.sv_table;
sv_table[FREEBSD32_SYS_chdir].sy_call = (sy_call_t *)sys_chdir;
sv_table[FREEBSD32_SYS_open].sy_call = (sy_call_t *)sys_open;
Latest clang uses openat(2). If the pathname is absolute or dirfd is AT_FDCWD we can handle it exactly like open(2). Otherwise we output an A record to indicate that the path of an open directory needs to be used (earlier in the trace). Differential Revision: D2810 Reviewed by: jhb MFC after: a bit
2015-06-14 16:31:06 +00:00
sv_table[FREEBSD32_SYS_openat].sy_call = (sy_call_t *)sys_openat;
Add the 'filemon' device. 'filemon' is a kernel module that provides a device interface for processes to record system calls of its children. Submitted by: Juniper Networks.
2012-06-04 22:54:19 +00:00
sv_table[FREEBSD32_SYS_rename].sy_call = (sy_call_t *)sys_rename;
sv_table[FREEBSD32_SYS_unlink].sy_call = (sy_call_t *)sys_unlink;
sv_table[FREEBSD32_SYS_link].sy_call = (sy_call_t *)sys_link;
sv_table[FREEBSD32_SYS_symlink].sy_call = (sy_call_t *)sys_symlink;
sv_table[FREEBSD32_SYS_linkat].sy_call = (sy_call_t *)sys_linkat;
#endif /* COMPAT_ARCH32 */
filemon: Use process_exit EVENTHANDLER to capture process exit. This fixes some cases where a process could exit without being untracked by filemon. Reported by: mjg MFC after: 2 weeks Sponsored by: EMC / Isilon Storage Division
2016-01-28 00:51:17 +00:00
filemon: Use process_exec EVENTHANDLER to capture sys_execve. MFC after: 2 weeks Sponsored by: EMC / Isilon Storage Division
2016-01-28 21:45:25 +00:00
EVENTHANDLER_DEREGISTER(process_exec, filemon_exec_tag);
filemon: Use process_exit EVENTHANDLER to capture process exit. This fixes some cases where a process could exit without being untracked by filemon. Reported by: mjg MFC after: 2 weeks Sponsored by: EMC / Isilon Storage Division
2016-01-28 00:51:17 +00:00
EVENTHANDLER_DEREGISTER(process_exit, filemon_exit_tag);
filemon: Trace fork via process_fork event. This avoids needing ugly hooks and needing both a vfork and fork handler. MFC after: 2 weeks Sponsored by: EMC / Isilon Storage Division
2016-01-28 01:17:55 +00:00
EVENTHANDLER_DEREGISTER(process_fork, filemon_fork_tag);
Add the 'filemon' device. 'filemon' is a kernel module that provides a device interface for processes to record system calls of its children. Submitted by: Juniper Networks.
2012-06-04 22:54:19 +00:00
}
Reference in New Issue Copy Permalink