bsd/vfs/vfs_fslog.c

   1 /*
   2  * Copyright (c) 2006-2017 Apple Inc. All rights reserved.
   3  *
   4  * @APPLE_OSREFERENCE_LICENSE_HEADER_START@
   5  *
   6  * This file contains Original Code and/or Modifications of Original Code
   7  * as defined in and that are subject to the Apple Public Source License
   8  * Version 2.0 (the 'License'). You may not use this file except in
   9  * compliance with the License. The rights granted to you under the License
  10  * may not be used to create, or enable the creation or redistribution of,
  11  * unlawful or unlicensed copies of an Apple operating system, or to
  12  * circumvent, violate, or enable the circumvention or violation of, any
  13  * terms of an Apple operating system software license agreement.
  14  *
  15  * Please obtain a copy of the License at
  16  * http://www.opensource.apple.com/apsl/ and read it before using this file.
  17  *
  18  * The Original Code and all software distributed under the License are
  19  * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
  20  * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
  21  * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
  22  * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
  23  * Please see the License for the specific language governing rights and
  24  * limitations under the License.
  25  *
  26  * @APPLE_OSREFERENCE_LICENSE_HEADER_END@
  27  */
  28
  29 #include <sys/errno.h>
  30 #include <sys/types.h>
  31 #include <kern/kalloc.h>
  32 #include <sys/buf.h>
  33 #include <sys/time.h>
  34 #include <sys/kauth.h>
  35 #include <sys/mount.h>
  36 #include <sys/vnode.h>
  37 #include <sys/syslog.h>
  38 #include <sys/vnode_internal.h>
  39 #include <sys/fslog.h>
  40 #include <sys/mount_internal.h>
  41 #include <sys/kasl.h>
  42
  43 #include <sys/queue.h>
  44 #include <kern/zalloc.h>
  45
  46 #include <uuid/uuid.h>
  47
  48 #include <stdarg.h>
  49
  50 /* Log information about external modification of a process,
  51  * using MessageTracer formatting. Assumes that both the caller
  52  * and target are appropriately locked.
  53  * Currently prints following information -
  54  *      1. Caller process name (truncated to 16 characters)
  55  *      2. Caller process Mach-O UUID
  56  *  3. Target process name (truncated to 16 characters)
  57  *  4. Target process Mach-O UUID
  58  */
  59 void
  60 fslog_extmod_msgtracer(proc_t caller, proc_t target)
  61 {
  62         if ((caller != PROC_NULL) && (target != PROC_NULL)) {
  63                 /*
  64                  * Print into buffer large enough for "ThisIsAnApplicat(BC223DD7-B314-42E0-B6B0-C5D2E6638337)",
  65                  * including space for escaping, and NUL byte included in sizeof(uuid_string_t).
  66                  */
  67
  68                 uuid_string_t uuidstr;
  69                 char c_name[2 * MAXCOMLEN + 2 /* () */ + sizeof(uuid_string_t)];
  70                 char t_name[2 * MAXCOMLEN + 2 /* () */ + sizeof(uuid_string_t)];
  71
  72                 strlcpy(c_name, caller->p_comm, sizeof(c_name));
  73                 uuid_unparse_upper(caller->p_uuid, uuidstr);
  74                 strlcat(c_name, "(", sizeof(c_name));
  75                 strlcat(c_name, uuidstr, sizeof(c_name));
  76                 strlcat(c_name, ")", sizeof(c_name));
  77                 if (0 != escape_str(c_name, strlen(c_name) + 1, sizeof(c_name))) {
  78                         return;
  79                 }
  80
  81                 strlcpy(t_name, target->p_comm, sizeof(t_name));
  82                 uuid_unparse_upper(target->p_uuid, uuidstr);
  83                 strlcat(t_name, "(", sizeof(t_name));
  84                 strlcat(t_name, uuidstr, sizeof(t_name));
  85                 strlcat(t_name, ")", sizeof(t_name));
  86                 if (0 != escape_str(t_name, strlen(t_name) + 1, sizeof(t_name))) {
  87                         return;
  88                 }
  89 #if DEBUG
  90                 printf("EXTMOD: %s(%d) -> %s(%d)\n",
  91                     c_name,
  92                     proc_pid(caller),
  93                     t_name,
  94                     proc_pid(target));
  95 #endif
  96
  97                 kern_asl_msg(LOG_DEBUG, "messagetracer",
  98                     5,
  99                     "com.apple.message.domain", "com.apple.kernel.external_modification",                                     /* 0 */
 100                     "com.apple.message.signature", c_name,                                     /* 1 */
 101                     "com.apple.message.signature2", t_name,                                     /* 2 */
 102                     "com.apple.message.result", "noop",                                     /* 3 */
 103                     "com.apple.message.summarize", "YES",                                     /* 4 */
 104                     NULL);
 105         }
 106 }
 107
 108 #if defined(__x86_64__)
 109
 110 /*
 111  * Log information about floating point exception handling
 112  */
 113
 114 static LCK_GRP_DECLARE(fpxlock_grp, "fpx");
 115 static LCK_MTX_DECLARE(fpxlock, &fpxlock_grp);
 116
 117 struct fpx_event {
 118         uuid_t fe_uuid;
 119         uint32_t fe_code;
 120         uint32_t fe_xcpt;
 121         TAILQ_ENTRY(fpx_event) fe_link;
 122 };
 123
 124 static bool
 125 match_fpx_event(const struct fpx_event *fe,
 126     const uuid_t uuid, const uint32_t code, const uint32_t xcpt)
 127 {
 128         return code == fe->fe_code && xcpt == fe->fe_xcpt &&
 129                0 == memcmp(uuid, fe->fe_uuid, sizeof(uuid_t));
 130 }
 131
 132 #if FPX_EVENT_DBG
 133 static __attribute__((noinline)) void
 134 print_fpx_event(const char *pfx, const struct fpx_event *fe)
 135 {
 136         uuid_string_t uustr;
 137         uuid_unparse_upper(fe->fe_uuid, uustr);
 138         printf("%s: code 0x%x xcpt 0x%x uuid '%s'\n",
 139             pfx, fe->fe_code, fe->fe_xcpt, uustr);
 140 }
 141 #define DPRINTF_FPX_EVENT(pfx, fe)      print_fpx_event(pfx, fe)
 142 #else
 143 #define DPRINTF_FPX_EVENT(pfx, fe)      /* nothing */
 144 #endif
 145
 146 #define MAX_DISTINCT_FPX_EVENTS 101     /* (approx one page of heap) */
 147
 148 /*
 149  * Filter to detect "new" <uuid, code, xcpt> tuples.
 150  * Uses limited amount of state, managed LRU.
 151  * Optimized to ignore repeated invocation with the same tuple.
 152  *
 153  * Note that there are 6 exception types, two types of FP, and
 154  * many binaries, so don't make the list bound too small.
 155  * It's also a linear search, so don't make it too large either.
 156  * Next level filtering provided by syslogd, and summarization.
 157  */
 158 static bool
 159 novel_fpx_event(const uuid_t uuid, uint32_t code, uint32_t xcpt)
 160 {
 161         static TAILQ_HEAD(fpx_event_head, fpx_event) fehead =
 162             TAILQ_HEAD_INITIALIZER(fehead);
 163         struct fpx_event *fe;
 164
 165         lck_mtx_lock(&fpxlock);
 166
 167         fe = TAILQ_FIRST(&fehead);
 168         if (NULL != fe &&
 169             match_fpx_event(fe, uuid, code, xcpt)) {
 170                 /* seen before and element already at head */
 171                 lck_mtx_unlock(&fpxlock);
 172                 DPRINTF_FPX_EVENT("seen, head", fe);
 173                 return false;
 174         }
 175
 176         unsigned int count = 0;
 177
 178         TAILQ_FOREACH(fe, &fehead, fe_link) {
 179                 if (match_fpx_event(fe, uuid, code, xcpt)) {
 180                         /* seen before, now move element to head */
 181                         TAILQ_REMOVE(&fehead, fe, fe_link);
 182                         TAILQ_INSERT_HEAD(&fehead, fe, fe_link);
 183                         lck_mtx_unlock(&fpxlock);
 184                         DPRINTF_FPX_EVENT("seen, moved to head", fe);
 185                         return false;
 186                 }
 187                 count++;
 188         }
 189
 190         /* not recorded here => novel */
 191
 192         if (count >= MAX_DISTINCT_FPX_EVENTS) {
 193                 /* reuse LRU element */
 194                 fe = TAILQ_LAST(&fehead, fpx_event_head);
 195                 TAILQ_REMOVE(&fehead, fe, fe_link);
 196                 DPRINTF_FPX_EVENT("reusing", fe);
 197         } else {
 198                 /* add a new element to the list */
 199                 fe = zalloc_permanent_type(struct fpx_event);
 200         }
 201         memcpy(fe->fe_uuid, uuid, sizeof(uuid_t));
 202         fe->fe_code = code;
 203         fe->fe_xcpt = xcpt;
 204         TAILQ_INSERT_HEAD(&fehead, fe, fe_link);
 205         lck_mtx_unlock(&fpxlock);
 206
 207         DPRINTF_FPX_EVENT("novel", fe);
 208
 209         return true;
 210 }
 211
 212 void
 213 fpxlog(
 214         int code,       /* Mach exception code: e.g. 5 or 8 */
 215         uint32_t stat,  /* Full FP status register bits */
 216         uint32_t ctrl,  /* Full FP control register bits */
 217         uint32_t xcpt)  /* Exception bits from FP status */
 218 {
 219         proc_t p = current_proc();
 220         if (PROC_NULL == p) {
 221                 return;
 222         }
 223
 224         uuid_t uuid;
 225         proc_getexecutableuuid(p, uuid, sizeof(uuid));
 226
 227         /*
 228          * Check to see if an exception with this <uuid, code, xcpt>
 229          * has been seen before.  If "novel" then log a message.
 230          */
 231         if (!novel_fpx_event(uuid, code, xcpt)) {
 232                 return;
 233         }
 234
 235         const size_t nmlen = 2 * MAXCOMLEN + 1;
 236         char nm[nmlen] = {};
 237         proc_selfname(nm, nmlen);
 238         if (escape_str(nm, strlen(nm) + 1, nmlen)) {
 239                 snprintf(nm, nmlen, "(a.out)");
 240         }
 241
 242         const size_t slen = 8 + 1 + 8 + 1;
 243         char xcptstr[slen], csrstr[slen];
 244
 245         snprintf(xcptstr, slen, "%x.%x", code, xcpt);
 246         if (ctrl == stat) {
 247                 snprintf(csrstr, slen, "%x", ctrl);
 248         } else {
 249                 snprintf(csrstr, slen, "%x.%x", ctrl, stat);
 250         }
 251
 252 #if DEVELOPMENT || DEBUG
 253         printf("%s[%d]: com.apple.kernel.fpx: %s, %s\n",
 254             nm, proc_pid(p), xcptstr, csrstr);
 255 #endif
 256         kern_asl_msg(LOG_DEBUG, "messagetracer", 5,
 257             /* 0 */ "com.apple.message.domain", "com.apple.kernel.fpx",
 258             /* 1 */ "com.apple.message.signature", nm,
 259             /* 2 */ "com.apple.message.signature2", xcptstr,
 260             /* 3 */ "com.apple.message.value", csrstr,
 261             /* 4 */ "com.apple.message.summarize", "YES",
 262             NULL);
 263 }
 264
 265 #endif /* __x86_64__ */