src/common/event-rule/kernel-syscall.c

   1 /*
   2  * Copyright (C) 2019 Jonathan Rajotte <jonathan.rajotte-julien@efficios.com>
   3  *
   4  * SPDX-License-Identifier: LGPL-2.1-only
   5  *
   6  */
   7
   8 #include <assert.h>
   9 #include <common/credentials.h>
  10 #include <common/error.h>
  11 #include <common/macros.h>
  12 #include <common/payload.h>
  13 #include <common/payload-view.h>
  14 #include <common/runas.h>
  15 #include <common/hashtable/hashtable.h>
  16 #include <common/hashtable/utils.h>
  17 #include <common/string-utils/string-utils.h>
  18 #include <lttng/event-rule/event-rule-internal.h>
  19 #include <lttng/event-rule/kernel-syscall-internal.h>
  20
  21 #define IS_SYSCALL_EVENT_RULE(rule) \
  22         (lttng_event_rule_get_type(rule) == LTTNG_EVENT_RULE_TYPE_KERNEL_SYSCALL)
  23
  24 static void lttng_event_rule_kernel_syscall_destroy(struct lttng_event_rule *rule)
  25 {
  26         struct lttng_event_rule_kernel_syscall *syscall;
  27
  28         if (rule == NULL) {
  29                 return;
  30         }
  31
  32         syscall = container_of(rule, struct lttng_event_rule_kernel_syscall, parent);
  33
  34         free(syscall->pattern);
  35         free(syscall->filter_expression);
  36         free(syscall->internal_filter.filter);
  37         free(syscall->internal_filter.bytecode);
  38         free(syscall);
  39 }
  40
  41 static bool lttng_event_rule_kernel_syscall_validate(
  42                 const struct lttng_event_rule *rule)
  43 {
  44         bool valid = false;
  45         struct lttng_event_rule_kernel_syscall *syscall;
  46
  47         if (!rule) {
  48                 goto end;
  49         }
  50
  51         syscall = container_of(rule, struct lttng_event_rule_kernel_syscall, parent);
  52
  53         /* Required field. */
  54         if (!syscall->pattern) {
  55                 ERR("Invalid syscall event rule: a pattern must be set.");
  56                 goto end;
  57         }
  58
  59         valid = true;
  60 end:
  61         return valid;
  62 }
  63
  64 static int lttng_event_rule_kernel_syscall_serialize(
  65                 const struct lttng_event_rule *rule,
  66                 struct lttng_payload *payload)
  67 {
  68         int ret;
  69         size_t pattern_len, filter_expression_len;
  70         struct lttng_event_rule_kernel_syscall *syscall;
  71         struct lttng_event_rule_kernel_syscall_comm syscall_comm;
  72
  73         if (!rule || !IS_SYSCALL_EVENT_RULE(rule)) {
  74                 ret = -1;
  75                 goto end;
  76         }
  77
  78         DBG("Serializing syscall event rule");
  79         syscall = container_of(rule, struct lttng_event_rule_kernel_syscall, parent);
  80
  81         pattern_len = strlen(syscall->pattern) + 1;
  82
  83         if (syscall->filter_expression != NULL) {
  84                 filter_expression_len = strlen(syscall->filter_expression) + 1;
  85         } else {
  86                 filter_expression_len = 0;
  87         }
  88
  89         syscall_comm.pattern_len = pattern_len;
  90         syscall_comm.filter_expression_len = filter_expression_len;
  91         syscall_comm.emission_site = syscall->emission_site;
  92
  93         ret = lttng_dynamic_buffer_append(
  94                         &payload->buffer, &syscall_comm, sizeof(syscall_comm));
  95         if (ret) {
  96                 goto end;
  97         }
  98
  99         ret = lttng_dynamic_buffer_append(
 100                         &payload->buffer, syscall->pattern, pattern_len);
 101         if (ret) {
 102                 goto end;
 103         }
 104
 105         ret = lttng_dynamic_buffer_append(&payload->buffer,
 106                         syscall->filter_expression, filter_expression_len);
 107 end:
 108         return ret;
 109 }
 110
 111 static bool lttng_event_rule_kernel_syscall_is_equal(const struct lttng_event_rule *_a,
 112                 const struct lttng_event_rule *_b)
 113 {
 114         bool is_equal = false;
 115         struct lttng_event_rule_kernel_syscall *a, *b;
 116
 117         a = container_of(_a, struct lttng_event_rule_kernel_syscall, parent);
 118         b = container_of(_b, struct lttng_event_rule_kernel_syscall, parent);
 119
 120         if (!!a->filter_expression != !!b->filter_expression) {
 121                 goto end;
 122         }
 123
 124         assert(a->pattern);
 125         assert(b->pattern);
 126         if (strcmp(a->pattern, b->pattern)) {
 127                 goto end;
 128         }
 129
 130         if (a->filter_expression && b->filter_expression) {
 131                 if (strcmp(a->filter_expression, b->filter_expression)) {
 132                         goto end;
 133                 }
 134         } else if (!!a->filter_expression != !!b->filter_expression) {
 135                 /* One is set and not the other. */
 136                 goto end;
 137         }
 138
 139         is_equal = true;
 140 end:
 141         return is_equal;
 142 }
 143
 144 static enum lttng_error_code lttng_event_rule_kernel_syscall_generate_filter_bytecode(
 145                 struct lttng_event_rule *rule,
 146                 const struct lttng_credentials *creds)
 147 {
 148         int ret;
 149         enum lttng_error_code ret_code = LTTNG_OK;
 150         struct lttng_event_rule_kernel_syscall *syscall;
 151         enum lttng_event_rule_status status;
 152         const char *filter;
 153         struct lttng_bytecode *bytecode = NULL;
 154
 155         assert(rule);
 156
 157         syscall = container_of(rule, struct lttng_event_rule_kernel_syscall, parent);
 158
 159         /* Generate the filter bytecode. */
 160         status = lttng_event_rule_kernel_syscall_get_filter(rule, &filter);
 161         if (status == LTTNG_EVENT_RULE_STATUS_UNSET) {
 162                 filter = NULL;
 163         } else if (status != LTTNG_EVENT_RULE_STATUS_OK) {
 164                 ret_code = LTTNG_ERR_FILTER_INVAL;
 165                 goto end;
 166         }
 167
 168         if (filter && filter[0] == '\0') {
 169                 ret_code = LTTNG_ERR_FILTER_INVAL;
 170                 goto end;
 171         }
 172
 173         if (filter == NULL) {
 174                 /* Nothing to do. */
 175                 ret = LTTNG_OK;
 176                 goto end;
 177         }
 178
 179         syscall->internal_filter.filter = strdup(filter);
 180         if (syscall->internal_filter.filter == NULL) {
 181                 ret_code = LTTNG_ERR_NOMEM;
 182                 goto end;
 183         }
 184
 185         ret = run_as_generate_filter_bytecode(
 186                         syscall->internal_filter.filter, creds, &bytecode);
 187         if (ret) {
 188                 ret_code = LTTNG_ERR_FILTER_INVAL;
 189         }
 190
 191         syscall->internal_filter.bytecode = bytecode;
 192         bytecode = NULL;
 193
 194 end:
 195         free(bytecode);
 196         return ret_code;
 197 }
 198
 199 static const char *lttng_event_rule_kernel_syscall_get_internal_filter(
 200                 const struct lttng_event_rule *rule)
 201 {
 202         struct lttng_event_rule_kernel_syscall *syscall;
 203
 204         assert(rule);
 205         syscall = container_of(rule, struct lttng_event_rule_kernel_syscall, parent);
 206
 207         return syscall->internal_filter.filter;
 208 }
 209
 210 static const struct lttng_bytecode *
 211 lttng_event_rule_kernel_syscall_get_internal_filter_bytecode(
 212                 const struct lttng_event_rule *rule)
 213 {
 214         struct lttng_event_rule_kernel_syscall *syscall;
 215
 216         assert(rule);
 217         syscall = container_of(rule, struct lttng_event_rule_kernel_syscall, parent);
 218
 219         return syscall->internal_filter.bytecode;
 220 }
 221
 222 static enum lttng_event_rule_generate_exclusions_status
 223 lttng_event_rule_kernel_syscall_generate_exclusions(const struct lttng_event_rule *rule,
 224                 struct lttng_event_exclusion **exclusions)
 225 {
 226         /* Unsupported. */
 227         *exclusions = NULL;
 228         return LTTNG_EVENT_RULE_GENERATE_EXCLUSIONS_STATUS_NONE;
 229 }
 230
 231 static unsigned long
 232 lttng_event_rule_kernel_syscall_hash(
 233                 const struct lttng_event_rule *rule)
 234 {
 235         unsigned long hash;
 236         struct lttng_event_rule_kernel_syscall *syscall_rule =
 237                         container_of(rule, typeof(*syscall_rule), parent);
 238
 239         hash = hash_key_ulong((void *) LTTNG_EVENT_RULE_TYPE_KERNEL_SYSCALL,
 240                         lttng_ht_seed);
 241         hash ^= hash_key_str(syscall_rule->pattern, lttng_ht_seed);
 242         if (syscall_rule->filter_expression) {
 243                 hash ^= hash_key_str(syscall_rule->filter_expression,
 244                                 lttng_ht_seed);
 245         }
 246
 247         return hash;
 248 }
 249
 250 struct lttng_event_rule *lttng_event_rule_kernel_syscall_create(
 251                 enum lttng_event_rule_kernel_syscall_emission_site
 252                                 emission_site)
 253 {
 254         struct lttng_event_rule *rule = NULL;
 255         struct lttng_event_rule_kernel_syscall *syscall_rule;
 256         enum lttng_event_rule_status status;
 257
 258         /* Validate the emission site type */
 259         switch (emission_site) {
 260         case LTTNG_EVENT_RULE_KERNEL_SYSCALL_EMISSION_SITE_ENTRY_EXIT:
 261         case LTTNG_EVENT_RULE_KERNEL_SYSCALL_EMISSION_SITE_ENTRY:
 262         case LTTNG_EVENT_RULE_KERNEL_SYSCALL_EMISSION_SITE_EXIT:
 263                 break;
 264         default:
 265                 /* Invalid emission type */
 266                 goto end;
 267         }
 268
 269         syscall_rule = zmalloc(sizeof(struct lttng_event_rule_kernel_syscall));
 270         if (!syscall_rule) {
 271                 goto end;
 272         }
 273
 274         rule = &syscall_rule->parent;
 275         lttng_event_rule_init(
 276                         &syscall_rule->parent, LTTNG_EVENT_RULE_TYPE_KERNEL_SYSCALL);
 277         syscall_rule->parent.validate = lttng_event_rule_kernel_syscall_validate;
 278         syscall_rule->parent.serialize = lttng_event_rule_kernel_syscall_serialize;
 279         syscall_rule->parent.equal = lttng_event_rule_kernel_syscall_is_equal;
 280         syscall_rule->parent.destroy = lttng_event_rule_kernel_syscall_destroy;
 281         syscall_rule->parent.generate_filter_bytecode =
 282                         lttng_event_rule_kernel_syscall_generate_filter_bytecode;
 283         syscall_rule->parent.get_filter =
 284                         lttng_event_rule_kernel_syscall_get_internal_filter;
 285         syscall_rule->parent.get_filter_bytecode =
 286                         lttng_event_rule_kernel_syscall_get_internal_filter_bytecode;
 287         syscall_rule->parent.generate_exclusions =
 288                         lttng_event_rule_kernel_syscall_generate_exclusions;
 289         syscall_rule->parent.hash = lttng_event_rule_kernel_syscall_hash;
 290
 291         /* Default pattern is '*'. */
 292         status = lttng_event_rule_kernel_syscall_set_name_pattern(rule, "*");
 293         if (status != LTTNG_EVENT_RULE_STATUS_OK) {
 294                 lttng_event_rule_destroy(rule);
 295                 rule = NULL;
 296         }
 297
 298         /* Emission site type */
 299         syscall_rule->emission_site = emission_site;
 300
 301 end:
 302         return rule;
 303 }
 304
 305 LTTNG_HIDDEN
 306 ssize_t lttng_event_rule_kernel_syscall_create_from_payload(
 307                 struct lttng_payload_view *view,
 308                 struct lttng_event_rule **_event_rule)
 309 {
 310         ssize_t ret, offset = 0;
 311         enum lttng_event_rule_status status;
 312         const struct lttng_event_rule_kernel_syscall_comm *syscall_comm;
 313         const char *pattern;
 314         const char *filter_expression = NULL;
 315         struct lttng_buffer_view current_buffer_view;
 316         struct lttng_event_rule *rule = NULL;
 317
 318         if (!_event_rule) {
 319                 ret = -1;
 320                 goto end;
 321         }
 322
 323         if (view->buffer.size < sizeof(*syscall_comm)) {
 324                 ERR("Failed to initialize from malformed event rule syscall: buffer too short to contain header");
 325                 ret = -1;
 326                 goto end;
 327         }
 328
 329         current_buffer_view = lttng_buffer_view_from_view(
 330                         &view->buffer, offset, sizeof(*syscall_comm));
 331         if (!lttng_buffer_view_is_valid(&current_buffer_view)) {
 332                 ret = -1;
 333                 goto end;
 334         }
 335
 336         syscall_comm = (typeof(syscall_comm)) current_buffer_view.data;
 337         rule = lttng_event_rule_kernel_syscall_create(syscall_comm->emission_site);
 338         if (!rule) {
 339                 ERR("Failed to create event rule syscall");
 340                 ret = -1;
 341                 goto end;
 342         }
 343
 344         /* Skip to payload. */
 345         offset += current_buffer_view.size;
 346
 347         /* Map the pattern. */
 348         current_buffer_view = lttng_buffer_view_from_view(
 349                         &view->buffer, offset, syscall_comm->pattern_len);
 350         if (!lttng_buffer_view_is_valid(&current_buffer_view)) {
 351                 ret = -1;
 352                 goto end;
 353         }
 354
 355         pattern = current_buffer_view.data;
 356         if (!lttng_buffer_view_contains_string(&current_buffer_view, pattern,
 357                         syscall_comm->pattern_len)) {
 358                 ret = -1;
 359                 goto end;
 360         }
 361
 362         /* Skip after the pattern. */
 363         offset += syscall_comm->pattern_len;
 364
 365         if (!syscall_comm->filter_expression_len) {
 366                 goto skip_filter_expression;
 367         }
 368
 369         /* Map the filter_expression. */
 370         current_buffer_view = lttng_buffer_view_from_view(&view->buffer, offset,
 371                         syscall_comm->filter_expression_len);
 372         if (!lttng_buffer_view_is_valid(&current_buffer_view)) {
 373                 ret = -1;
 374                 goto end;
 375         }
 376
 377         filter_expression = current_buffer_view.data;
 378         if (!lttng_buffer_view_contains_string(&current_buffer_view,
 379                                 filter_expression,
 380                                 syscall_comm->filter_expression_len)) {
 381                 ret = -1;
 382                 goto end;
 383         }
 384
 385         /* Skip after the pattern. */
 386         offset += syscall_comm->filter_expression_len;
 387
 388 skip_filter_expression:
 389
 390         status = lttng_event_rule_kernel_syscall_set_name_pattern(rule, pattern);
 391         if (status != LTTNG_EVENT_RULE_STATUS_OK) {
 392                 ERR("Failed to set event rule syscall pattern");
 393                 ret = -1;
 394                 goto end;
 395         }
 396
 397         if (filter_expression) {
 398                 status = lttng_event_rule_kernel_syscall_set_filter(
 399                                 rule, filter_expression);
 400                 if (status != LTTNG_EVENT_RULE_STATUS_OK) {
 401                         ERR("Failed to set event rule syscall pattern");
 402                         ret = -1;
 403                         goto end;
 404                 }
 405         }
 406
 407         *_event_rule = rule;
 408         rule = NULL;
 409         ret = offset;
 410 end:
 411         lttng_event_rule_destroy(rule);
 412         return ret;
 413 }
 414
 415 enum lttng_event_rule_status lttng_event_rule_kernel_syscall_set_name_pattern(
 416                 struct lttng_event_rule *rule, const char *pattern)
 417 {
 418         char *pattern_copy = NULL;
 419         struct lttng_event_rule_kernel_syscall *syscall;
 420         enum lttng_event_rule_status status = LTTNG_EVENT_RULE_STATUS_OK;
 421
 422         if (!rule || !IS_SYSCALL_EVENT_RULE(rule) || !pattern ||
 423                         strlen(pattern) == 0) {
 424                 status = LTTNG_EVENT_RULE_STATUS_INVALID;
 425                 goto end;
 426         }
 427
 428         syscall = container_of(rule, struct lttng_event_rule_kernel_syscall, parent);
 429         pattern_copy = strdup(pattern);
 430         if (!pattern_copy) {
 431                 status = LTTNG_EVENT_RULE_STATUS_ERROR;
 432                 goto end;
 433         }
 434
 435         strutils_normalize_star_glob_pattern(pattern_copy);
 436
 437         free(syscall->pattern);
 438
 439         syscall->pattern = pattern_copy;
 440         pattern_copy = NULL;
 441 end:
 442         return status;
 443 }
 444
 445 enum lttng_event_rule_status lttng_event_rule_kernel_syscall_get_name_pattern(
 446                 const struct lttng_event_rule *rule, const char **pattern)
 447 {
 448         struct lttng_event_rule_kernel_syscall *syscall;
 449         enum lttng_event_rule_status status = LTTNG_EVENT_RULE_STATUS_OK;
 450
 451         if (!rule || !IS_SYSCALL_EVENT_RULE(rule) || !pattern) {
 452                 status = LTTNG_EVENT_RULE_STATUS_INVALID;
 453                 goto end;
 454         }
 455
 456         syscall = container_of(rule, struct lttng_event_rule_kernel_syscall, parent);
 457         if (!syscall->pattern) {
 458                 status = LTTNG_EVENT_RULE_STATUS_UNSET;
 459                 goto end;
 460         }
 461
 462         *pattern = syscall->pattern;
 463 end:
 464         return status;
 465 }
 466
 467 enum lttng_event_rule_status lttng_event_rule_kernel_syscall_set_filter(
 468                 struct lttng_event_rule *rule, const char *expression)
 469 {
 470         char *expression_copy = NULL;
 471         struct lttng_event_rule_kernel_syscall *syscall;
 472         enum lttng_event_rule_status status = LTTNG_EVENT_RULE_STATUS_OK;
 473
 474         /* TODO: validate that the passed expression is valid. */
 475
 476         if (!rule || !IS_SYSCALL_EVENT_RULE(rule) || !expression ||
 477                         strlen(expression) == 0) {
 478                 status = LTTNG_EVENT_RULE_STATUS_INVALID;
 479                 goto end;
 480         }
 481
 482         syscall = container_of(rule, struct lttng_event_rule_kernel_syscall, parent);
 483         expression_copy = strdup(expression);
 484         if (!expression_copy) {
 485                 status = LTTNG_EVENT_RULE_STATUS_ERROR;
 486                 goto end;
 487         }
 488
 489         if (syscall->filter_expression) {
 490                 free(syscall->filter_expression);
 491         }
 492
 493         syscall->filter_expression = expression_copy;
 494         expression_copy = NULL;
 495 end:
 496         return status;
 497 }
 498
 499 enum lttng_event_rule_status lttng_event_rule_kernel_syscall_get_filter(
 500                 const struct lttng_event_rule *rule, const char **expression)
 501 {
 502         struct lttng_event_rule_kernel_syscall *syscall;
 503         enum lttng_event_rule_status status = LTTNG_EVENT_RULE_STATUS_OK;
 504
 505         if (!rule || !IS_SYSCALL_EVENT_RULE(rule) || !expression) {
 506                 status = LTTNG_EVENT_RULE_STATUS_INVALID;
 507                 goto end;
 508         }
 509
 510         syscall = container_of(rule, struct lttng_event_rule_kernel_syscall, parent);
 511         if (!syscall->filter_expression) {
 512                 status = LTTNG_EVENT_RULE_STATUS_UNSET;
 513                 goto end;
 514         }
 515
 516         *expression = syscall->filter_expression;
 517 end:
 518         return status;
 519 }
 520 extern enum lttng_event_rule_kernel_syscall_emission_site
 521 lttng_event_rule_kernel_syscall_get_emission_site(
 522                 const struct lttng_event_rule *rule)
 523 {
 524         enum lttng_event_rule_kernel_syscall_emission_site emission_site =
 525                 LTTNG_EVENT_RULE_KERNEL_SYSCALL_EMISSION_SITE_UNKNOWN;
 526         struct lttng_event_rule_kernel_syscall *syscall;
 527
 528         if (!rule || !IS_SYSCALL_EVENT_RULE(rule)) {
 529                 goto end;
 530         }
 531
 532         syscall = container_of(rule, struct lttng_event_rule_kernel_syscall, parent);
 533         emission_site = syscall->emission_site;
 534
 535 end:
 536         return emission_site;
 537 }
 538
 539 LTTNG_HIDDEN
 540 const char *lttng_event_rule_kernel_syscall_emission_site_str(
 541                 enum lttng_event_rule_kernel_syscall_emission_site emission_site)
 542 {
 543         switch (emission_site) {
 544         case LTTNG_EVENT_RULE_KERNEL_SYSCALL_EMISSION_SITE_ENTRY:
 545                 return "entry";
 546         case LTTNG_EVENT_RULE_KERNEL_SYSCALL_EMISSION_SITE_ENTRY_EXIT:
 547                 return "entry+exit";
 548         case LTTNG_EVENT_RULE_KERNEL_SYSCALL_EMISSION_SITE_EXIT:
 549                 return "exit";
 550         default:
 551                 return "???";
 552         }
 553 }