From owner-svn-src-all@freebsd.org Mon Jun 27 22:21:31 2016 Return-Path: Delivered-To: svn-src-all@mailman.ysv.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:1900:2254:206a::19:1]) by mailman.ysv.freebsd.org (Postfix) with ESMTP id 113CBB85723; Mon, 27 Jun 2016 22:21:31 +0000 (UTC) (envelope-from bdrewery@FreeBSD.org) Received: from repo.freebsd.org (repo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:0]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client did not present a certificate) by mx1.freebsd.org (Postfix) with ESMTPS id C4CB62A3A; Mon, 27 Jun 2016 22:21:30 +0000 (UTC) (envelope-from bdrewery@FreeBSD.org) Received: from repo.freebsd.org ([127.0.1.37]) by repo.freebsd.org (8.15.2/8.15.2) with ESMTP id u5RMLTHI040849; Mon, 27 Jun 2016 22:21:29 GMT (envelope-from bdrewery@FreeBSD.org) Received: (from bdrewery@localhost) by repo.freebsd.org (8.15.2/8.15.2/Submit) id u5RMLT7I040847; Mon, 27 Jun 2016 22:21:29 GMT (envelope-from bdrewery@FreeBSD.org) Message-Id: <201606272221.u5RMLT7I040847@repo.freebsd.org> X-Authentication-Warning: repo.freebsd.org: bdrewery set sender to bdrewery@FreeBSD.org using -f From: Bryan Drewery Date: Mon, 27 Jun 2016 22:21:29 +0000 (UTC) To: src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-stable@freebsd.org, svn-src-stable-10@freebsd.org Subject: svn commit: r302241 - stable/10/sys/dev/filemon X-SVN-Group: stable-10 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-BeenThere: svn-src-all@freebsd.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "SVN commit messages for the entire src tree \(except for " user" and " projects" \)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 27 Jun 2016 22:21:31 -0000 Author: bdrewery Date: Mon Jun 27 22:21:29 2016 New Revision: 302241 URL: https://svnweb.freebsd.org/changeset/base/302241 Log: MFC r300809,r300890,r300891: r300809: filemon exec: Use imgp->execpath rather than vn_fullpath(9). r300890: exec: Cease tracing if credentials will change with the new image. r300891: Write to the log using the tracer's credentials. Modified: stable/10/sys/dev/filemon/filemon.c stable/10/sys/dev/filemon/filemon_wrapper.c Directory Properties: stable/10/ (props changed) Modified: stable/10/sys/dev/filemon/filemon.c ============================================================================== --- stable/10/sys/dev/filemon/filemon.c Mon Jun 27 22:18:52 2016 (r302240) +++ stable/10/sys/dev/filemon/filemon.c Mon Jun 27 22:21:29 2016 (r302241) @@ -85,6 +85,7 @@ MALLOC_DEFINE(M_FILEMON, "filemon", "Fil struct filemon { struct sx lock; /* Lock for this filemon. */ struct file *fp; /* Output file pointer. */ + struct ucred *cred; /* Credential of tracer. */ char fname1[MAXPATHLEN]; /* Temporary filename buffer. */ char fname2[MAXPATHLEN]; /* Temporary filename buffer. */ char msgbufr[1024]; /* Output message buffer. */ @@ -121,6 +122,8 @@ filemon_release(struct filemon *filemon) */ sx_assert(&filemon->lock, SA_UNLOCKED); + if (filemon->cred != NULL) + crfree(filemon->cred); sx_destroy(&filemon->lock); free(filemon, M_FILEMON); } @@ -304,6 +307,9 @@ filemon_attach_proc(struct filemon *file KASSERT((p->p_flag & P_WEXIT) == 0, ("%s: filemon %p attaching to exiting process %p", __func__, filemon, p)); + KASSERT((p->p_flag & P_INEXEC) == 0, + ("%s: filemon %p attaching to execing process %p", + __func__, filemon, p)); if (p->p_filemon == filemon) return (0); @@ -381,8 +387,8 @@ filemon_ioctl(struct cdev *dev, u_long c /* Invalidate any existing processes already set. */ filemon_untrack_processes(filemon); - error = pget(*((pid_t *)data), PGET_CANDEBUG | PGET_NOTWEXIT, - &p); + error = pget(*((pid_t *)data), + PGET_CANDEBUG | PGET_NOTWEXIT | PGET_NOTINEXEC, &p); if (error == 0) { KASSERT(p->p_filemon != filemon, ("%s: proc %p didn't untrack filemon %p", @@ -403,7 +409,7 @@ filemon_ioctl(struct cdev *dev, u_long c static int filemon_open(struct cdev *dev, int oflags __unused, int devtype __unused, - struct thread *td __unused) + struct thread *td) { int error; struct filemon *filemon; @@ -412,6 +418,7 @@ filemon_open(struct cdev *dev, int oflag M_WAITOK | M_ZERO); sx_init(&filemon->lock, "filemon"); refcount_init(&filemon->refcnt, 1); + filemon->cred = crhold(td->td_ucred); error = devfs_set_cdevpriv(filemon, filemon_dtr); if (error != 0) Modified: stable/10/sys/dev/filemon/filemon_wrapper.c ============================================================================== --- stable/10/sys/dev/filemon/filemon_wrapper.c Mon Jun 27 22:18:52 2016 (r302240) +++ stable/10/sys/dev/filemon/filemon_wrapper.c Mon Jun 27 22:21:29 2016 (r302241) @@ -32,6 +32,7 @@ __FBSDID("$FreeBSD$"); #include #include #include +#include #include #include #include @@ -65,7 +66,7 @@ filemon_output(struct filemon *filemon, if (filemon->fp->f_type == DTYPE_VNODE) bwillwrite(); - error = fo_write(filemon->fp, &auio, curthread->td_ucred, 0, curthread); + error = fo_write(filemon->fp, &auio, filemon->cred, 0, curthread); if (error != 0 && filemon->error == 0) filemon->error = error; } @@ -103,24 +104,35 @@ filemon_event_process_exec(void *arg __u struct image_params *imgp) { struct filemon *filemon; - char *fullpath, *freepath; size_t len; if ((filemon = filemon_proc_get(p)) != NULL) { - fullpath = ""; - freepath = NULL; - - vn_fullpath(curthread, imgp->vp, &fullpath, &freepath); - len = snprintf(filemon->msgbufr, sizeof(filemon->msgbufr), "E %d %s\n", - p->p_pid, fullpath); + p->p_pid, + imgp->execpath != NULL ? imgp->execpath : ""); filemon_output(filemon, filemon->msgbufr, len); - filemon_drop(filemon); + /* If the credentials changed then cease tracing. */ + if (imgp->newcred != NULL && + imgp->credential_setid && + priv_check_cred(filemon->cred, + PRIV_DEBUG_DIFFCRED, 0) != 0) { + /* + * It may have changed to NULL already, but + * will not be re-attached by anything else. + */ + if (p->p_filemon != NULL) { + KASSERT(p->p_filemon == filemon, + ("%s: proc %p didn't have expected" + " filemon %p", __func__, p, filemon)); + filemon_proc_drop(p); + } + } - free(freepath, M_TEMP); + + filemon_drop(filemon); } }