bsd/vfs/vfs_fslog.c

   1 /*
   2  * Copyright (c) 2006-2017 Apple Inc. All rights reserved.
   3  *
   4  * @APPLE_OSREFERENCE_LICENSE_HEADER_START@
   5  *
   6  * This file contains Original Code and/or Modifications of Original Code
   7  * as defined in and that are subject to the Apple Public Source License
   8  * Version 2.0 (the 'License'). You may not use this file except in
   9  * compliance with the License. The rights granted to you under the License
  10  * may not be used to create, or enable the creation or redistribution of,
  11  * unlawful or unlicensed copies of an Apple operating system, or to
  12  * circumvent, violate, or enable the circumvention or violation of, any
  13  * terms of an Apple operating system software license agreement.
  14  *
  15  * Please obtain a copy of the License at
  16  * http://www.opensource.apple.com/apsl/ and read it before using this file.
  17  *
  18  * The Original Code and all software distributed under the License are
  19  * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
  20  * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
  21  * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
  22  * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
  23  * Please see the License for the specific language governing rights and
  24  * limitations under the License.
  25  *
  26  * @APPLE_OSREFERENCE_LICENSE_HEADER_END@
  27  */
  28
  29 #include <sys/errno.h>
  30 #include <sys/types.h>
  31 #include <sys/malloc.h>
  32 #include <sys/buf.h>
  33 #include <sys/time.h>
  34 #include <sys/kauth.h>
  35 #include <sys/mount.h>
  36 #include <sys/vnode.h>
  37 #include <sys/syslog.h>
  38 #include <sys/vnode_internal.h>
  39 #include <sys/fslog.h>
  40 #include <sys/mount_internal.h>
  41 #include <sys/kasl.h>
  42
  43 #include <sys/queue.h>
  44 #include <kern/kalloc.h>
  45
  46 #include <uuid/uuid.h>
  47
  48 #include <stdarg.h>
  49
  50 /* Log information about external modification of a process,
  51  * using MessageTracer formatting. Assumes that both the caller
  52  * and target are appropriately locked.
  53  * Currently prints following information -
  54  *      1. Caller process name (truncated to 16 characters)
  55  *      2. Caller process Mach-O UUID
  56  *  3. Target process name (truncated to 16 characters)
  57  *  4. Target process Mach-O UUID
  58  */
  59 void
  60 fslog_extmod_msgtracer(proc_t caller, proc_t target)
  61 {
  62         if ((caller != PROC_NULL) && (target != PROC_NULL)) {
  63
  64                 /*
  65                  * Print into buffer large enough for "ThisIsAnApplicat(BC223DD7-B314-42E0-B6B0-C5D2E6638337)",
  66                  * including space for escaping, and NUL byte included in sizeof(uuid_string_t).
  67                  */
  68
  69                 uuid_string_t uuidstr;
  70                 char c_name[2*MAXCOMLEN + 2 /* () */ + sizeof(uuid_string_t)];
  71                 char t_name[2*MAXCOMLEN + 2 /* () */ + sizeof(uuid_string_t)];
  72
  73                 strlcpy(c_name, caller->p_comm, sizeof(c_name));
  74                 uuid_unparse_upper(caller->p_uuid, uuidstr);
  75                 strlcat(c_name, "(", sizeof(c_name));
  76                 strlcat(c_name, uuidstr, sizeof(c_name));
  77                 strlcat(c_name, ")", sizeof(c_name));
  78                 if (0 != escape_str(c_name, strlen(c_name), sizeof(c_name))) {
  79                         return;
  80                 }
  81
  82                 strlcpy(t_name, target->p_comm, sizeof(t_name));
  83                 uuid_unparse_upper(target->p_uuid, uuidstr);
  84                 strlcat(t_name, "(", sizeof(t_name));
  85                 strlcat(t_name, uuidstr, sizeof(t_name));
  86                 strlcat(t_name, ")", sizeof(t_name));
  87                 if (0 != escape_str(t_name, strlen(t_name), sizeof(t_name))) {
  88                         return;
  89                 }
  90 #if DEBUG
  91                 printf("EXTMOD: %s(%d) -> %s(%d)\n",
  92                            c_name,
  93                            proc_pid(caller),
  94                            t_name,
  95                            proc_pid(target));
  96 #endif
  97
  98                 kern_asl_msg(LOG_DEBUG, "messagetracer",
  99                                                         5,
 100                                                         "com.apple.message.domain", "com.apple.kernel.external_modification", /* 0 */
 101                                                         "com.apple.message.signature", c_name, /* 1 */
 102                                                         "com.apple.message.signature2", t_name, /* 2 */
 103                                                         "com.apple.message.result", "noop", /* 3 */
 104                                                         "com.apple.message.summarize", "YES", /* 4 */
 105                                                         NULL);
 106         }
 107 }
 108
 109 #if defined(__x86_64__)
 110
 111 /*
 112  * Log information about floating point exception handling
 113  */
 114
 115 static lck_mtx_t fpxlock;
 116
 117 void
 118 fpxlog_init(void)
 119 {
 120         lck_grp_attr_t *lck_grp_attr = lck_grp_attr_alloc_init();
 121         lck_grp_t *lck_grp = lck_grp_alloc_init("fpx", lck_grp_attr);
 122         lck_mtx_init(&fpxlock, lck_grp, LCK_ATTR_NULL);
 123 }
 124
 125 struct fpx_event {
 126         uuid_t fe_uuid;
 127         uint32_t fe_code;
 128         uint32_t fe_xcpt;
 129         TAILQ_ENTRY(fpx_event) fe_link;
 130 };
 131
 132 static bool
 133 match_fpx_event(const struct fpx_event *fe,
 134     const uuid_t uuid, const uint32_t code, const uint32_t xcpt)
 135 {
 136         return (code == fe->fe_code && xcpt == fe->fe_xcpt &&
 137             0 == memcmp(uuid, fe->fe_uuid, sizeof (uuid_t)));
 138 }
 139
 140 #if FPX_EVENT_DBG
 141 static __attribute__((noinline)) void
 142 print_fpx_event(const char *pfx, const struct fpx_event *fe)
 143 {
 144         uuid_string_t uustr;
 145         uuid_unparse_upper(fe->fe_uuid, uustr);
 146         printf("%s: code 0x%x xcpt 0x%x uuid '%s'\n",
 147             pfx, fe->fe_code, fe->fe_xcpt, uustr);
 148 }
 149 #define DPRINTF_FPX_EVENT(pfx, fe)      print_fpx_event(pfx, fe)
 150 #else
 151 #define DPRINTF_FPX_EVENT(pfx, fe)      /* nothing */
 152 #endif
 153
 154 #define MAX_DISTINCT_FPX_EVENTS 101     /* (approx one page of heap) */
 155
 156 /*
 157  * Filter to detect "new" <uuid, code, xcpt> tuples.
 158  * Uses limited amount of state, managed LRU.
 159  * Optimized to ignore repeated invocation with the same tuple.
 160  *
 161  * Note that there are 6 exception types, two types of FP, and
 162  * many binaries, so don't make the list bound too small.
 163  * It's also a linear search, so don't make it too large either.
 164  * Next level filtering provided by syslogd, and summarization.
 165  */
 166 static bool
 167 novel_fpx_event(const uuid_t uuid, uint32_t code, uint32_t xcpt)
 168 {
 169         static TAILQ_HEAD(fpx_event_head, fpx_event) fehead =
 170                 TAILQ_HEAD_INITIALIZER(fehead);
 171         struct fpx_event *fe;
 172
 173         lck_mtx_lock(&fpxlock);
 174
 175         fe = TAILQ_FIRST(&fehead);
 176         if (NULL != fe &&
 177             match_fpx_event(fe, uuid, code, xcpt)) {
 178                 /* seen before and element already at head */
 179                 lck_mtx_unlock(&fpxlock);
 180                 DPRINTF_FPX_EVENT("seen, head", fe);
 181                 return (false);
 182         }
 183
 184         unsigned int count = 0;
 185
 186         TAILQ_FOREACH(fe, &fehead, fe_link) {
 187                 if (match_fpx_event(fe, uuid, code, xcpt)) {
 188                         /* seen before, now move element to head */
 189                         TAILQ_REMOVE(&fehead, fe, fe_link);
 190                         TAILQ_INSERT_HEAD(&fehead, fe, fe_link);
 191                         lck_mtx_unlock(&fpxlock);
 192                         DPRINTF_FPX_EVENT("seen, moved to head", fe);
 193                         return (false);
 194                 }
 195                 count++;
 196         }
 197
 198         /* not recorded here => novel */
 199
 200         if (count >= MAX_DISTINCT_FPX_EVENTS) {
 201                 /* reuse LRU element */
 202                 fe = TAILQ_LAST(&fehead, fpx_event_head);
 203                 TAILQ_REMOVE(&fehead, fe, fe_link);
 204                 DPRINTF_FPX_EVENT("reusing", fe);
 205         } else {
 206                 /* add a new element to the list */
 207                 fe = kalloc(sizeof (*fe));
 208         }
 209         memcpy(fe->fe_uuid, uuid, sizeof (uuid_t));
 210         fe->fe_code = code;
 211         fe->fe_xcpt = xcpt;
 212         TAILQ_INSERT_HEAD(&fehead, fe, fe_link);
 213         lck_mtx_unlock(&fpxlock);
 214
 215         DPRINTF_FPX_EVENT("novel", fe);
 216
 217         return (true);
 218 }
 219
 220 void
 221 fpxlog(
 222         int code,       /* Mach exception code: e.g. 5 or 8 */
 223         uint32_t stat,  /* Full FP status register bits */
 224         uint32_t ctrl,  /* Full FP control register bits */
 225         uint32_t xcpt)  /* Exception bits from FP status */
 226 {
 227         proc_t p = current_proc();
 228         if (PROC_NULL == p)
 229                 return;
 230
 231         uuid_t uuid;
 232         proc_getexecutableuuid(p, uuid, sizeof (uuid));
 233
 234         /*
 235          * Check to see if an exception with this <uuid, code, xcpt>
 236          * has been seen before.  If "novel" then log a message.
 237          */
 238         if (!novel_fpx_event(uuid, code, xcpt))
 239                 return;
 240
 241         const size_t nmlen = 2 * MAXCOMLEN + 1;
 242         char nm[nmlen] = {};
 243         proc_selfname(nm, nmlen);
 244         if (escape_str(nm, strlen(nm) + 1, nmlen))
 245                 snprintf(nm, nmlen, "(a.out)");
 246
 247         const size_t slen = 8 + 1 + 8 + 1;
 248         char xcptstr[slen], csrstr[slen];
 249
 250         snprintf(xcptstr, slen, "%x.%x", code, xcpt);
 251         if (ctrl == stat)
 252                 snprintf(csrstr, slen, "%x", ctrl);
 253         else
 254                 snprintf(csrstr, slen, "%x.%x", ctrl, stat);
 255
 256 #if DEVELOPMENT || DEBUG
 257         printf("%s[%d]: com.apple.kernel.fpx: %s, %s\n",
 258                 nm, proc_pid(p), xcptstr, csrstr);
 259 #endif
 260         kern_asl_msg(LOG_DEBUG, "messagetracer", 5,
 261         /* 0 */ "com.apple.message.domain", "com.apple.kernel.fpx",
 262         /* 1 */ "com.apple.message.signature", nm,
 263         /* 2 */ "com.apple.message.signature2", xcptstr,
 264         /* 3 */ "com.apple.message.value", csrstr,
 265         /* 4 */ "com.apple.message.summarize", "YES",
 266                 NULL);
 267 }
 268
 269 #else
 270
 271 void
 272 fpxlog_init(void)
 273 {}
 274
 275 #endif /* __x86_64__ */