1 | /* |
2 | * Copyright (c) 2006-2017 Apple Inc. All rights reserved. |
3 | * |
4 | * @APPLE_OSREFERENCE_LICENSE_HEADER_START@ |
5 | * |
6 | * This file contains Original Code and/or Modifications of Original Code |
7 | * as defined in and that are subject to the Apple Public Source License |
8 | * Version 2.0 (the 'License'). You may not use this file except in |
9 | * compliance with the License. The rights granted to you under the License |
10 | * may not be used to create, or enable the creation or redistribution of, |
11 | * unlawful or unlicensed copies of an Apple operating system, or to |
12 | * circumvent, violate, or enable the circumvention or violation of, any |
13 | * terms of an Apple operating system software license agreement. |
14 | * |
15 | * Please obtain a copy of the License at |
16 | * http://www.opensource.apple.com/apsl/ and read it before using this file. |
17 | * |
18 | * The Original Code and all software distributed under the License are |
19 | * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER |
20 | * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES, |
21 | * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY, |
22 | * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT. |
23 | * Please see the License for the specific language governing rights and |
24 | * limitations under the License. |
25 | * |
26 | * @APPLE_OSREFERENCE_LICENSE_HEADER_END@ |
27 | */ |
28 | |
29 | #include <sys/errno.h> |
30 | #include <sys/types.h> |
31 | #include <sys/malloc.h> |
32 | #include <sys/buf.h> |
33 | #include <sys/time.h> |
34 | #include <sys/kauth.h> |
35 | #include <sys/mount.h> |
36 | #include <sys/vnode.h> |
37 | #include <sys/syslog.h> |
38 | #include <sys/vnode_internal.h> |
39 | #include <sys/fslog.h> |
40 | #include <sys/mount_internal.h> |
41 | #include <sys/kasl.h> |
42 | |
43 | #include <sys/queue.h> |
44 | #include <kern/kalloc.h> |
45 | |
46 | #include <uuid/uuid.h> |
47 | |
48 | #include <stdarg.h> |
49 | |
50 | /* Log information about external modification of a process, |
51 | * using MessageTracer formatting. Assumes that both the caller |
52 | * and target are appropriately locked. |
53 | * Currently prints following information - |
54 | * 1. Caller process name (truncated to 16 characters) |
55 | * 2. Caller process Mach-O UUID |
56 | * 3. Target process name (truncated to 16 characters) |
57 | * 4. Target process Mach-O UUID |
58 | */ |
59 | void |
60 | fslog_extmod_msgtracer(proc_t caller, proc_t target) |
61 | { |
62 | if ((caller != PROC_NULL) && (target != PROC_NULL)) { |
63 | |
64 | /* |
65 | * Print into buffer large enough for "ThisIsAnApplicat(BC223DD7-B314-42E0-B6B0-C5D2E6638337)", |
66 | * including space for escaping, and NUL byte included in sizeof(uuid_string_t). |
67 | */ |
68 | |
69 | uuid_string_t uuidstr; |
70 | char c_name[2*MAXCOMLEN + 2 /* () */ + sizeof(uuid_string_t)]; |
71 | char t_name[2*MAXCOMLEN + 2 /* () */ + sizeof(uuid_string_t)]; |
72 | |
73 | strlcpy(c_name, caller->p_comm, sizeof(c_name)); |
74 | uuid_unparse_upper(caller->p_uuid, uuidstr); |
75 | strlcat(c_name, "(" , sizeof(c_name)); |
76 | strlcat(c_name, uuidstr, sizeof(c_name)); |
77 | strlcat(c_name, ")" , sizeof(c_name)); |
78 | if (0 != escape_str(c_name, strlen(c_name) + 1, sizeof(c_name))) { |
79 | return; |
80 | } |
81 | |
82 | strlcpy(t_name, target->p_comm, sizeof(t_name)); |
83 | uuid_unparse_upper(target->p_uuid, uuidstr); |
84 | strlcat(t_name, "(" , sizeof(t_name)); |
85 | strlcat(t_name, uuidstr, sizeof(t_name)); |
86 | strlcat(t_name, ")" , sizeof(t_name)); |
87 | if (0 != escape_str(t_name, strlen(t_name) + 1, sizeof(t_name))) { |
88 | return; |
89 | } |
90 | #if DEBUG |
91 | printf("EXTMOD: %s(%d) -> %s(%d)\n" , |
92 | c_name, |
93 | proc_pid(caller), |
94 | t_name, |
95 | proc_pid(target)); |
96 | #endif |
97 | |
98 | kern_asl_msg(LOG_DEBUG, "messagetracer" , |
99 | 5, |
100 | "com.apple.message.domain" , "com.apple.kernel.external_modification" , /* 0 */ |
101 | "com.apple.message.signature" , c_name, /* 1 */ |
102 | "com.apple.message.signature2" , t_name, /* 2 */ |
103 | "com.apple.message.result" , "noop" , /* 3 */ |
104 | "com.apple.message.summarize" , "YES" , /* 4 */ |
105 | NULL); |
106 | } |
107 | } |
108 | |
109 | #if defined(__x86_64__) |
110 | |
111 | /* |
112 | * Log information about floating point exception handling |
113 | */ |
114 | |
115 | static lck_mtx_t fpxlock; |
116 | |
117 | void |
118 | fpxlog_init(void) |
119 | { |
120 | lck_grp_attr_t *lck_grp_attr = lck_grp_attr_alloc_init(); |
121 | lck_grp_t *lck_grp = lck_grp_alloc_init("fpx" , lck_grp_attr); |
122 | lck_mtx_init(&fpxlock, lck_grp, LCK_ATTR_NULL); |
123 | } |
124 | |
125 | struct fpx_event { |
126 | uuid_t fe_uuid; |
127 | uint32_t fe_code; |
128 | uint32_t fe_xcpt; |
129 | TAILQ_ENTRY(fpx_event) fe_link; |
130 | }; |
131 | |
132 | static bool |
133 | match_fpx_event(const struct fpx_event *fe, |
134 | const uuid_t uuid, const uint32_t code, const uint32_t xcpt) |
135 | { |
136 | return (code == fe->fe_code && xcpt == fe->fe_xcpt && |
137 | 0 == memcmp(uuid, fe->fe_uuid, sizeof (uuid_t))); |
138 | } |
139 | |
140 | #if FPX_EVENT_DBG |
141 | static __attribute__((noinline)) void |
142 | print_fpx_event(const char *pfx, const struct fpx_event *fe) |
143 | { |
144 | uuid_string_t uustr; |
145 | uuid_unparse_upper(fe->fe_uuid, uustr); |
146 | printf("%s: code 0x%x xcpt 0x%x uuid '%s'\n" , |
147 | pfx, fe->fe_code, fe->fe_xcpt, uustr); |
148 | } |
149 | #define DPRINTF_FPX_EVENT(pfx, fe) print_fpx_event(pfx, fe) |
150 | #else |
151 | #define DPRINTF_FPX_EVENT(pfx, fe) /* nothing */ |
152 | #endif |
153 | |
154 | #define MAX_DISTINCT_FPX_EVENTS 101 /* (approx one page of heap) */ |
155 | |
156 | /* |
157 | * Filter to detect "new" <uuid, code, xcpt> tuples. |
158 | * Uses limited amount of state, managed LRU. |
159 | * Optimized to ignore repeated invocation with the same tuple. |
160 | * |
161 | * Note that there are 6 exception types, two types of FP, and |
162 | * many binaries, so don't make the list bound too small. |
163 | * It's also a linear search, so don't make it too large either. |
164 | * Next level filtering provided by syslogd, and summarization. |
165 | */ |
166 | static bool |
167 | novel_fpx_event(const uuid_t uuid, uint32_t code, uint32_t xcpt) |
168 | { |
169 | static TAILQ_HEAD(fpx_event_head, fpx_event) fehead = |
170 | TAILQ_HEAD_INITIALIZER(fehead); |
171 | struct fpx_event *fe; |
172 | |
173 | lck_mtx_lock(&fpxlock); |
174 | |
175 | fe = TAILQ_FIRST(&fehead); |
176 | if (NULL != fe && |
177 | match_fpx_event(fe, uuid, code, xcpt)) { |
178 | /* seen before and element already at head */ |
179 | lck_mtx_unlock(&fpxlock); |
180 | DPRINTF_FPX_EVENT("seen, head" , fe); |
181 | return (false); |
182 | } |
183 | |
184 | unsigned int count = 0; |
185 | |
186 | TAILQ_FOREACH(fe, &fehead, fe_link) { |
187 | if (match_fpx_event(fe, uuid, code, xcpt)) { |
188 | /* seen before, now move element to head */ |
189 | TAILQ_REMOVE(&fehead, fe, fe_link); |
190 | TAILQ_INSERT_HEAD(&fehead, fe, fe_link); |
191 | lck_mtx_unlock(&fpxlock); |
192 | DPRINTF_FPX_EVENT("seen, moved to head" , fe); |
193 | return (false); |
194 | } |
195 | count++; |
196 | } |
197 | |
198 | /* not recorded here => novel */ |
199 | |
200 | if (count >= MAX_DISTINCT_FPX_EVENTS) { |
201 | /* reuse LRU element */ |
202 | fe = TAILQ_LAST(&fehead, fpx_event_head); |
203 | TAILQ_REMOVE(&fehead, fe, fe_link); |
204 | DPRINTF_FPX_EVENT("reusing" , fe); |
205 | } else { |
206 | /* add a new element to the list */ |
207 | fe = kalloc(sizeof (*fe)); |
208 | } |
209 | memcpy(fe->fe_uuid, uuid, sizeof (uuid_t)); |
210 | fe->fe_code = code; |
211 | fe->fe_xcpt = xcpt; |
212 | TAILQ_INSERT_HEAD(&fehead, fe, fe_link); |
213 | lck_mtx_unlock(&fpxlock); |
214 | |
215 | DPRINTF_FPX_EVENT("novel" , fe); |
216 | |
217 | return (true); |
218 | } |
219 | |
220 | void |
221 | fpxlog( |
222 | int code, /* Mach exception code: e.g. 5 or 8 */ |
223 | uint32_t stat, /* Full FP status register bits */ |
224 | uint32_t ctrl, /* Full FP control register bits */ |
225 | uint32_t xcpt) /* Exception bits from FP status */ |
226 | { |
227 | proc_t p = current_proc(); |
228 | if (PROC_NULL == p) |
229 | return; |
230 | |
231 | uuid_t uuid; |
232 | proc_getexecutableuuid(p, uuid, sizeof (uuid)); |
233 | |
234 | /* |
235 | * Check to see if an exception with this <uuid, code, xcpt> |
236 | * has been seen before. If "novel" then log a message. |
237 | */ |
238 | if (!novel_fpx_event(uuid, code, xcpt)) |
239 | return; |
240 | |
241 | const size_t nmlen = 2 * MAXCOMLEN + 1; |
242 | char nm[nmlen] = {}; |
243 | proc_selfname(nm, nmlen); |
244 | if (escape_str(nm, strlen(nm) + 1, nmlen)) |
245 | snprintf(nm, nmlen, "(a.out)" ); |
246 | |
247 | const size_t slen = 8 + 1 + 8 + 1; |
248 | char xcptstr[slen], csrstr[slen]; |
249 | |
250 | snprintf(xcptstr, slen, "%x.%x" , code, xcpt); |
251 | if (ctrl == stat) |
252 | snprintf(csrstr, slen, "%x" , ctrl); |
253 | else |
254 | snprintf(csrstr, slen, "%x.%x" , ctrl, stat); |
255 | |
256 | #if DEVELOPMENT || DEBUG |
257 | printf("%s[%d]: com.apple.kernel.fpx: %s, %s\n" , |
258 | nm, proc_pid(p), xcptstr, csrstr); |
259 | #endif |
260 | kern_asl_msg(LOG_DEBUG, "messagetracer" , 5, |
261 | /* 0 */ "com.apple.message.domain" , "com.apple.kernel.fpx" , |
262 | /* 1 */ "com.apple.message.signature" , nm, |
263 | /* 2 */ "com.apple.message.signature2" , xcptstr, |
264 | /* 3 */ "com.apple.message.value" , csrstr, |
265 | /* 4 */ "com.apple.message.summarize" , "YES" , |
266 | NULL); |
267 | } |
268 | |
269 | #else |
270 | |
271 | void |
272 | fpxlog_init(void) |
273 | {} |
274 | |
275 | #endif /* __x86_64__ */ |
276 | |