2 * cn_proc.c - process events connector
4 * Copyright (C) Matt Helsley, IBM Corp. 2005
5 * Based on cn_fork.c by Guillaume Thouvenin <guillaume.thouvenin@bull.net>
6 * Original copyright notice follows:
7 * Copyright (C) 2005 BULL SA.
10 * This program is free software; you can redistribute it and/or modify
11 * it under the terms of the GNU General Public License as published by
12 * the Free Software Foundation; either version 2 of the License, or
13 * (at your option) any later version.
15 * This program is distributed in the hope that it will be useful,
16 * but WITHOUT ANY WARRANTY; without even the implied warranty of
17 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
18 * GNU General Public License for more details.
20 * You should have received a copy of the GNU General Public License
21 * along with this program; if not, write to the Free Software
22 * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
25 #include <linux/module.h>
26 #include <linux/kernel.h>
27 #include <linux/ktime.h>
28 #include <linux/init.h>
29 #include <linux/connector.h>
30 #include <linux/gfp.h>
31 #include <linux/ptrace.h>
32 #include <linux/atomic.h>
34 #include <asm/unaligned.h>
36 #include <linux/cn_proc.h>
38 #define CN_PROC_MSG_SIZE (sizeof(struct cn_msg) + sizeof(struct proc_event))
40 static atomic_t proc_event_num_listeners = ATOMIC_INIT(0);
41 static struct cb_id cn_proc_event_id = { CN_IDX_PROC, CN_VAL_PROC };
43 /* proc_event_counts is used as the sequence number of the netlink message */
44 static DEFINE_PER_CPU(__u32, proc_event_counts) = { 0 };
46 static inline void get_seq(__u32 *ts, int *cpu)
49 *ts = __this_cpu_inc_return(proc_event_counts) -1;
50 *cpu = smp_processor_id();
54 void proc_fork_connector(struct task_struct *task)
57 struct proc_event *ev;
58 __u8 buffer[CN_PROC_MSG_SIZE];
60 struct task_struct *parent;
62 if (atomic_read(&proc_event_num_listeners) < 1)
65 msg = (struct cn_msg*)buffer;
66 ev = (struct proc_event*)msg->data;
67 memset(&ev->event_data, 0, sizeof(ev->event_data));
68 get_seq(&msg->seq, &ev->cpu);
69 ktime_get_ts(&ts); /* get high res monotonic timestamp */
70 put_unaligned(timespec_to_ns(&ts), (__u64 *)&ev->timestamp_ns);
71 ev->what = PROC_EVENT_FORK;
73 parent = rcu_dereference(task->real_parent);
74 ev->event_data.fork.parent_pid = parent->pid;
75 ev->event_data.fork.parent_tgid = parent->tgid;
77 ev->event_data.fork.child_pid = task->pid;
78 ev->event_data.fork.child_tgid = task->tgid;
80 memcpy(&msg->id, &cn_proc_event_id, sizeof(msg->id));
81 msg->ack = 0; /* not used */
82 msg->len = sizeof(*ev);
83 msg->flags = 0; /* not used */
84 /* If cn_netlink_send() failed, the data is not sent */
85 cn_netlink_send(msg, CN_IDX_PROC, GFP_KERNEL);
88 void proc_exec_connector(struct task_struct *task)
91 struct proc_event *ev;
93 __u8 buffer[CN_PROC_MSG_SIZE];
95 if (atomic_read(&proc_event_num_listeners) < 1)
98 msg = (struct cn_msg*)buffer;
99 ev = (struct proc_event*)msg->data;
100 memset(&ev->event_data, 0, sizeof(ev->event_data));
101 get_seq(&msg->seq, &ev->cpu);
102 ktime_get_ts(&ts); /* get high res monotonic timestamp */
103 put_unaligned(timespec_to_ns(&ts), (__u64 *)&ev->timestamp_ns);
104 ev->what = PROC_EVENT_EXEC;
105 ev->event_data.exec.process_pid = task->pid;
106 ev->event_data.exec.process_tgid = task->tgid;
108 memcpy(&msg->id, &cn_proc_event_id, sizeof(msg->id));
109 msg->ack = 0; /* not used */
110 msg->len = sizeof(*ev);
111 msg->flags = 0; /* not used */
112 cn_netlink_send(msg, CN_IDX_PROC, GFP_KERNEL);
115 void proc_id_connector(struct task_struct *task, int which_id)
118 struct proc_event *ev;
119 __u8 buffer[CN_PROC_MSG_SIZE];
121 const struct cred *cred;
123 if (atomic_read(&proc_event_num_listeners) < 1)
126 msg = (struct cn_msg*)buffer;
127 ev = (struct proc_event*)msg->data;
128 memset(&ev->event_data, 0, sizeof(ev->event_data));
130 ev->event_data.id.process_pid = task->pid;
131 ev->event_data.id.process_tgid = task->tgid;
133 cred = __task_cred(task);
134 if (which_id == PROC_EVENT_UID) {
135 ev->event_data.id.r.ruid = cred->uid;
136 ev->event_data.id.e.euid = cred->euid;
137 } else if (which_id == PROC_EVENT_GID) {
138 ev->event_data.id.r.rgid = cred->gid;
139 ev->event_data.id.e.egid = cred->egid;
145 get_seq(&msg->seq, &ev->cpu);
146 ktime_get_ts(&ts); /* get high res monotonic timestamp */
147 put_unaligned(timespec_to_ns(&ts), (__u64 *)&ev->timestamp_ns);
149 memcpy(&msg->id, &cn_proc_event_id, sizeof(msg->id));
150 msg->ack = 0; /* not used */
151 msg->len = sizeof(*ev);
152 msg->flags = 0; /* not used */
153 cn_netlink_send(msg, CN_IDX_PROC, GFP_KERNEL);
156 void proc_sid_connector(struct task_struct *task)
159 struct proc_event *ev;
161 __u8 buffer[CN_PROC_MSG_SIZE];
163 if (atomic_read(&proc_event_num_listeners) < 1)
166 msg = (struct cn_msg *)buffer;
167 ev = (struct proc_event *)msg->data;
168 memset(&ev->event_data, 0, sizeof(ev->event_data));
169 get_seq(&msg->seq, &ev->cpu);
170 ktime_get_ts(&ts); /* get high res monotonic timestamp */
171 put_unaligned(timespec_to_ns(&ts), (__u64 *)&ev->timestamp_ns);
172 ev->what = PROC_EVENT_SID;
173 ev->event_data.sid.process_pid = task->pid;
174 ev->event_data.sid.process_tgid = task->tgid;
176 memcpy(&msg->id, &cn_proc_event_id, sizeof(msg->id));
177 msg->ack = 0; /* not used */
178 msg->len = sizeof(*ev);
179 msg->flags = 0; /* not used */
180 cn_netlink_send(msg, CN_IDX_PROC, GFP_KERNEL);
183 void proc_ptrace_connector(struct task_struct *task, int ptrace_id)
186 struct proc_event *ev;
188 __u8 buffer[CN_PROC_MSG_SIZE];
190 if (atomic_read(&proc_event_num_listeners) < 1)
193 msg = (struct cn_msg *)buffer;
194 ev = (struct proc_event *)msg->data;
195 memset(&ev->event_data, 0, sizeof(ev->event_data));
196 get_seq(&msg->seq, &ev->cpu);
197 ktime_get_ts(&ts); /* get high res monotonic timestamp */
198 put_unaligned(timespec_to_ns(&ts), (__u64 *)&ev->timestamp_ns);
199 ev->what = PROC_EVENT_PTRACE;
200 ev->event_data.ptrace.process_pid = task->pid;
201 ev->event_data.ptrace.process_tgid = task->tgid;
202 if (ptrace_id == PTRACE_ATTACH) {
203 ev->event_data.ptrace.tracer_pid = current->pid;
204 ev->event_data.ptrace.tracer_tgid = current->tgid;
205 } else if (ptrace_id == PTRACE_DETACH) {
206 ev->event_data.ptrace.tracer_pid = 0;
207 ev->event_data.ptrace.tracer_tgid = 0;
211 memcpy(&msg->id, &cn_proc_event_id, sizeof(msg->id));
212 msg->ack = 0; /* not used */
213 msg->len = sizeof(*ev);
214 msg->flags = 0; /* not used */
215 cn_netlink_send(msg, CN_IDX_PROC, GFP_KERNEL);
218 void proc_comm_connector(struct task_struct *task)
221 struct proc_event *ev;
223 __u8 buffer[CN_PROC_MSG_SIZE];
225 if (atomic_read(&proc_event_num_listeners) < 1)
228 msg = (struct cn_msg *)buffer;
229 ev = (struct proc_event *)msg->data;
230 memset(&ev->event_data, 0, sizeof(ev->event_data));
231 get_seq(&msg->seq, &ev->cpu);
232 ktime_get_ts(&ts); /* get high res monotonic timestamp */
233 put_unaligned(timespec_to_ns(&ts), (__u64 *)&ev->timestamp_ns);
234 ev->what = PROC_EVENT_COMM;
235 ev->event_data.comm.process_pid = task->pid;
236 ev->event_data.comm.process_tgid = task->tgid;
237 get_task_comm(ev->event_data.comm.comm, task);
239 memcpy(&msg->id, &cn_proc_event_id, sizeof(msg->id));
240 msg->ack = 0; /* not used */
241 msg->len = sizeof(*ev);
242 msg->flags = 0; /* not used */
243 cn_netlink_send(msg, CN_IDX_PROC, GFP_KERNEL);
246 void proc_exit_connector(struct task_struct *task)
249 struct proc_event *ev;
250 __u8 buffer[CN_PROC_MSG_SIZE];
253 if (atomic_read(&proc_event_num_listeners) < 1)
256 msg = (struct cn_msg*)buffer;
257 ev = (struct proc_event*)msg->data;
258 memset(&ev->event_data, 0, sizeof(ev->event_data));
259 get_seq(&msg->seq, &ev->cpu);
260 ktime_get_ts(&ts); /* get high res monotonic timestamp */
261 put_unaligned(timespec_to_ns(&ts), (__u64 *)&ev->timestamp_ns);
262 ev->what = PROC_EVENT_EXIT;
263 ev->event_data.exit.process_pid = task->pid;
264 ev->event_data.exit.process_tgid = task->tgid;
265 ev->event_data.exit.exit_code = task->exit_code;
266 ev->event_data.exit.exit_signal = task->exit_signal;
268 memcpy(&msg->id, &cn_proc_event_id, sizeof(msg->id));
269 msg->ack = 0; /* not used */
270 msg->len = sizeof(*ev);
271 msg->flags = 0; /* not used */
272 cn_netlink_send(msg, CN_IDX_PROC, GFP_KERNEL);
276 * Send an acknowledgement message to userspace
278 * Use 0 for success, EFOO otherwise.
279 * Note: this is the negative of conventional kernel error
280 * values because it's not being returned via syscall return
283 static void cn_proc_ack(int err, int rcvd_seq, int rcvd_ack)
286 struct proc_event *ev;
287 __u8 buffer[CN_PROC_MSG_SIZE];
290 if (atomic_read(&proc_event_num_listeners) < 1)
293 msg = (struct cn_msg*)buffer;
294 ev = (struct proc_event*)msg->data;
295 memset(&ev->event_data, 0, sizeof(ev->event_data));
297 ktime_get_ts(&ts); /* get high res monotonic timestamp */
298 put_unaligned(timespec_to_ns(&ts), (__u64 *)&ev->timestamp_ns);
300 ev->what = PROC_EVENT_NONE;
301 ev->event_data.ack.err = err;
302 memcpy(&msg->id, &cn_proc_event_id, sizeof(msg->id));
303 msg->ack = rcvd_ack + 1;
304 msg->len = sizeof(*ev);
305 msg->flags = 0; /* not used */
306 cn_netlink_send(msg, CN_IDX_PROC, GFP_KERNEL);
311 * @data: message sent from userspace via the connector
313 static void cn_proc_mcast_ctl(struct cn_msg *msg,
314 struct netlink_skb_parms *nsp)
316 enum proc_cn_mcast_op *mc_op = NULL;
319 if (msg->len != sizeof(*mc_op))
322 /* Can only change if privileged. */
323 if (!capable(CAP_NET_ADMIN)) {
328 mc_op = (enum proc_cn_mcast_op*)msg->data;
330 case PROC_CN_MCAST_LISTEN:
331 atomic_inc(&proc_event_num_listeners);
333 case PROC_CN_MCAST_IGNORE:
334 atomic_dec(&proc_event_num_listeners);
342 cn_proc_ack(err, msg->seq, msg->ack);
346 * cn_proc_init - initialization entry point
348 * Adds the connector callback to the connector driver.
350 static int __init cn_proc_init(void)
354 if ((err = cn_add_callback(&cn_proc_event_id, "cn_proc",
355 &cn_proc_mcast_ctl))) {
356 printk(KERN_WARNING "cn_proc failed to register\n");
362 module_init(cn_proc_init);