src/common/event-rule-syscall.c

   1 /*
   2  * Copyright (C) 2019 - Jonathan Rajotte-Julien <jonathan.rajotte-julien@efficios.com>
   3  *
   4  * This library is free software; you can redistribute it and/or modify it
   5  * under the terms of the GNU Lesser General Public License, version 2.1 only,
   6  * as published by the Free Software Foundation.
   7  *
   8  * This library is distributed in the hope that it will be useful, but WITHOUT
   9  * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
  10  * FITNESS FOR A PARTICULAR PURPOSE. See the GNU Lesser General Public License
  11  * for more details.
  12  *
  13  * You should have received a copy of the GNU Lesser General Public License
  14  * along with this library; if not, write to the Free Software Foundation,
  15  * Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
  16  */
  17
  18 #include <lttng/event-rule/event-rule-internal.h>
  19 #include <lttng/event-rule/syscall-internal.h>
  20 #include <common/macros.h>
  21 #include <common/error.h>
  22 #include <common/runas.h>
  23 #include <assert.h>
  24
  25 #define IS_SYSCALL_EVENT_RULE(rule) ( \
  26         lttng_event_rule_get_type(rule) == LTTNG_EVENT_RULE_TYPE_SYSCALL \
  27         )
  28
  29 static
  30 void lttng_event_rule_syscall_destroy(struct lttng_event_rule *rule)
  31 {
  32         struct lttng_event_rule_syscall *syscall;
  33
  34         if (rule == NULL) {
  35                 return;
  36         }
  37
  38         syscall = container_of(rule, struct lttng_event_rule_syscall,
  39                         parent);
  40
  41         free(syscall->pattern);
  42         free(syscall->filter_expression);
  43         free(syscall->internal_filter.filter);
  44         free(syscall->internal_filter.bytecode);
  45         free(syscall);
  46 }
  47
  48 static
  49 bool lttng_event_rule_syscall_validate(
  50                 const struct lttng_event_rule *rule)
  51 {
  52         bool valid = false;
  53         struct lttng_event_rule_syscall *syscall;
  54
  55         if (!rule) {
  56                 goto end;
  57         }
  58
  59         syscall = container_of(rule, struct lttng_event_rule_syscall, parent);
  60
  61         /* Required field */
  62         if (!syscall->pattern) {
  63                 ERR("Invalid syscall event rule: a pattern must be set.");
  64                 goto end;
  65         }
  66
  67         valid = true;
  68 end:
  69         return valid;
  70 }
  71
  72 static
  73 int lttng_event_rule_syscall_serialize(
  74                 const struct lttng_event_rule *rule,
  75                 struct lttng_dynamic_buffer *buf,
  76                 int *fd_to_send)
  77 {
  78         int ret;
  79         size_t pattern_len, filter_expression_len;
  80         struct lttng_event_rule_syscall *syscall;
  81         struct lttng_event_rule_syscall_comm syscall_comm;
  82
  83         if (!rule || !IS_SYSCALL_EVENT_RULE(rule)) {
  84                 ret = -1;
  85                 goto end;
  86         }
  87
  88         DBG("Serializing syscall event rule");
  89         syscall = container_of(rule, struct lttng_event_rule_syscall, parent);
  90
  91         pattern_len = strlen(syscall->pattern) + 1;
  92
  93         if (syscall->filter_expression != NULL) {
  94                 filter_expression_len = strlen(syscall->filter_expression) + 1;
  95         } else {
  96                 filter_expression_len = 0;
  97         }
  98
  99         syscall_comm.pattern_len = pattern_len;
 100         syscall_comm.filter_expression_len = filter_expression_len;
 101
 102         ret = lttng_dynamic_buffer_append(
 103                         buf, &syscall_comm, sizeof(syscall_comm));
 104         if (ret) {
 105                 goto end;
 106         }
 107         ret = lttng_dynamic_buffer_append(buf, syscall->pattern, pattern_len);
 108         if (ret) {
 109                 goto end;
 110         }
 111         ret = lttng_dynamic_buffer_append(
 112                         buf, syscall->filter_expression, filter_expression_len);
 113         if (ret) {
 114                 goto end;
 115         }
 116
 117         if (fd_to_send) {
 118                 /* Nothing to send */
 119                 *fd_to_send = -1;
 120         }
 121 end:
 122         return ret;
 123 }
 124
 125 static
 126 bool lttng_event_rule_syscall_is_equal(const struct lttng_event_rule *_a,
 127                 const struct lttng_event_rule *_b)
 128 {
 129         bool is_equal = false;
 130         struct lttng_event_rule_syscall *a, *b;
 131
 132         a = container_of(_a, struct lttng_event_rule_syscall, parent);
 133         b = container_of(_b, struct lttng_event_rule_syscall, parent);
 134
 135         if (!!a->filter_expression != !!b->filter_expression) {
 136                 goto end;
 137         }
 138
 139         /* Long check */
 140         /* syscall is invalid if this is not true */
 141         assert(a->pattern);
 142         assert(b->pattern);
 143         if (strcmp(a->pattern, b->pattern)) {
 144                 goto end;
 145         }
 146
 147         if (a->filter_expression && b->filter_expression) {
 148                 if (strcmp(a->filter_expression, b->filter_expression)) {
 149                         goto end;
 150                 }
 151         }
 152
 153         is_equal = true;
 154 end:
 155         return is_equal;
 156 }
 157
 158 static
 159 enum lttng_error_code lttng_event_rule_syscall_populate(struct lttng_event_rule *rule, uid_t uid, gid_t gid)
 160 {
 161         int ret;
 162         enum lttng_error_code ret_code = LTTNG_OK;
 163         struct lttng_event_rule_syscall *syscall;
 164         enum lttng_event_rule_status status;
 165         const char *filter;
 166         struct lttng_filter_bytecode *bytecode = NULL;
 167
 168         assert(rule);
 169
 170         syscall = container_of(rule, struct lttng_event_rule_syscall,
 171                         parent);
 172
 173         /* Generate the filter bytecode */
 174         status = lttng_event_rule_syscall_get_filter(rule, &filter);
 175         if (status == LTTNG_EVENT_RULE_STATUS_UNSET) {
 176                 filter = NULL;
 177         } else if (status != LTTNG_EVENT_RULE_STATUS_OK) {
 178                 ret_code = LTTNG_ERR_FILTER_INVAL;
 179                 goto end;
 180         }
 181
 182         if (filter && filter[0] == '\0') {
 183                 ret_code = LTTNG_ERR_FILTER_INVAL;
 184                 goto error;
 185         }
 186
 187         if (filter == NULL) {
 188                 /* Nothing to do */
 189                 ret = LTTNG_OK;
 190                 goto end;
 191         }
 192
 193         syscall->internal_filter.filter = strdup(filter);
 194         if (syscall->internal_filter.filter == NULL) {
 195                 ret_code = LTTNG_ERR_NOMEM;
 196                 goto end;
 197         }
 198
 199         ret = run_as_generate_filter_bytecode(syscall->internal_filter.filter, uid, gid, &bytecode);
 200         if (ret) {
 201                 ret_code = LTTNG_ERR_FILTER_INVAL;
 202         }
 203
 204         syscall->internal_filter.bytecode = bytecode;
 205         bytecode = NULL;
 206
 207 error:
 208 end:
 209         free(bytecode);
 210         return ret_code;
 211 }
 212
 213 static const char *lttng_event_rule_syscall_get_internal_filter(
 214                 const struct lttng_event_rule *rule)
 215 {
 216         struct lttng_event_rule_syscall *syscall;
 217         assert(rule);
 218
 219         syscall = container_of(rule, struct lttng_event_rule_syscall, parent);
 220         return syscall->internal_filter.filter;
 221 }
 222
 223 static const struct lttng_filter_bytecode *
 224 lttng_event_rule_syscall_get_internal_filter_bytecode(
 225                 const struct lttng_event_rule *rule)
 226 {
 227         struct lttng_event_rule_syscall *syscall;
 228         assert(rule);
 229
 230         syscall = container_of(rule, struct lttng_event_rule_syscall, parent);
 231         return syscall->internal_filter.bytecode;
 232 }
 233
 234 static struct lttng_event_exclusion *
 235 lttng_event_rule_syscall_generate_exclusions(struct lttng_event_rule *rule)
 236 {
 237         /* Not supported */
 238         return NULL;
 239 }
 240
 241 struct lttng_event_rule *lttng_event_rule_syscall_create()
 242 {
 243         struct lttng_event_rule_syscall *rule;
 244
 245         rule = zmalloc(sizeof(struct lttng_event_rule_syscall));
 246         if (!rule) {
 247                 return NULL;
 248         }
 249
 250         lttng_event_rule_init(&rule->parent, LTTNG_EVENT_RULE_TYPE_SYSCALL);
 251         rule->parent.validate = lttng_event_rule_syscall_validate;
 252         rule->parent.serialize = lttng_event_rule_syscall_serialize;
 253         rule->parent.equal = lttng_event_rule_syscall_is_equal;
 254         rule->parent.destroy = lttng_event_rule_syscall_destroy;
 255         rule->parent.populate = lttng_event_rule_syscall_populate;
 256         rule->parent.get_filter = lttng_event_rule_syscall_get_internal_filter;
 257         rule->parent.get_filter_bytecode =
 258                         lttng_event_rule_syscall_get_internal_filter_bytecode;
 259         rule->parent.generate_exclusions =
 260                         lttng_event_rule_syscall_generate_exclusions;
 261         return &rule->parent;
 262 }
 263
 264 LTTNG_HIDDEN
 265 ssize_t lttng_event_rule_syscall_create_from_buffer(
 266                 const struct lttng_buffer_view *view,
 267                 struct lttng_event_rule **_event_rule)
 268 {
 269         ssize_t ret, offset = 0;
 270         enum lttng_event_rule_status status;
 271         const struct lttng_event_rule_syscall_comm *syscall_comm;
 272         const char *pattern;
 273         const char *filter_expression = NULL;
 274         struct lttng_buffer_view current_view;
 275         struct lttng_event_rule *rule = NULL;
 276
 277         if (!_event_rule) {
 278                 ret = -1;
 279                 goto end;
 280         }
 281
 282         if (view->size < sizeof(*syscall_comm)) {
 283                 ERR("Failed to initialize from malformed event rule syscall: buffer too short to contain header");
 284                 ret = -1;
 285                 goto end;
 286         }
 287
 288         current_view = lttng_buffer_view_from_view(
 289                         view, offset, sizeof(*syscall_comm));
 290         syscall_comm = (typeof(syscall_comm)) current_view.data;
 291
 292         if (!syscall_comm) {
 293                 ret = -1;
 294                 goto end;
 295         }
 296
 297         rule = lttng_event_rule_syscall_create();
 298         if (!rule) {
 299                 ERR("Failed to create event rule syscall");
 300                 ret = -1;
 301                 goto end;
 302         }
 303
 304         /* Skip to payload */
 305         offset += current_view.size;
 306
 307         /* Map the pattern */
 308         current_view = lttng_buffer_view_from_view(
 309                         view, offset, syscall_comm->pattern_len);
 310         pattern = current_view.data;
 311         if (!pattern) {
 312                 ret = -1;
 313                 goto end;
 314         }
 315
 316         if (syscall_comm->pattern_len == 1 ||
 317                         pattern[syscall_comm->pattern_len - 1] != '\0' ||
 318                         strlen(pattern) != syscall_comm->pattern_len - 1) {
 319                 /*
 320                  * Check that the pattern is not NULL, is NULL-terminated, and
 321                  * does not contain a NULL before the last byte.
 322                  */
 323                 ret = -1;
 324                 goto end;
 325         }
 326
 327         /* Skip after the pattern */
 328         offset += syscall_comm->pattern_len;
 329
 330         if (!syscall_comm->filter_expression_len) {
 331                 goto skip_filter_expression;
 332         }
 333
 334         /* Map the filter_expression */
 335         current_view = lttng_buffer_view_from_view(
 336                         view, offset, syscall_comm->filter_expression_len);
 337         filter_expression = current_view.data;
 338         if (!filter_expression) {
 339                 ret = -1;
 340                 goto end;
 341         }
 342
 343         if (syscall_comm->filter_expression_len == 1 ||
 344                         filter_expression[syscall_comm->filter_expression_len -
 345                                           1] != '\0' ||
 346                         strlen(filter_expression) !=
 347                                         syscall_comm->filter_expression_len -
 348                                                         1) {
 349                 /*
 350                  * Check that the filter expression is not NULL, is
 351                  * NULL-terminated, and does not contain a NULL before the last
 352                  * byte.
 353                  */
 354                 ret = -1;
 355                 goto end;
 356         }
 357
 358         /* Skip after the pattern */
 359         offset += syscall_comm->filter_expression_len;
 360
 361 skip_filter_expression:
 362
 363         status = lttng_event_rule_syscall_set_pattern(rule, pattern);
 364         if (status != LTTNG_EVENT_RULE_STATUS_OK) {
 365                 ERR("Failed to set event rule syscall pattern");
 366                 ret = -1;
 367                 goto end;
 368         }
 369
 370         if (filter_expression) {
 371                 status = lttng_event_rule_syscall_set_filter(
 372                                 rule, filter_expression);
 373                 if (status != LTTNG_EVENT_RULE_STATUS_OK) {
 374                         ERR("Failed to set event rule syscall pattern");
 375                         ret = -1;
 376                         goto end;
 377                 }
 378         }
 379
 380         *_event_rule = rule;
 381         rule = NULL;
 382         ret = offset;
 383 end:
 384         lttng_event_rule_destroy(rule);
 385         return ret;
 386 }
 387
 388 enum lttng_event_rule_status lttng_event_rule_syscall_set_pattern(
 389                 struct lttng_event_rule *rule, const char *pattern)
 390 {
 391         char *pattern_copy = NULL;
 392         struct lttng_event_rule_syscall *syscall;
 393         enum lttng_event_rule_status status = LTTNG_EVENT_RULE_STATUS_OK;
 394
 395         if (!rule || !IS_SYSCALL_EVENT_RULE(rule) || !pattern ||
 396                         strlen(pattern) == 0) {
 397                 status = LTTNG_EVENT_RULE_STATUS_INVALID;
 398                 goto end;
 399         }
 400
 401         syscall = container_of(rule, struct lttng_event_rule_syscall, parent);
 402         pattern_copy = strdup(pattern);
 403         if (!pattern_copy) {
 404                 status = LTTNG_EVENT_RULE_STATUS_ERROR;
 405                 goto end;
 406         }
 407
 408         if (syscall->pattern) {
 409                 free(syscall->pattern);
 410         }
 411
 412         syscall->pattern = pattern_copy;
 413         pattern_copy = NULL;
 414 end:
 415         return status;
 416 }
 417
 418 enum lttng_event_rule_status lttng_event_rule_syscall_get_pattern(
 419                 const struct lttng_event_rule *rule, const char **pattern)
 420 {
 421         struct lttng_event_rule_syscall *syscall;
 422         enum lttng_event_rule_status status = LTTNG_EVENT_RULE_STATUS_OK;
 423
 424         if (!rule || !IS_SYSCALL_EVENT_RULE(rule) || !pattern) {
 425                 status = LTTNG_EVENT_RULE_STATUS_INVALID;
 426                 goto end;
 427         }
 428
 429         syscall = container_of(rule, struct lttng_event_rule_syscall, parent);
 430         if (!syscall->pattern) {
 431                 status = LTTNG_EVENT_RULE_STATUS_UNSET;
 432                 goto end;
 433         }
 434
 435         *pattern = syscall->pattern;
 436 end:
 437         return status;
 438 }
 439
 440 enum lttng_event_rule_status lttng_event_rule_syscall_set_filter(
 441                 struct lttng_event_rule *rule, const char *expression)
 442 {
 443         char *expression_copy = NULL;
 444         struct lttng_event_rule_syscall *syscall;
 445         enum lttng_event_rule_status status = LTTNG_EVENT_RULE_STATUS_OK;
 446
 447         /* TODO: validate that the passed expression is valid */
 448
 449         if (!rule || !IS_SYSCALL_EVENT_RULE(rule) || !expression ||
 450                         strlen(expression) == 0) {
 451                 status = LTTNG_EVENT_RULE_STATUS_INVALID;
 452                 goto end;
 453         }
 454
 455         syscall = container_of(rule, struct lttng_event_rule_syscall, parent);
 456         expression_copy = strdup(expression);
 457         if (!expression_copy) {
 458                 status = LTTNG_EVENT_RULE_STATUS_ERROR;
 459                 goto end;
 460         }
 461
 462         if (syscall->filter_expression) {
 463                 free(syscall->filter_expression);
 464         }
 465
 466         syscall->filter_expression = expression_copy;
 467         expression_copy = NULL;
 468 end:
 469         return status;
 470 }
 471
 472 enum lttng_event_rule_status lttng_event_rule_syscall_get_filter(
 473                 const struct lttng_event_rule *rule, const char **expression)
 474 {
 475         struct lttng_event_rule_syscall *syscall;
 476         enum lttng_event_rule_status status = LTTNG_EVENT_RULE_STATUS_OK;
 477
 478         if (!rule || !IS_SYSCALL_EVENT_RULE(rule) || !expression) {
 479                 status = LTTNG_EVENT_RULE_STATUS_INVALID;
 480                 goto end;
 481         }
 482
 483         syscall = container_of(rule, struct lttng_event_rule_syscall, parent);
 484         if (!syscall->filter_expression) {
 485                 status = LTTNG_EVENT_RULE_STATUS_UNSET;
 486                 goto end;
 487         }
 488
 489         *expression = syscall->filter_expression;
 490 end:
 491         return status;
 492 }