| | 1 | /* |
| | 2 | * Copyright (c) 2006-2014 Apple Inc. All rights reserved. |
| | 3 | * |
| | 4 | * @APPLE_OSREFERENCE_LICENSE_HEADER_START@ |
| | 5 | * |
| | 6 | * This file contains Original Code and/or Modifications of Original Code |
| | 7 | * as defined in and that are subject to the Apple Public Source License |
| | 8 | * Version 2.0 (the 'License'). You may not use this file except in |
| | 9 | * compliance with the License. The rights granted to you under the License |
| | 10 | * may not be used to create, or enable the creation or redistribution of, |
| | 11 | * unlawful or unlicensed copies of an Apple operating system, or to |
| | 12 | * circumvent, violate, or enable the circumvention or violation of, any |
| | 13 | * terms of an Apple operating system software license agreement. |
| | 14 | * |
| | 15 | * Please obtain a copy of the License at |
| | 16 | * http://www.opensource.apple.com/apsl/ and read it before using this file. |
| | 17 | * |
| | 18 | * The Original Code and all software distributed under the License are |
| | 19 | * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER |
| | 20 | * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES, |
| | 21 | * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY, |
| | 22 | * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT. |
| | 23 | * Please see the License for the specific language governing rights and |
| | 24 | * limitations under the License. |
| | 25 | * |
| | 26 | * @APPLE_OSREFERENCE_LICENSE_HEADER_END@ |
| | 27 | */ |
| | 28 | |
| | 29 | #include <sys/errno.h> |
| | 30 | #include <sys/types.h> |
| | 31 | #include <sys/malloc.h> |
| | 32 | #include <sys/buf.h> |
| | 33 | #include <sys/time.h> |
| | 34 | #include <sys/kauth.h> |
| | 35 | #include <sys/mount.h> |
| | 36 | #include <sys/vnode.h> |
| | 37 | #include <sys/syslog.h> |
| | 38 | #include <sys/vnode_internal.h> |
| | 39 | #include <sys/fslog.h> |
| | 40 | #include <sys/mount_internal.h> |
| | 41 | #include <sys/kasl.h> |
| | 42 | |
| | 43 | #include <dev/random/randomdev.h> |
| | 44 | |
| | 45 | #include <uuid/uuid.h> |
| | 46 | |
| | 47 | #include <stdarg.h> |
| | 48 | |
| | 49 | /* Log information about external modification of a process, |
| | 50 | * using MessageTracer formatting. Assumes that both the caller |
| | 51 | * and target are appropriately locked. |
| | 52 | * Currently prints following information - |
| | 53 | * 1. Caller process name (truncated to 16 characters) |
| | 54 | * 2. Caller process Mach-O UUID |
| | 55 | * 3. Target process name (truncated to 16 characters) |
| | 56 | * 4. Target process Mach-O UUID |
| | 57 | */ |
| | 58 | void |
| | 59 | fslog_extmod_msgtracer(proc_t caller, proc_t target) |
| | 60 | { |
| | 61 | if ((caller != PROC_NULL) && (target != PROC_NULL)) { |
| | 62 | |
| | 63 | /* |
| | 64 | * Print into buffer large enough for "ThisIsAnApplicat(BC223DD7-B314-42E0-B6B0-C5D2E6638337)", |
| | 65 | * including space for escaping, and NUL byte included in sizeof(uuid_string_t). |
| | 66 | */ |
| | 67 | |
| | 68 | uuid_string_t uuidstr; |
| | 69 | char c_name[2*MAXCOMLEN + 2 /* () */ + sizeof(uuid_string_t)]; |
| | 70 | char t_name[2*MAXCOMLEN + 2 /* () */ + sizeof(uuid_string_t)]; |
| | 71 | |
| | 72 | strlcpy(c_name, caller->p_comm, sizeof(c_name)); |
| | 73 | uuid_unparse_upper(caller->p_uuid, uuidstr); |
| | 74 | strlcat(c_name, "(", sizeof(c_name)); |
| | 75 | strlcat(c_name, uuidstr, sizeof(c_name)); |
| | 76 | strlcat(c_name, ")", sizeof(c_name)); |
| | 77 | if (0 != escape_str(c_name, strlen(c_name), sizeof(c_name))) { |
| | 78 | return; |
| | 79 | } |
| | 80 | |
| | 81 | strlcpy(t_name, target->p_comm, sizeof(t_name)); |
| | 82 | uuid_unparse_upper(target->p_uuid, uuidstr); |
| | 83 | strlcat(t_name, "(", sizeof(t_name)); |
| | 84 | strlcat(t_name, uuidstr, sizeof(t_name)); |
| | 85 | strlcat(t_name, ")", sizeof(t_name)); |
| | 86 | if (0 != escape_str(t_name, strlen(t_name), sizeof(t_name))) { |
| | 87 | return; |
| | 88 | } |
| | 89 | #if DEBUG |
| | 90 | printf("EXTMOD: %s(%d) -> %s(%d)\n", |
| | 91 | c_name, |
| | 92 | proc_pid(caller), |
| | 93 | t_name, |
| | 94 | proc_pid(target)); |
| | 95 | #endif |
| | 96 | |
| | 97 | kern_asl_msg(LOG_DEBUG, "messagetracer", |
| | 98 | 5, |
| | 99 | "com.apple.message.domain", "com.apple.kernel.external_modification", /* 0 */ |
| | 100 | "com.apple.message.signature", c_name, /* 1 */ |
| | 101 | "com.apple.message.signature2", t_name, /* 2 */ |
| | 102 | "com.apple.message.result", "noop", /* 3 */ |
| | 103 | "com.apple.message.summarize", "YES", /* 4 */ |
| | 104 | NULL); |
| | 105 | } |
| | 106 | } |
| | 107 | |
projects / apple / xnu.git / blame_incremental