1 | /* |
2 | * Copyright (c) 2000-2010 Apple Inc. All rights reserved. |
3 | * |
4 | * @APPLE_OSREFERENCE_LICENSE_HEADER_START@ |
5 | * |
6 | * This file contains Original Code and/or Modifications of Original Code |
7 | * as defined in and that are subject to the Apple Public Source License |
8 | * Version 2.0 (the 'License'). You may not use this file except in |
9 | * compliance with the License. The rights granted to you under the License |
10 | * may not be used to create, or enable the creation or redistribution of, |
11 | * unlawful or unlicensed copies of an Apple operating system, or to |
12 | * circumvent, violate, or enable the circumvention or violation of, any |
13 | * terms of an Apple operating system software license agreement. |
14 | * |
15 | * Please obtain a copy of the License at |
16 | * http://www.opensource.apple.com/apsl/ and read it before using this file. |
17 | * |
18 | * The Original Code and all software distributed under the License are |
19 | * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER |
20 | * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES, |
21 | * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY, |
22 | * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT. |
23 | * Please see the License for the specific language governing rights and |
24 | * limitations under the License. |
25 | * |
26 | * @APPLE_OSREFERENCE_LICENSE_HEADER_END@ |
27 | */ |
28 | /* Copyright (c) 1995 NeXT Computer, Inc. All Rights Reserved */ |
29 | /*- |
30 | * Copyright (c) 1982, 1986, 1989, 1993 |
31 | * The Regents of the University of California. All rights reserved. |
32 | * (c) UNIX System Laboratories, Inc. |
33 | * All or some portions of this file are derived from material licensed |
34 | * to the University of California by American Telephone and Telegraph |
35 | * Co. or Unix System Laboratories, Inc. and are reproduced herein with |
36 | * the permission of UNIX System Laboratories, Inc. |
37 | * |
38 | * Redistribution and use in source and binary forms, with or without |
39 | * modification, are permitted provided that the following conditions |
40 | * are met: |
41 | * 1. Redistributions of source code must retain the above copyright |
42 | * notice, this list of conditions and the following disclaimer. |
43 | * 2. Redistributions in binary form must reproduce the above copyright |
44 | * notice, this list of conditions and the following disclaimer in the |
45 | * documentation and/or other materials provided with the distribution. |
46 | * 3. All advertising materials mentioning features or use of this software |
47 | * must display the following acknowledgement: |
48 | * This product includes software developed by the University of |
49 | * California, Berkeley and its contributors. |
50 | * 4. Neither the name of the University nor the names of its contributors |
51 | * may be used to endorse or promote products derived from this software |
52 | * without specific prior written permission. |
53 | * |
54 | * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND |
55 | * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE |
56 | * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE |
57 | * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE |
58 | * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL |
59 | * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS |
60 | * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) |
61 | * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT |
62 | * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY |
63 | * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF |
64 | * SUCH DAMAGE. |
65 | * |
66 | * @(#)kern_acct.c 8.1 (Berkeley) 6/14/93 |
67 | */ |
68 | /* HISTORY |
69 | * 08-May-95 Mac Gillon (mgillon) at NeXT |
70 | * Purged old history |
71 | * New version based on 4.4 |
72 | */ |
73 | /* |
74 | * NOTICE: This file was modified by SPARTA, Inc. in 2005 to introduce |
75 | * support for mandatory and extensible security protections. This notice |
76 | * is included in support of clause 2.2 (b) of the Apple Public License, |
77 | * Version 2.0. |
78 | */ |
79 | |
80 | |
81 | #include <sys/param.h> |
82 | #include <sys/proc_internal.h> |
83 | #include <sys/kauth.h> |
84 | #include <sys/mount_internal.h> |
85 | #include <sys/vnode_internal.h> |
86 | #include <sys/file_internal.h> |
87 | #include <sys/syslog.h> |
88 | #include <sys/kernel.h> |
89 | #include <sys/namei.h> |
90 | #include <sys/errno.h> |
91 | #include <sys/acct.h> |
92 | #include <sys/resourcevar.h> |
93 | #include <sys/ioctl.h> |
94 | #include <sys/tty.h> |
95 | #include <sys/sysproto.h> |
96 | #if CONFIG_MACF |
97 | #include <security/mac_framework.h> |
98 | #endif |
99 | |
100 | /* |
101 | * The routines implemented in this file are described in: |
102 | * Leffler, et al.: The Design and Implementation of the 4.3BSD |
103 | * UNIX Operating System (Addison Welley, 1989) |
104 | * on pages 62-63. |
105 | * |
106 | * Arguably, to simplify accounting operations, this mechanism should |
107 | * be replaced by one in which an accounting log file (similar to /dev/klog) |
108 | * is read by a user process, etc. However, that has its own problems. |
109 | */ |
110 | |
111 | /* |
112 | * Internal accounting functions. |
113 | * The former's operation is described in Leffler, et al., and the latter |
114 | * was provided by UCB with the 4.4BSD-Lite release |
115 | */ |
116 | comp_t encode_comp_t(uint32_t, uint32_t); |
117 | void acctwatch(void *); |
118 | void acct_init(void); |
119 | |
120 | /* |
121 | * Accounting vnode pointer, and suspended accounting vnode pointer. States |
122 | * are as follows: |
123 | * |
124 | * acctp suspend_acctp state |
125 | * ------------- ------------ ------------------------------ |
126 | * NULL NULL Accounting disabled |
127 | * !NULL NULL Accounting enabled |
128 | * NULL !NULL Accounting enabled, but suspended |
129 | * !NULL !NULL <not allowed> |
130 | */ |
131 | struct vnode *acctp; |
132 | struct vnode *suspend_acctp; |
133 | |
134 | /* |
135 | * Values associated with enabling and disabling accounting |
136 | */ |
137 | int acctsuspend = 2; /* stop accounting when < 2% free space left */ |
138 | int acctresume = 4; /* resume when free space risen to > 4% */ |
139 | int acctchkfreq = 15; /* frequency (in seconds) to check space */ |
140 | |
141 | |
142 | static lck_grp_t *acct_subsys_lck_grp; |
143 | static lck_mtx_t *acct_subsys_mutex; |
144 | |
145 | #define ACCT_SUBSYS_LOCK() lck_mtx_lock(acct_subsys_mutex) |
146 | #define ACCT_SUBSYS_UNLOCK() lck_mtx_unlock(acct_subsys_mutex) |
147 | |
148 | void |
149 | acct_init(void) |
150 | { |
151 | acct_subsys_lck_grp = lck_grp_alloc_init("acct" , NULL); |
152 | acct_subsys_mutex = lck_mtx_alloc_init(acct_subsys_lck_grp, NULL); |
153 | } |
154 | |
155 | |
156 | /* |
157 | * Accounting system call. Written based on the specification and |
158 | * previous implementation done by Mark Tinguely. |
159 | */ |
160 | int |
161 | acct(proc_t p, struct acct_args *uap, __unused int *retval) |
162 | { |
163 | struct nameidata nd; |
164 | int error; |
165 | struct vfs_context *ctx; |
166 | |
167 | ctx = vfs_context_current(); |
168 | |
169 | /* Make sure that the caller is root. */ |
170 | if ((error = suser(vfs_context_ucred(ctx), &p->p_acflag))) |
171 | return (error); |
172 | |
173 | /* |
174 | * If accounting is to be started to a file, open that file for |
175 | * writing and make sure it's a 'normal'. |
176 | */ |
177 | if (uap->path != USER_ADDR_NULL) { |
178 | NDINIT(&nd, LOOKUP, OP_OPEN, NOFOLLOW, UIO_USERSPACE, uap->path, ctx); |
179 | if ((error = vn_open(&nd, FWRITE, 0))) |
180 | return (error); |
181 | #if CONFIG_MACF |
182 | error = mac_system_check_acct(vfs_context_ucred(ctx), nd.ni_vp); |
183 | if (error) { |
184 | vnode_put(nd.ni_vp); |
185 | vn_close(nd.ni_vp, FWRITE, ctx); |
186 | return (error); |
187 | } |
188 | #endif |
189 | vnode_put(nd.ni_vp); |
190 | |
191 | if (nd.ni_vp->v_type != VREG) { |
192 | vn_close(nd.ni_vp, FWRITE, ctx); |
193 | return (EACCES); |
194 | } |
195 | } |
196 | #if CONFIG_MACF |
197 | else { |
198 | error = mac_system_check_acct(vfs_context_ucred(ctx), NULL); |
199 | if (error) |
200 | return (error); |
201 | } |
202 | #endif |
203 | |
204 | /* |
205 | * If accounting was previously enabled, kill the old space-watcher, |
206 | * close the file, and (if no new file was specified, leave). |
207 | */ |
208 | ACCT_SUBSYS_LOCK(); |
209 | if (acctp != NULLVP || suspend_acctp != NULLVP) { |
210 | untimeout(acctwatch, NULL); |
211 | error = vn_close((acctp != NULLVP ? acctp : suspend_acctp), |
212 | FWRITE, vfs_context_current()); |
213 | |
214 | acctp = suspend_acctp = NULLVP; |
215 | } |
216 | if (uap->path == USER_ADDR_NULL) { |
217 | ACCT_SUBSYS_UNLOCK(); |
218 | return (error); |
219 | } |
220 | |
221 | /* |
222 | * Save the new accounting file vnode, and schedule the new |
223 | * free space watcher. |
224 | */ |
225 | acctp = nd.ni_vp; |
226 | ACCT_SUBSYS_UNLOCK(); |
227 | |
228 | acctwatch(NULL); |
229 | return (error); |
230 | } |
231 | |
232 | /* |
233 | * Write out process accounting information, on process exit. |
234 | * Data to be written out is specified in Leffler, et al. |
235 | * and are enumerated below. (They're also noted in the system |
236 | * "acct.h" header file.) |
237 | */ |
238 | int |
239 | acct_process(proc_t p) |
240 | { |
241 | struct acct an_acct; |
242 | struct rusage rup, *r; |
243 | struct timeval ut, st, tmp; |
244 | int t; |
245 | int error; |
246 | struct vnode *vp; |
247 | kauth_cred_t safecred; |
248 | struct session * sessp; |
249 | struct tty *tp; |
250 | |
251 | /* If accounting isn't enabled, don't bother */ |
252 | ACCT_SUBSYS_LOCK(); |
253 | vp = acctp; |
254 | if (vp == NULLVP) { |
255 | ACCT_SUBSYS_UNLOCK(); |
256 | return (0); |
257 | } |
258 | |
259 | /* |
260 | * Get process accounting information. |
261 | */ |
262 | |
263 | /* (1) The name of the command that ran */ |
264 | bcopy(p->p_comm, an_acct.ac_comm, sizeof an_acct.ac_comm); |
265 | |
266 | /* (2) The amount of user and system time that was used */ |
267 | calcru(p, &ut, &st, NULL); |
268 | an_acct.ac_utime = encode_comp_t(ut.tv_sec, ut.tv_usec); |
269 | an_acct.ac_stime = encode_comp_t(st.tv_sec, st.tv_usec); |
270 | |
271 | /* (3) The elapsed time the commmand ran (and its starting time) */ |
272 | an_acct.ac_btime = p->p_start.tv_sec; |
273 | microtime(&tmp); |
274 | timevalsub(&tmp, &p->p_start); |
275 | an_acct.ac_etime = encode_comp_t(tmp.tv_sec, tmp.tv_usec); |
276 | |
277 | /* (4) The average amount of memory used */ |
278 | proc_lock(p); |
279 | rup = p->p_stats->p_ru; |
280 | proc_unlock(p); |
281 | r = &rup; |
282 | tmp = ut; |
283 | timevaladd(&tmp, &st); |
284 | t = tmp.tv_sec * hz + tmp.tv_usec / tick; |
285 | if (t) |
286 | an_acct.ac_mem = (r->ru_ixrss + r->ru_idrss + r->ru_isrss) / t; |
287 | else |
288 | an_acct.ac_mem = 0; |
289 | |
290 | /* (5) The number of disk I/O operations done */ |
291 | an_acct.ac_io = encode_comp_t(r->ru_inblock + r->ru_oublock, 0); |
292 | |
293 | /* (6) The UID and GID of the process */ |
294 | safecred = kauth_cred_proc_ref(p); |
295 | |
296 | an_acct.ac_uid = kauth_cred_getruid(safecred); |
297 | an_acct.ac_gid = kauth_cred_getrgid(safecred); |
298 | |
299 | /* (7) The terminal from which the process was started */ |
300 | |
301 | sessp = proc_session(p); |
302 | if ((p->p_flag & P_CONTROLT) && (sessp != SESSION_NULL) && ((tp = SESSION_TP(sessp)) != TTY_NULL)) { |
303 | tty_lock(tp); |
304 | an_acct.ac_tty = tp->t_dev; |
305 | tty_unlock(tp); |
306 | }else |
307 | an_acct.ac_tty = NODEV; |
308 | |
309 | if (sessp != SESSION_NULL) |
310 | session_rele(sessp); |
311 | |
312 | /* (8) The boolean flags that tell how the process terminated, etc. */ |
313 | an_acct.ac_flag = p->p_acflag; |
314 | |
315 | /* |
316 | * Now, just write the accounting information to the file. |
317 | */ |
318 | if ((error = vnode_getwithref(vp)) == 0) { |
319 | error = vn_rdwr(UIO_WRITE, vp, (caddr_t)&an_acct, sizeof (an_acct), |
320 | (off_t)0, UIO_SYSSPACE, IO_APPEND|IO_UNIT, safecred, |
321 | (int *)0, p); |
322 | vnode_put(vp); |
323 | } |
324 | |
325 | kauth_cred_unref(&safecred); |
326 | ACCT_SUBSYS_UNLOCK(); |
327 | |
328 | return (error); |
329 | } |
330 | |
331 | /* |
332 | * Encode_comp_t converts from ticks in seconds and microseconds |
333 | * to ticks in 1/AHZ seconds. The encoding is described in |
334 | * Leffler, et al., on page 63. |
335 | */ |
336 | |
337 | #define MANTSIZE 13 /* 13 bit mantissa. */ |
338 | #define EXPSIZE 3 /* Base 8 (3 bit) exponent. */ |
339 | #define MAXFRACT ((1 << MANTSIZE) - 1) /* Maximum fractional value. */ |
340 | |
341 | comp_t |
342 | encode_comp_t(uint32_t s, uint32_t us) |
343 | { |
344 | int exp, rnd; |
345 | |
346 | exp = 0; |
347 | rnd = 0; |
348 | s *= AHZ; |
349 | s += us / (1000000 / AHZ); /* Maximize precision. */ |
350 | |
351 | while (s > MAXFRACT) { |
352 | rnd = s & (1 << (EXPSIZE - 1)); /* Round up? */ |
353 | s >>= EXPSIZE; /* Base 8 exponent == 3 bit shift. */ |
354 | exp++; |
355 | } |
356 | |
357 | /* If we need to round up, do it (and handle overflow correctly). */ |
358 | if (rnd && (++s > MAXFRACT)) { |
359 | s >>= EXPSIZE; |
360 | exp++; |
361 | } |
362 | |
363 | /* Clean it up and polish it off. */ |
364 | exp <<= MANTSIZE; /* Shift the exponent into place */ |
365 | exp += s; /* and add on the mantissa. */ |
366 | return (exp); |
367 | } |
368 | |
369 | /* |
370 | * Periodically check the file system to see if accounting |
371 | * should be turned on or off. Beware the case where the vnode |
372 | * has been vgone()'d out from underneath us, e.g. when the file |
373 | * system containing the accounting file has been forcibly unmounted. |
374 | */ |
375 | /* ARGSUSED */ |
376 | void |
377 | acctwatch(__unused void *a) |
378 | { |
379 | vfs_context_t ctx = vfs_context_current(); |
380 | struct vfs_attr va; |
381 | |
382 | VFSATTR_INIT(&va); |
383 | VFSATTR_WANTED(&va, f_blocks); |
384 | VFSATTR_WANTED(&va, f_bavail); |
385 | |
386 | ACCT_SUBSYS_LOCK(); |
387 | if (suspend_acctp != NULLVP) { |
388 | /* |
389 | * Resuming accounting when accounting is suspended, and the |
390 | * filesystem containing the suspended accounting file goes |
391 | * below a low watermark |
392 | */ |
393 | if (suspend_acctp->v_type == VBAD) { |
394 | (void) vn_close(suspend_acctp, FWRITE, vfs_context_kernel()); |
395 | suspend_acctp = NULLVP; |
396 | ACCT_SUBSYS_UNLOCK(); |
397 | return; |
398 | } |
399 | (void)vfs_getattr(suspend_acctp->v_mount, &va, ctx); |
400 | if (va.f_bavail > acctresume * va.f_blocks / 100) { |
401 | acctp = suspend_acctp; |
402 | suspend_acctp = NULLVP; |
403 | log(LOG_NOTICE, "Accounting resumed\n" ); |
404 | } |
405 | } else if (acctp != NULLVP) { |
406 | /* |
407 | * Suspending accounting when accounting is currently active, |
408 | * and the filesystem containing the active accounting file |
409 | * goes over a high watermark |
410 | */ |
411 | if (acctp->v_type == VBAD) { |
412 | (void) vn_close(acctp, FWRITE, vfs_context_kernel()); |
413 | acctp = NULLVP; |
414 | ACCT_SUBSYS_UNLOCK(); |
415 | return; |
416 | } |
417 | (void)vfs_getattr(acctp->v_mount, &va, ctx); |
418 | if (va.f_bavail <= acctsuspend * va.f_blocks / 100) { |
419 | suspend_acctp = acctp; |
420 | acctp = NULLVP; |
421 | log(LOG_NOTICE, "Accounting suspended\n" ); |
422 | } |
423 | } else { |
424 | ACCT_SUBSYS_UNLOCK(); |
425 | return; |
426 | } |
427 | ACCT_SUBSYS_UNLOCK(); |
428 | |
429 | timeout(acctwatch, NULL, acctchkfreq * hz); |
430 | } |
431 | |