FreeBSD中替换系统调用监视系统文件打开记录

FreeBSD 7.1

Makefile

SRCS = rmdir.c vn_help.c main.c  vnode_if.h 
KMOD = fsmon
KO  = $(KMOD).ko
KLDMOD = t
WERROR  = 

.include <bsd.kmod.mk>

main.c 模块主文件

#include "inc.h"

static int
load (struct module *module, int cmd, void *arg) 
{
    int error = 0;

    switch( cmd ) {
    case MOD_LOAD:
        uprintf( "%s module was loaded. \n", MOD_NAME );
        //sysent[SYS_rmdir].sy_call = (sy_call_t *)new_rmdir;

        //sysent[SYS_mkdir].sy_call = (sy_call_t *)new_mkdir;

        sysent[SYS_open].sy_call = (sy_call_t *)new_open;
        break;

    case MOD_UNLOAD:
        uprintf( "%s module was unloaded. \n", MOD_NAME );
        //sysent[SYS_rmdir].sy_call = (sy_call_t *)rmdir;

        //sysent[SYS_mkdir].sy_call = (sy_call_t *)mkdir;

        sysent[SYS_open].sy_call = (sy_call_t *)open;
        break;

    default:
        error = EINVAL;
        break;
    }
    return error;
}

static moduledata_t fsmon_mod = {
  "fsmon",
  load,
  NULL
};  

DECLARE_MODULE(fsmon, fsmon_mod, SI_SUB_KLD,SI_ORDER_ANY);

open.c 拦截open系统调用

#include "inc.h"

static char old_path[MAXPATHLEN];

int
new_open(td, uap)
    struct thread *td;
    register struct open_args /* {
        char *path;
        int flags;
        int mode;
    } */ *uap;
{

    struct vnode *vp, *dvp = NULL;
    int error;
    struct nameidata nd, *ndp;
    int vfslocked;
    char *dlep = NULL;
    char *flep = NULL;
    char *nameptr = NULL;
    char *dirptr = NULL;
    int fmode = 0, mpsafe;
    int locked = 0;    
    
    fmode = FFLAGS(uap->flags);
    ndp = &nd;    
    mpsafe = ndp->ni_cnd.cn_flags & MPSAFE;
    
    vfslocked = 0;    
    NDINIT(ndp, LOOKUP, FOLLOW | AUDITVNODE1 | MPSAFE, UIO_USERSPACE, uap->path, td);
    
    if (fmode & O_CREAT) {
        ndp->ni_cnd.cn_nameiop = CREATE;
        ndp->ni_cnd.cn_flags = ISOPEN | LOCKPARENT | LOCKLEAF |
            MPSAFE | AUDITVNODE1;
        if ((fmode & O_EXCL) == 0 && (fmode & O_NOFOLLOW) == 0)
            ndp->ni_cnd.cn_flags |= FOLLOW;
        bwillwrite();
        if ((error = namei(ndp)) != 0)
            return (error);
        vfslocked = NDHASGIANT(ndp);
        if (!mpsafe)
            ndp->ni_cnd.cn_flags &= ~MPSAFE;
            
        if (ndp->ni_vp == NULL) {
            dvp = ndp->ni_dvp;
            vp = NULL;
            locked = 0;
            
            vput(ndp->ni_dvp);
            VFS_UNLOCK_GIANT(vfslocked);
            NDFREE(ndp, NDF_ONLY_PNBUF);
        }
        else {
            if (ndp->ni_dvp == ndp->ni_vp)
                vrele(ndp->ni_dvp);
            else
                vput(ndp->ni_dvp);
                
            dvp = ndp->ni_dvp;            
            vp = ndp->ni_vp;
            locked = 1;
            
            if (fmode & O_EXCL) {
                error = EEXIST;
                goto bad;
            }
        }
    }
    else {
        ndp->ni_cnd.cn_nameiop = LOOKUP;
        ndp->ni_cnd.cn_flags = ISOPEN |
            ((fmode & O_NOFOLLOW) ? NOFOLLOW : FOLLOW) |
            LOCKLEAF | MPSAFE | AUDITVNODE1;
        if ((error = namei(ndp)) != 0)
            return (error);
        if (!mpsafe)
            ndp->ni_cnd.cn_flags &= ~MPSAFE;
        vfslocked = NDHASGIANT(ndp);
        
        dvp = ndp->ni_dvp;
        vp = ndp->ni_vp;
        locked = 1;
    }
    
    if ( vp ) {
        if (vp->v_type == VLNK) {
            error = EMLINK;
            goto bad;
        }
        if (vp->v_type == VSOCK) {
            error = EOPNOTSUPP;
            goto bad;
        }
        if (fmode & (FWRITE | O_TRUNC)) {
            if (vp->v_type == VDIR) {
                error = EISDIR;
                goto bad;
            }
        }
    }
    if ( dvp ) {
        error = vn_fullpath( td, dvp, &dlep, &flep );
        if ( !error ) {
            //uprintf( "path = %s\n", dlep );

            strncpy( old_path, dlep, MAXPATHLEN );            
        }
        else {
            uprintf( "%s: vn_fullpath call fail. return %d\n", __func__, error );
            //uprintf( "old_path = %s \n", old_path );            

        }
        //

        dirptr = old_path;        
        if ( nd.ni_cnd.cn_namelen ) {
            nameptr = nd.ni_cnd.cn_nameptr;
        }
        else {
            nameptr = "";
        }
        
        if ( fmode & O_CREAT ) {
            uprintf( "open %s/%s for create\n", dirptr, nameptr );
        }
        else {
            if ( fmode & (FWRITE | O_TRUNC | O_APPEND) ) {
                uprintf( "open %s/%s for write\n", dirptr, nameptr );
            }
            else {
                uprintf( "open %s/%s\n", dirptr, nameptr );
            }
        }        
        
        if ( flep ) {
            free( flep, M_TEMP );
        }        
        error = 0;
    }
    
    if ( locked ) {
        NDFREE(ndp, NDF_ONLY_PNBUF);
        if ( vp )
            vput(vp);
        VFS_UNLOCK_GIANT(vfslocked);
    }
    return kern_open(td, uap->path, UIO_USERSPACE, uap->flags, uap->mode);
    
bad:
    NDFREE(ndp, NDF_ONLY_PNBUF);
    if ( vp )
        vput(vp);
    VFS_UNLOCK_GIANT(vfslocked);
    return error;
}

in.h 公共头文件

#ifndef _INC_H
#define _INC_H

#include <sys/cdefs.h>
#include <sys/param.h>
#include <sys/systm.h>
#include <sys/bio.h>
#include <sys/buf.h>
#include <sys/sysent.h>
#include <sys/malloc.h>
#include <sys/mount.h>
#include <sys/mutex.h>
#include <sys/sysproto.h>
#include <sys/namei.h>
#include <sys/filedesc.h>
#include <sys/kernel.h>
#include <sys/fcntl.h>
#include <sys/file.h>
#include <sys/filio.h>
#include <sys/limits.h>
#include <sys/linker.h>
#include <sys/stat.h>
#include <sys/sx.h>
#include <sys/unistd.h>
#include <sys/vnode.h>
#include <sys/priv.h>
#include <sys/proc.h>
#include <sys/dirent.h>
#include <sys/jail.h>
#include <sys/syscallsubr.h>
#include <sys/sysctl.h>
#ifdef KTRACE
#include <sys/ktrace.h>
#endif

#include <machine/stdarg.h>

#include <security/audit/audit.h>
#include <security/mac/mac_framework.h>

#include <vm/vm.h>
#include <vm/vm_object.h>
#include <vm/vm_page.h>
#include <vm/uma.h>


#define MOD_NAME    "fsmon"


int    new_open(struct thread *, struct open_args *);

#endif