f701e5b73a
This change adds a procfs connector event, which is emitted on every successful process tracer attach or detach. If some process connects to other one, kernelspace connector reports process id and thread group id of both these involved processes. On disconnection null process id is returned. Such an event allows to create a simple automated userspace mechanism to be aware about processes connecting to others, therefore predefined process policies can be applied to them if needed. Note, a detach signal is emitted only in case, if a tracer process explicitly executes PTRACE_DETACH request. In other cases like tracee or tracer exit detach event from proc connector is not reported. Signed-off-by: Vladimir Zapolskiy <vzapolskiy@gmail.com> Acked-by: Evgeniy Polyakov <zbr@ioremap.net> Cc: David S. Miller <davem@davemloft.net> Signed-off-by: Oleg Nesterov <oleg@redhat.com>
145 lines
3.7 KiB
C
145 lines
3.7 KiB
C
/*
|
|
* cn_proc.h - process events connector
|
|
*
|
|
* Copyright (C) Matt Helsley, IBM Corp. 2005
|
|
* Based on cn_fork.h by Nguyen Anh Quynh and Guillaume Thouvenin
|
|
* Copyright (C) 2005 Nguyen Anh Quynh <aquynh@gmail.com>
|
|
* Copyright (C) 2005 Guillaume Thouvenin <guillaume.thouvenin@bull.net>
|
|
*
|
|
* This program is free software; you can redistribute it and/or modify it
|
|
* under the terms of version 2.1 of the GNU Lesser General Public License
|
|
* as published by the Free Software Foundation.
|
|
*
|
|
* This program is distributed in the hope that it would be useful, but
|
|
* WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
|
|
*/
|
|
|
|
#ifndef CN_PROC_H
|
|
#define CN_PROC_H
|
|
|
|
#include <linux/types.h>
|
|
|
|
/*
|
|
* Userspace sends this enum to register with the kernel that it is listening
|
|
* for events on the connector.
|
|
*/
|
|
enum proc_cn_mcast_op {
|
|
PROC_CN_MCAST_LISTEN = 1,
|
|
PROC_CN_MCAST_IGNORE = 2
|
|
};
|
|
|
|
/*
|
|
* From the user's point of view, the process
|
|
* ID is the thread group ID and thread ID is the internal
|
|
* kernel "pid". So, fields are assigned as follow:
|
|
*
|
|
* In user space - In kernel space
|
|
*
|
|
* parent process ID = parent->tgid
|
|
* parent thread ID = parent->pid
|
|
* child process ID = child->tgid
|
|
* child thread ID = child->pid
|
|
*/
|
|
|
|
struct proc_event {
|
|
enum what {
|
|
/* Use successive bits so the enums can be used to record
|
|
* sets of events as well
|
|
*/
|
|
PROC_EVENT_NONE = 0x00000000,
|
|
PROC_EVENT_FORK = 0x00000001,
|
|
PROC_EVENT_EXEC = 0x00000002,
|
|
PROC_EVENT_UID = 0x00000004,
|
|
PROC_EVENT_GID = 0x00000040,
|
|
PROC_EVENT_SID = 0x00000080,
|
|
PROC_EVENT_PTRACE = 0x00000100,
|
|
/* "next" should be 0x00000400 */
|
|
/* "last" is the last process event: exit */
|
|
PROC_EVENT_EXIT = 0x80000000
|
|
} what;
|
|
__u32 cpu;
|
|
__u64 __attribute__((aligned(8))) timestamp_ns;
|
|
/* Number of nano seconds since system boot */
|
|
union { /* must be last field of proc_event struct */
|
|
struct {
|
|
__u32 err;
|
|
} ack;
|
|
|
|
struct fork_proc_event {
|
|
__kernel_pid_t parent_pid;
|
|
__kernel_pid_t parent_tgid;
|
|
__kernel_pid_t child_pid;
|
|
__kernel_pid_t child_tgid;
|
|
} fork;
|
|
|
|
struct exec_proc_event {
|
|
__kernel_pid_t process_pid;
|
|
__kernel_pid_t process_tgid;
|
|
} exec;
|
|
|
|
struct id_proc_event {
|
|
__kernel_pid_t process_pid;
|
|
__kernel_pid_t process_tgid;
|
|
union {
|
|
__u32 ruid; /* task uid */
|
|
__u32 rgid; /* task gid */
|
|
} r;
|
|
union {
|
|
__u32 euid;
|
|
__u32 egid;
|
|
} e;
|
|
} id;
|
|
|
|
struct sid_proc_event {
|
|
__kernel_pid_t process_pid;
|
|
__kernel_pid_t process_tgid;
|
|
} sid;
|
|
|
|
struct ptrace_proc_event {
|
|
__kernel_pid_t process_pid;
|
|
__kernel_pid_t process_tgid;
|
|
__kernel_pid_t tracer_pid;
|
|
__kernel_pid_t tracer_tgid;
|
|
} ptrace;
|
|
|
|
struct exit_proc_event {
|
|
__kernel_pid_t process_pid;
|
|
__kernel_pid_t process_tgid;
|
|
__u32 exit_code, exit_signal;
|
|
} exit;
|
|
} event_data;
|
|
};
|
|
|
|
#ifdef __KERNEL__
|
|
#ifdef CONFIG_PROC_EVENTS
|
|
void proc_fork_connector(struct task_struct *task);
|
|
void proc_exec_connector(struct task_struct *task);
|
|
void proc_id_connector(struct task_struct *task, int which_id);
|
|
void proc_sid_connector(struct task_struct *task);
|
|
void proc_ptrace_connector(struct task_struct *task, int which_id);
|
|
void proc_exit_connector(struct task_struct *task);
|
|
#else
|
|
static inline void proc_fork_connector(struct task_struct *task)
|
|
{}
|
|
|
|
static inline void proc_exec_connector(struct task_struct *task)
|
|
{}
|
|
|
|
static inline void proc_id_connector(struct task_struct *task,
|
|
int which_id)
|
|
{}
|
|
|
|
static inline void proc_sid_connector(struct task_struct *task)
|
|
{}
|
|
|
|
static inline void proc_ptrace_connector(struct task_struct *task,
|
|
int ptrace_id)
|
|
{}
|
|
|
|
static inline void proc_exit_connector(struct task_struct *task)
|
|
{}
|
|
#endif /* CONFIG_PROC_EVENTS */
|
|
#endif /* __KERNEL__ */
|
|
#endif /* CN_PROC_H */
|