1 | /* |
2 | * Copyright (c) 2006-2017 Apple Inc. All rights reserved. |
3 | * |
4 | * @APPLE_OSREFERENCE_LICENSE_HEADER_START@ |
5 | * |
6 | * This file contains Original Code and/or Modifications of Original Code |
7 | * as defined in and that are subject to the Apple Public Source License |
8 | * Version 2.0 (the 'License'). You may not use this file except in |
9 | * compliance with the License. The rights granted to you under the License |
10 | * may not be used to create, or enable the creation or redistribution of, |
11 | * unlawful or unlicensed copies of an Apple operating system, or to |
12 | * circumvent, violate, or enable the circumvention or violation of, any |
13 | * terms of an Apple operating system software license agreement. |
14 | * |
15 | * Please obtain a copy of the License at |
16 | * http://www.opensource.apple.com/apsl/ and read it before using this file. |
17 | * |
18 | * The Original Code and all software distributed under the License are |
19 | * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER |
20 | * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES, |
21 | * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY, |
22 | * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT. |
23 | * Please see the License for the specific language governing rights and |
24 | * limitations under the License. |
25 | * |
26 | * @APPLE_OSREFERENCE_LICENSE_HEADER_END@ |
27 | */ |
28 | |
29 | #include <sys/errno.h> |
30 | #include <sys/types.h> |
31 | #include <kern/kalloc.h> |
32 | #include <sys/buf.h> |
33 | #include <sys/time.h> |
34 | #include <sys/kauth.h> |
35 | #include <sys/mount.h> |
36 | #include <sys/vnode.h> |
37 | #include <sys/syslog.h> |
38 | #include <sys/vnode_internal.h> |
39 | #include <sys/fslog.h> |
40 | #include <sys/mount_internal.h> |
41 | #if 0 /* see rdar://81514225 */ |
42 | #include <sys/kasl.h> |
43 | #endif |
44 | |
45 | #include <kern/zalloc.h> |
46 | |
47 | #include <uuid/uuid.h> |
48 | |
49 | #include <stdarg.h> |
50 | |
51 | /* Log information about external modification of a process, |
52 | * using MessageTracer formatting. Assumes that both the caller |
53 | * and target are appropriately locked. |
54 | * Currently prints following information - |
55 | * 1. Caller process name (truncated to 16 characters) |
56 | * 2. Caller process Mach-O UUID |
57 | * 3. Target process name (truncated to 16 characters) |
58 | * 4. Target process Mach-O UUID |
59 | */ |
60 | void |
61 | fslog_extmod_msgtracer(__unused proc_t caller, __unused proc_t target) |
62 | { |
63 | #if 0 /* see rdar://81514225 */ |
64 | if ((caller != PROC_NULL) && (target != PROC_NULL)) { |
65 | /* |
66 | * Print into buffer large enough for "ThisIsAnApplicat(BC223DD7-B314-42E0-B6B0-C5D2E6638337)", |
67 | * including space for escaping, and NUL byte included in sizeof(uuid_string_t). |
68 | */ |
69 | |
70 | uuid_string_t uuidstr; |
71 | char c_name[2 * MAXCOMLEN + 2 /* () */ + sizeof(uuid_string_t)]; |
72 | char t_name[2 * MAXCOMLEN + 2 /* () */ + sizeof(uuid_string_t)]; |
73 | |
74 | strlcpy(c_name, caller->p_comm, sizeof(c_name)); |
75 | uuid_unparse_upper(proc_executableuuid_addr(caller), uuidstr); |
76 | strlcat(c_name, "(" , sizeof(c_name)); |
77 | strlcat(c_name, uuidstr, sizeof(c_name)); |
78 | strlcat(c_name, ")" , sizeof(c_name)); |
79 | if (0 != escape_str(c_name, strlen(c_name) + 1, sizeof(c_name))) { |
80 | return; |
81 | } |
82 | |
83 | strlcpy(t_name, target->p_comm, sizeof(t_name)); |
84 | uuid_unparse_upper(proc_executableuuid_addr(target), uuidstr); |
85 | strlcat(t_name, "(" , sizeof(t_name)); |
86 | strlcat(t_name, uuidstr, sizeof(t_name)); |
87 | strlcat(t_name, ")" , sizeof(t_name)); |
88 | if (0 != escape_str(t_name, strlen(t_name) + 1, sizeof(t_name))) { |
89 | return; |
90 | } |
91 | #if DEBUG |
92 | printf("EXTMOD: %s(%d) -> %s(%d)\n" , |
93 | c_name, |
94 | proc_pid(caller), |
95 | t_name, |
96 | proc_pid(target)); |
97 | #endif |
98 | |
99 | kern_asl_msg(LOG_DEBUG, "messagetracer" , |
100 | 5, |
101 | "com.apple.message.domain" , "com.apple.kernel.external_modification" , /* 0 */ |
102 | "com.apple.message.signature" , c_name, /* 1 */ |
103 | "com.apple.message.signature2" , t_name, /* 2 */ |
104 | "com.apple.message.result" , "noop" , /* 3 */ |
105 | "com.apple.message.summarize" , "YES" , /* 4 */ |
106 | NULL); |
107 | } |
108 | #endif |
109 | } |
110 | |