1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25#include <linux/module.h>
26#include <linux/kernel.h>
27#include <linux/ktime.h>
28#include <linux/init.h>
29#include <linux/connector.h>
30#include <linux/gfp.h>
31#include <linux/ptrace.h>
32#include <linux/atomic.h>
33#include <linux/pid_namespace.h>
34
35#include <asm/unaligned.h>
36
37#include <linux/cn_proc.h>
38
39#define CN_PROC_MSG_SIZE (sizeof(struct cn_msg) + sizeof(struct proc_event))
40
41static atomic_t proc_event_num_listeners = ATOMIC_INIT(0);
42static struct cb_id cn_proc_event_id = { CN_IDX_PROC, CN_VAL_PROC };
43
44
45static DEFINE_PER_CPU(__u32, proc_event_counts) = { 0 };
46
47static inline void get_seq(__u32 *ts, int *cpu)
48{
49 preempt_disable();
50 *ts = __this_cpu_inc_return(proc_event_counts) - 1;
51 *cpu = smp_processor_id();
52 preempt_enable();
53}
54
55void proc_fork_connector(struct task_struct *task)
56{
57 struct cn_msg *msg;
58 struct proc_event *ev;
59 __u8 buffer[CN_PROC_MSG_SIZE];
60 struct timespec ts;
61 struct task_struct *parent;
62
63 if (atomic_read(&proc_event_num_listeners) < 1)
64 return;
65
66 msg = (struct cn_msg *)buffer;
67 ev = (struct proc_event *)msg->data;
68 memset(&ev->event_data, 0, sizeof(ev->event_data));
69 get_seq(&msg->seq, &ev->cpu);
70 ktime_get_ts(&ts);
71 put_unaligned(timespec_to_ns(&ts), (__u64 *)&ev->timestamp_ns);
72 ev->what = PROC_EVENT_FORK;
73 rcu_read_lock();
74 parent = rcu_dereference(task->real_parent);
75 ev->event_data.fork.parent_pid = parent->pid;
76 ev->event_data.fork.parent_tgid = parent->tgid;
77 rcu_read_unlock();
78 ev->event_data.fork.child_pid = task->pid;
79 ev->event_data.fork.child_tgid = task->tgid;
80
81 memcpy(&msg->id, &cn_proc_event_id, sizeof(msg->id));
82 msg->ack = 0;
83 msg->len = sizeof(*ev);
84 msg->flags = 0;
85
86 cn_netlink_send(msg, CN_IDX_PROC, GFP_KERNEL);
87}
88
89void proc_exec_connector(struct task_struct *task)
90{
91 struct cn_msg *msg;
92 struct proc_event *ev;
93 struct timespec ts;
94 __u8 buffer[CN_PROC_MSG_SIZE];
95
96 if (atomic_read(&proc_event_num_listeners) < 1)
97 return;
98
99 msg = (struct cn_msg *)buffer;
100 ev = (struct proc_event *)msg->data;
101 memset(&ev->event_data, 0, sizeof(ev->event_data));
102 get_seq(&msg->seq, &ev->cpu);
103 ktime_get_ts(&ts);
104 put_unaligned(timespec_to_ns(&ts), (__u64 *)&ev->timestamp_ns);
105 ev->what = PROC_EVENT_EXEC;
106 ev->event_data.exec.process_pid = task->pid;
107 ev->event_data.exec.process_tgid = task->tgid;
108
109 memcpy(&msg->id, &cn_proc_event_id, sizeof(msg->id));
110 msg->ack = 0;
111 msg->len = sizeof(*ev);
112 msg->flags = 0;
113 cn_netlink_send(msg, CN_IDX_PROC, GFP_KERNEL);
114}
115
116void proc_id_connector(struct task_struct *task, int which_id)
117{
118 struct cn_msg *msg;
119 struct proc_event *ev;
120 __u8 buffer[CN_PROC_MSG_SIZE];
121 struct timespec ts;
122 const struct cred *cred;
123
124 if (atomic_read(&proc_event_num_listeners) < 1)
125 return;
126
127 msg = (struct cn_msg *)buffer;
128 ev = (struct proc_event *)msg->data;
129 memset(&ev->event_data, 0, sizeof(ev->event_data));
130 ev->what = which_id;
131 ev->event_data.id.process_pid = task->pid;
132 ev->event_data.id.process_tgid = task->tgid;
133 rcu_read_lock();
134 cred = __task_cred(task);
135 if (which_id == PROC_EVENT_UID) {
136 ev->event_data.id.r.ruid = from_kuid_munged(&init_user_ns, cred->uid);
137 ev->event_data.id.e.euid = from_kuid_munged(&init_user_ns, cred->euid);
138 } else if (which_id == PROC_EVENT_GID) {
139 ev->event_data.id.r.rgid = from_kgid_munged(&init_user_ns, cred->gid);
140 ev->event_data.id.e.egid = from_kgid_munged(&init_user_ns, cred->egid);
141 } else {
142 rcu_read_unlock();
143 return;
144 }
145 rcu_read_unlock();
146 get_seq(&msg->seq, &ev->cpu);
147 ktime_get_ts(&ts);
148 put_unaligned(timespec_to_ns(&ts), (__u64 *)&ev->timestamp_ns);
149
150 memcpy(&msg->id, &cn_proc_event_id, sizeof(msg->id));
151 msg->ack = 0;
152 msg->len = sizeof(*ev);
153 msg->flags = 0;
154 cn_netlink_send(msg, CN_IDX_PROC, GFP_KERNEL);
155}
156
157void proc_sid_connector(struct task_struct *task)
158{
159 struct cn_msg *msg;
160 struct proc_event *ev;
161 struct timespec ts;
162 __u8 buffer[CN_PROC_MSG_SIZE];
163
164 if (atomic_read(&proc_event_num_listeners) < 1)
165 return;
166
167 msg = (struct cn_msg *)buffer;
168 ev = (struct proc_event *)msg->data;
169 memset(&ev->event_data, 0, sizeof(ev->event_data));
170 get_seq(&msg->seq, &ev->cpu);
171 ktime_get_ts(&ts);
172 put_unaligned(timespec_to_ns(&ts), (__u64 *)&ev->timestamp_ns);
173 ev->what = PROC_EVENT_SID;
174 ev->event_data.sid.process_pid = task->pid;
175 ev->event_data.sid.process_tgid = task->tgid;
176
177 memcpy(&msg->id, &cn_proc_event_id, sizeof(msg->id));
178 msg->ack = 0;
179 msg->len = sizeof(*ev);
180 msg->flags = 0;
181 cn_netlink_send(msg, CN_IDX_PROC, GFP_KERNEL);
182}
183
184void proc_ptrace_connector(struct task_struct *task, int ptrace_id)
185{
186 struct cn_msg *msg;
187 struct proc_event *ev;
188 struct timespec ts;
189 __u8 buffer[CN_PROC_MSG_SIZE];
190
191 if (atomic_read(&proc_event_num_listeners) < 1)
192 return;
193
194 msg = (struct cn_msg *)buffer;
195 ev = (struct proc_event *)msg->data;
196 memset(&ev->event_data, 0, sizeof(ev->event_data));
197 get_seq(&msg->seq, &ev->cpu);
198 ktime_get_ts(&ts);
199 put_unaligned(timespec_to_ns(&ts), (__u64 *)&ev->timestamp_ns);
200 ev->what = PROC_EVENT_PTRACE;
201 ev->event_data.ptrace.process_pid = task->pid;
202 ev->event_data.ptrace.process_tgid = task->tgid;
203 if (ptrace_id == PTRACE_ATTACH) {
204 ev->event_data.ptrace.tracer_pid = current->pid;
205 ev->event_data.ptrace.tracer_tgid = current->tgid;
206 } else if (ptrace_id == PTRACE_DETACH) {
207 ev->event_data.ptrace.tracer_pid = 0;
208 ev->event_data.ptrace.tracer_tgid = 0;
209 } else
210 return;
211
212 memcpy(&msg->id, &cn_proc_event_id, sizeof(msg->id));
213 msg->ack = 0;
214 msg->len = sizeof(*ev);
215 msg->flags = 0;
216 cn_netlink_send(msg, CN_IDX_PROC, GFP_KERNEL);
217}
218
219void proc_comm_connector(struct task_struct *task)
220{
221 struct cn_msg *msg;
222 struct proc_event *ev;
223 struct timespec ts;
224 __u8 buffer[CN_PROC_MSG_SIZE];
225
226 if (atomic_read(&proc_event_num_listeners) < 1)
227 return;
228
229 msg = (struct cn_msg *)buffer;
230 ev = (struct proc_event *)msg->data;
231 memset(&ev->event_data, 0, sizeof(ev->event_data));
232 get_seq(&msg->seq, &ev->cpu);
233 ktime_get_ts(&ts);
234 put_unaligned(timespec_to_ns(&ts), (__u64 *)&ev->timestamp_ns);
235 ev->what = PROC_EVENT_COMM;
236 ev->event_data.comm.process_pid = task->pid;
237 ev->event_data.comm.process_tgid = task->tgid;
238 get_task_comm(ev->event_data.comm.comm, task);
239
240 memcpy(&msg->id, &cn_proc_event_id, sizeof(msg->id));
241 msg->ack = 0;
242 msg->len = sizeof(*ev);
243 msg->flags = 0;
244 cn_netlink_send(msg, CN_IDX_PROC, GFP_KERNEL);
245}
246
247void proc_coredump_connector(struct task_struct *task)
248{
249 struct cn_msg *msg;
250 struct proc_event *ev;
251 __u8 buffer[CN_PROC_MSG_SIZE];
252 struct timespec ts;
253
254 if (atomic_read(&proc_event_num_listeners) < 1)
255 return;
256
257 msg = (struct cn_msg *)buffer;
258 ev = (struct proc_event *)msg->data;
259 memset(&ev->event_data, 0, sizeof(ev->event_data));
260 get_seq(&msg->seq, &ev->cpu);
261 ktime_get_ts(&ts);
262 put_unaligned(timespec_to_ns(&ts), (__u64 *)&ev->timestamp_ns);
263 ev->what = PROC_EVENT_COREDUMP;
264 ev->event_data.coredump.process_pid = task->pid;
265 ev->event_data.coredump.process_tgid = task->tgid;
266
267 memcpy(&msg->id, &cn_proc_event_id, sizeof(msg->id));
268 msg->ack = 0;
269 msg->len = sizeof(*ev);
270 msg->flags = 0;
271 cn_netlink_send(msg, CN_IDX_PROC, GFP_KERNEL);
272}
273
274void proc_exit_connector(struct task_struct *task)
275{
276 struct cn_msg *msg;
277 struct proc_event *ev;
278 __u8 buffer[CN_PROC_MSG_SIZE];
279 struct timespec ts;
280
281 if (atomic_read(&proc_event_num_listeners) < 1)
282 return;
283
284 msg = (struct cn_msg *)buffer;
285 ev = (struct proc_event *)msg->data;
286 memset(&ev->event_data, 0, sizeof(ev->event_data));
287 get_seq(&msg->seq, &ev->cpu);
288 ktime_get_ts(&ts);
289 put_unaligned(timespec_to_ns(&ts), (__u64 *)&ev->timestamp_ns);
290 ev->what = PROC_EVENT_EXIT;
291 ev->event_data.exit.process_pid = task->pid;
292 ev->event_data.exit.process_tgid = task->tgid;
293 ev->event_data.exit.exit_code = task->exit_code;
294 ev->event_data.exit.exit_signal = task->exit_signal;
295
296 memcpy(&msg->id, &cn_proc_event_id, sizeof(msg->id));
297 msg->ack = 0;
298 msg->len = sizeof(*ev);
299 msg->flags = 0;
300 cn_netlink_send(msg, CN_IDX_PROC, GFP_KERNEL);
301}
302
303
304
305
306
307
308
309
310
311static void cn_proc_ack(int err, int rcvd_seq, int rcvd_ack)
312{
313 struct cn_msg *msg;
314 struct proc_event *ev;
315 __u8 buffer[CN_PROC_MSG_SIZE];
316 struct timespec ts;
317
318 if (atomic_read(&proc_event_num_listeners) < 1)
319 return;
320
321 msg = (struct cn_msg *)buffer;
322 ev = (struct proc_event *)msg->data;
323 memset(&ev->event_data, 0, sizeof(ev->event_data));
324 msg->seq = rcvd_seq;
325 ktime_get_ts(&ts);
326 put_unaligned(timespec_to_ns(&ts), (__u64 *)&ev->timestamp_ns);
327 ev->cpu = -1;
328 ev->what = PROC_EVENT_NONE;
329 ev->event_data.ack.err = err;
330 memcpy(&msg->id, &cn_proc_event_id, sizeof(msg->id));
331 msg->ack = rcvd_ack + 1;
332 msg->len = sizeof(*ev);
333 msg->flags = 0;
334 cn_netlink_send(msg, CN_IDX_PROC, GFP_KERNEL);
335}
336
337
338
339
340
341static void cn_proc_mcast_ctl(struct cn_msg *msg,
342 struct netlink_skb_parms *nsp)
343{
344 enum proc_cn_mcast_op *mc_op = NULL;
345 int err = 0;
346
347 if (msg->len != sizeof(*mc_op))
348 return;
349
350
351
352
353
354
355 if ((current_user_ns() != &init_user_ns) ||
356 (task_active_pid_ns(current) != &init_pid_ns))
357 return;
358
359
360 if (!capable(CAP_NET_ADMIN)) {
361 err = EPERM;
362 goto out;
363 }
364
365 mc_op = (enum proc_cn_mcast_op *)msg->data;
366 switch (*mc_op) {
367 case PROC_CN_MCAST_LISTEN:
368 atomic_inc(&proc_event_num_listeners);
369 break;
370 case PROC_CN_MCAST_IGNORE:
371 atomic_dec(&proc_event_num_listeners);
372 break;
373 default:
374 err = EINVAL;
375 break;
376 }
377
378out:
379 cn_proc_ack(err, msg->seq, msg->ack);
380}
381
382
383
384
385
386
387static int __init cn_proc_init(void)
388{
389 int err = cn_add_callback(&cn_proc_event_id,
390 "cn_proc",
391 &cn_proc_mcast_ctl);
392 if (err) {
393 pr_warn("cn_proc failed to register\n");
394 return err;
395 }
396 return 0;
397}
398
399module_init(cn_proc_init);
400