bsd/vfs/vfs_fslog.c

   1 /*
   2  * Copyright (c) 2006-2017 Apple Inc. All rights reserved.
   3  *
   4  * @APPLE_OSREFERENCE_LICENSE_HEADER_START@
   5  *
   6  * This file contains Original Code and/or Modifications of Original Code
   7  * as defined in and that are subject to the Apple Public Source License
   8  * Version 2.0 (the 'License'). You may not use this file except in
   9  * compliance with the License. The rights granted to you under the License
  10  * may not be used to create, or enable the creation or redistribution of,
  11  * unlawful or unlicensed copies of an Apple operating system, or to
  12  * circumvent, violate, or enable the circumvention or violation of, any
  13  * terms of an Apple operating system software license agreement.
  14  *
  15  * Please obtain a copy of the License at
  16  * http://www.opensource.apple.com/apsl/ and read it before using this file.
  17  *
  18  * The Original Code and all software distributed under the License are
  19  * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
  20  * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
  21  * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
  22  * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
  23  * Please see the License for the specific language governing rights and
  24  * limitations under the License.
  25  *
  26  * @APPLE_OSREFERENCE_LICENSE_HEADER_END@
  27  */
  28
  29 #include <sys/errno.h>
  30 #include <sys/types.h>
  31 #include <sys/malloc.h>
  32 #include <sys/buf.h>
  33 #include <sys/time.h>
  34 #include <sys/kauth.h>
  35 #include <sys/mount.h>
  36 #include <sys/vnode.h>
  37 #include <sys/syslog.h>
  38 #include <sys/vnode_internal.h>
  39 #include <sys/fslog.h>
  40 #include <sys/mount_internal.h>
  41 #include <sys/kasl.h>
  42
  43 #include <sys/queue.h>
  44 #include <kern/kalloc.h>
  45
  46 #include <uuid/uuid.h>
  47
  48 #include <stdarg.h>
  49
  50 /* Log information about external modification of a process,
  51  * using MessageTracer formatting. Assumes that both the caller
  52  * and target are appropriately locked.
  53  * Currently prints following information -
  54  *      1. Caller process name (truncated to 16 characters)
  55  *      2. Caller process Mach-O UUID
  56  *  3. Target process name (truncated to 16 characters)
  57  *  4. Target process Mach-O UUID
  58  */
  59 void
  60 fslog_extmod_msgtracer(proc_t caller, proc_t target)
  61 {
  62         if ((caller != PROC_NULL) && (target != PROC_NULL)) {
  63                 /*
  64                  * Print into buffer large enough for "ThisIsAnApplicat(BC223DD7-B314-42E0-B6B0-C5D2E6638337)",
  65                  * including space for escaping, and NUL byte included in sizeof(uuid_string_t).
  66                  */
  67
  68                 uuid_string_t uuidstr;
  69                 char c_name[2 * MAXCOMLEN + 2 /* () */ + sizeof(uuid_string_t)];
  70                 char t_name[2 * MAXCOMLEN + 2 /* () */ + sizeof(uuid_string_t)];
  71
  72                 strlcpy(c_name, caller->p_comm, sizeof(c_name));
  73                 uuid_unparse_upper(caller->p_uuid, uuidstr);
  74                 strlcat(c_name, "(", sizeof(c_name));
  75                 strlcat(c_name, uuidstr, sizeof(c_name));
  76                 strlcat(c_name, ")", sizeof(c_name));
  77                 if (0 != escape_str(c_name, strlen(c_name) + 1, sizeof(c_name))) {
  78                         return;
  79                 }
  80
  81                 strlcpy(t_name, target->p_comm, sizeof(t_name));
  82                 uuid_unparse_upper(target->p_uuid, uuidstr);
  83                 strlcat(t_name, "(", sizeof(t_name));
  84                 strlcat(t_name, uuidstr, sizeof(t_name));
  85                 strlcat(t_name, ")", sizeof(t_name));
  86                 if (0 != escape_str(t_name, strlen(t_name) + 1, sizeof(t_name))) {
  87                         return;
  88                 }
  89 #if DEBUG
  90                 printf("EXTMOD: %s(%d) -> %s(%d)\n",
  91                     c_name,
  92                     proc_pid(caller),
  93                     t_name,
  94                     proc_pid(target));
  95 #endif
  96
  97                 kern_asl_msg(LOG_DEBUG, "messagetracer",
  98                     5,
  99                     "com.apple.message.domain", "com.apple.kernel.external_modification",                                     /* 0 */
 100                     "com.apple.message.signature", c_name,                                     /* 1 */
 101                     "com.apple.message.signature2", t_name,                                     /* 2 */
 102                     "com.apple.message.result", "noop",                                     /* 3 */
 103                     "com.apple.message.summarize", "YES",                                     /* 4 */
 104                     NULL);
 105         }
 106 }
 107
 108 #if defined(__x86_64__)
 109
 110 /*
 111  * Log information about floating point exception handling
 112  */
 113
 114 static lck_mtx_t fpxlock;
 115
 116 void
 117 fpxlog_init(void)
 118 {
 119         lck_grp_attr_t *lck_grp_attr = lck_grp_attr_alloc_init();
 120         lck_grp_t *lck_grp = lck_grp_alloc_init("fpx", lck_grp_attr);
 121         lck_mtx_init(&fpxlock, lck_grp, LCK_ATTR_NULL);
 122 }
 123
 124 struct fpx_event {
 125         uuid_t fe_uuid;
 126         uint32_t fe_code;
 127         uint32_t fe_xcpt;
 128         TAILQ_ENTRY(fpx_event) fe_link;
 129 };
 130
 131 static bool
 132 match_fpx_event(const struct fpx_event *fe,
 133     const uuid_t uuid, const uint32_t code, const uint32_t xcpt)
 134 {
 135         return code == fe->fe_code && xcpt == fe->fe_xcpt &&
 136                0 == memcmp(uuid, fe->fe_uuid, sizeof(uuid_t));
 137 }
 138
 139 #if FPX_EVENT_DBG
 140 static __attribute__((noinline)) void
 141 print_fpx_event(const char *pfx, const struct fpx_event *fe)
 142 {
 143         uuid_string_t uustr;
 144         uuid_unparse_upper(fe->fe_uuid, uustr);
 145         printf("%s: code 0x%x xcpt 0x%x uuid '%s'\n",
 146             pfx, fe->fe_code, fe->fe_xcpt, uustr);
 147 }
 148 #define DPRINTF_FPX_EVENT(pfx, fe)      print_fpx_event(pfx, fe)
 149 #else
 150 #define DPRINTF_FPX_EVENT(pfx, fe)      /* nothing */
 151 #endif
 152
 153 #define MAX_DISTINCT_FPX_EVENTS 101     /* (approx one page of heap) */
 154
 155 /*
 156  * Filter to detect "new" <uuid, code, xcpt> tuples.
 157  * Uses limited amount of state, managed LRU.
 158  * Optimized to ignore repeated invocation with the same tuple.
 159  *
 160  * Note that there are 6 exception types, two types of FP, and
 161  * many binaries, so don't make the list bound too small.
 162  * It's also a linear search, so don't make it too large either.
 163  * Next level filtering provided by syslogd, and summarization.
 164  */
 165 static bool
 166 novel_fpx_event(const uuid_t uuid, uint32_t code, uint32_t xcpt)
 167 {
 168         static TAILQ_HEAD(fpx_event_head, fpx_event) fehead =
 169             TAILQ_HEAD_INITIALIZER(fehead);
 170         struct fpx_event *fe;
 171
 172         lck_mtx_lock(&fpxlock);
 173
 174         fe = TAILQ_FIRST(&fehead);
 175         if (NULL != fe &&
 176             match_fpx_event(fe, uuid, code, xcpt)) {
 177                 /* seen before and element already at head */
 178                 lck_mtx_unlock(&fpxlock);
 179                 DPRINTF_FPX_EVENT("seen, head", fe);
 180                 return false;
 181         }
 182
 183         unsigned int count = 0;
 184
 185         TAILQ_FOREACH(fe, &fehead, fe_link) {
 186                 if (match_fpx_event(fe, uuid, code, xcpt)) {
 187                         /* seen before, now move element to head */
 188                         TAILQ_REMOVE(&fehead, fe, fe_link);
 189                         TAILQ_INSERT_HEAD(&fehead, fe, fe_link);
 190                         lck_mtx_unlock(&fpxlock);
 191                         DPRINTF_FPX_EVENT("seen, moved to head", fe);
 192                         return false;
 193                 }
 194                 count++;
 195         }
 196
 197         /* not recorded here => novel */
 198
 199         if (count >= MAX_DISTINCT_FPX_EVENTS) {
 200                 /* reuse LRU element */
 201                 fe = TAILQ_LAST(&fehead, fpx_event_head);
 202                 TAILQ_REMOVE(&fehead, fe, fe_link);
 203                 DPRINTF_FPX_EVENT("reusing", fe);
 204         } else {
 205                 /* add a new element to the list */
 206                 fe = kalloc(sizeof(*fe));
 207         }
 208         memcpy(fe->fe_uuid, uuid, sizeof(uuid_t));
 209         fe->fe_code = code;
 210         fe->fe_xcpt = xcpt;
 211         TAILQ_INSERT_HEAD(&fehead, fe, fe_link);
 212         lck_mtx_unlock(&fpxlock);
 213
 214         DPRINTF_FPX_EVENT("novel", fe);
 215
 216         return true;
 217 }
 218
 219 void
 220 fpxlog(
 221         int code,       /* Mach exception code: e.g. 5 or 8 */
 222         uint32_t stat,  /* Full FP status register bits */
 223         uint32_t ctrl,  /* Full FP control register bits */
 224         uint32_t xcpt)  /* Exception bits from FP status */
 225 {
 226         proc_t p = current_proc();
 227         if (PROC_NULL == p) {
 228                 return;
 229         }
 230
 231         uuid_t uuid;
 232         proc_getexecutableuuid(p, uuid, sizeof(uuid));
 233
 234         /*
 235          * Check to see if an exception with this <uuid, code, xcpt>
 236          * has been seen before.  If "novel" then log a message.
 237          */
 238         if (!novel_fpx_event(uuid, code, xcpt)) {
 239                 return;
 240         }
 241
 242         const size_t nmlen = 2 * MAXCOMLEN + 1;
 243         char nm[nmlen] = {};
 244         proc_selfname(nm, nmlen);
 245         if (escape_str(nm, strlen(nm) + 1, nmlen)) {
 246                 snprintf(nm, nmlen, "(a.out)");
 247         }
 248
 249         const size_t slen = 8 + 1 + 8 + 1;
 250         char xcptstr[slen], csrstr[slen];
 251
 252         snprintf(xcptstr, slen, "%x.%x", code, xcpt);
 253         if (ctrl == stat) {
 254                 snprintf(csrstr, slen, "%x", ctrl);
 255         } else {
 256                 snprintf(csrstr, slen, "%x.%x", ctrl, stat);
 257         }
 258
 259 #if DEVELOPMENT || DEBUG
 260         printf("%s[%d]: com.apple.kernel.fpx: %s, %s\n",
 261             nm, proc_pid(p), xcptstr, csrstr);
 262 #endif
 263         kern_asl_msg(LOG_DEBUG, "messagetracer", 5,
 264             /* 0 */ "com.apple.message.domain", "com.apple.kernel.fpx",
 265             /* 1 */ "com.apple.message.signature", nm,
 266             /* 2 */ "com.apple.message.signature2", xcptstr,
 267             /* 3 */ "com.apple.message.value", csrstr,
 268             /* 4 */ "com.apple.message.summarize", "YES",
 269             NULL);
 270 }
 271
 272 #else
 273
 274 void
 275 fpxlog_init(void)
 276 {
 277 }
 278
 279 #endif /* __x86_64__ */