Patch Detail
get:
Show a patch.
patch:
Update a patch.
put:
Update a patch.
GET /api/patches/812784/?format=api
{ "id": 812784, "url": "http://patchwork.ozlabs.org/api/patches/812784/?format=api", "web_url": "http://patchwork.ozlabs.org/project/lede/patch/20170912111250.31576-9-sojkam1@fel.cvut.cz/", "project": { "id": 54, "url": "http://patchwork.ozlabs.org/api/projects/54/?format=api", "name": "LEDE development", "link_name": "lede", "list_id": "lede-dev.lists.infradead.org", "list_email": "lede-dev@lists.infradead.org", "web_url": "http://lede-project.org/", "scm_url": "", "webscm_url": "http://git.lede-project.org/", "list_archive_url": "", "list_archive_url_format": "", "commit_url_format": "" }, "msgid": "<20170912111250.31576-9-sojkam1@fel.cvut.cz>", "list_archive_url": null, "date": "2017-09-12T11:12:38", "name": "[LEDE-DEV,procd,06/17] utrace: Trace processes across forks", "commit_ref": null, "pull_url": null, "state": "accepted", "archived": false, "hash": "ec80c455a168880aad271e6ad2414c2355f446c9", "submitter": { "id": 14651, "url": "http://patchwork.ozlabs.org/api/people/14651/?format=api", "name": "Michal Sojka", "email": "sojkam1@fel.cvut.cz" }, "delegate": null, "mbox": "http://patchwork.ozlabs.org/project/lede/patch/20170912111250.31576-9-sojkam1@fel.cvut.cz/mbox/", "series": [ { "id": 2665, "url": "http://patchwork.ozlabs.org/api/series/2665/?format=api", "web_url": "http://patchwork.ozlabs.org/project/lede/list/?series=2665", "date": "2017-09-12T11:12:36", "name": "[LEDE-DEV,procd,01/17] utrace: Fix environment initialization", "version": 1, "mbox": "http://patchwork.ozlabs.org/series/2665/mbox/" } ], "comments": "http://patchwork.ozlabs.org/api/patches/812784/comments/", "check": "pending", "checks": "http://patchwork.ozlabs.org/api/patches/812784/checks/", "tags": {}, "related": [], "headers": { "Return-Path": "<lede-dev-bounces+incoming=patchwork.ozlabs.org@lists.infradead.org>", "X-Original-To": "incoming@patchwork.ozlabs.org", "Delivered-To": "patchwork-incoming@bilbo.ozlabs.org", "Authentication-Results": [ "ozlabs.org; spf=none (mailfrom)\n\tsmtp.mailfrom=lists.infradead.org (client-ip=65.50.211.133;\n\thelo=bombadil.infradead.org;\n\tenvelope-from=lede-dev-bounces+incoming=patchwork.ozlabs.org@lists.infradead.org;\n\treceiver=<UNKNOWN>)", "ozlabs.org; dkim=pass (2048-bit key;\n\tunprotected) header.d=lists.infradead.org\n\theader.i=@lists.infradead.org header.b=\"iHjBmMVU\"; \n\tdkim-atps=neutral" ], "Received": [ "from bombadil.infradead.org (bombadil.infradead.org\n\t[65.50.211.133])\n\t(using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256\n\tbits)) (No client certificate requested)\n\tby ozlabs.org (Postfix) with ESMTPS id 3xs2MT5bZzz9s7g\n\tfor <incoming@patchwork.ozlabs.org>;\n\tTue, 12 Sep 2017 21:17:41 +1000 (AEST)", "from localhost ([127.0.0.1] helo=bombadil.infradead.org)\n\tby bombadil.infradead.org with esmtp (Exim 4.87 #1 (Red Hat Linux))\n\tid 1drjC5-0008SS-EY; Tue, 12 Sep 2017 11:17:29 +0000", "from smtpx.feld.cvut.cz ([147.32.192.33])\n\tby bombadil.infradead.org with esmtp (Exim 4.87 #1 (Red Hat Linux))\n\tid 1drj8i-0004Xz-VL\n\tfor lede-dev@lists.infradead.org; Tue, 12 Sep 2017 11:14:11 +0000", "from localhost (unknown [192.168.200.7])\n\tby smtpx.feld.cvut.cz (Postfix) with ESMTP id CA481DC3DD;\n\tTue, 12 Sep 2017 13:13:15 +0200 (CEST)", "from smtpx.feld.cvut.cz ([192.168.200.6])\n\tby localhost (styx.feld.cvut.cz [192.168.200.7]) (amavisd-new,\n\tport 10054)\n\twith ESMTP id XoI0g3aeciOG; Tue, 12 Sep 2017 13:13:14 +0200 (CEST)", "from imap.feld.cvut.cz (imap.feld.cvut.cz [147.32.192.34])\n\tby smtpx.feld.cvut.cz (Postfix) with ESMTP id 39B3DDC3DC;\n\tTue, 12 Sep 2017 13:13:13 +0200 (CEST)", "from wsh by steelpick.2x.cz with local (Exim 4.89)\n\t(envelope-from <sojkam1@fel.cvut.cz>)\n\tid 1drj7x-0008EP-5Q; Tue, 12 Sep 2017 13:13:13 +0200" ], "DKIM-Signature": "v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed;\n\td=lists.infradead.org; s=bombadil.20170209; h=Sender:\n\tContent-Transfer-Encoding:Content-Type:MIME-Version:Cc:List-Subscribe:\n\tList-Help:List-Post:List-Archive:List-Unsubscribe:List-Id:Subject:References:\n\tIn-Reply-To:Message-Id:Date:To:From:Reply-To:Content-ID:Content-Description:\n\tResent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:\n\tList-Owner; bh=O2xAS3KOC/urls02VcyuKO5F9+6zcH2/WDESXLbdQxI=;\n\tb=iHjBmMVUYk9zDv\n\tPAhYDYA3bpptl1SP4rTA8TagEIyksZYK7m3OJZTdkM1D5pmAnfiUTZD+VaAmfqqAuc1QDC5b1cK/t\n\tS6taTAmezM3R5abPO3bYfHBgzUzWIKmwkcyr4q0lJt+nx666TMTX4QDHTOC1fmDLWtS58JvYQvukj\n\t+gj7oFODvNpJ55ICbrbyHO1A0150xUk0Vy42oX8GkO1cjx6Ypl7cQGCE28WqwK7Wx5zRy0XE3gUqK\n\t19Mfqc0RNAHpg9JHwdHVtUFOpdJ4Q1iEHUSpxISqKYTZtgA3MQK6BJCGKKSE2nECovMB3cmmE3exS\n\t9dXlXu4Dxj8ZCsrpnSjg==;", "X-Virus-Scanned": "IMAP STYX AMAVIS", "From": "Michal Sojka <sojkam1@fel.cvut.cz>", "To": "lede-dev@lists.infradead.org", "Date": "Tue, 12 Sep 2017 13:12:38 +0200", "Message-Id": "<20170912111250.31576-9-sojkam1@fel.cvut.cz>", "X-Mailer": "git-send-email 2.14.1", "In-Reply-To": "<20170912111250.31576-1-sojkam1@fel.cvut.cz>", "References": "<20170912111250.31576-1-sojkam1@fel.cvut.cz>", "X-CRM114-Version": "20100106-BlameMichelson ( TRE 0.8.0 (BSD) ) MR-646709E3 ", "X-CRM114-CacheID": "sfid-20170912_041401_513336_F308C685 ", "X-CRM114-Status": "GOOD ( 12.17 )", "X-Spam-Score": "-4.2 (----)", "X-Spam-Report": "SpamAssassin version 3.4.1 on bombadil.infradead.org summary:\n\tContent analysis details: (-4.2 points)\n\tpts rule name description\n\t---- ----------------------\n\t--------------------------------------------------\n\t-2.3 RCVD_IN_DNSWL_MED RBL: Sender listed at http://www.dnswl.org/,\n\tmedium trust [147.32.192.33 listed in list.dnswl.org]\n\t-0.0 RP_MATCHES_RCVD Envelope sender domain matches handover relay\n\tdomain\n\t-1.9 BAYES_00 BODY: Bayes spam probability is 0 to 1%\n\t[score: 0.0000]", "Subject": "[LEDE-DEV] [PATCH procd 06/17] utrace: Trace processes across forks", "X-BeenThere": "lede-dev@lists.infradead.org", "X-Mailman-Version": "2.1.21", "Precedence": "list", "List-Id": "<lede-dev.lists.infradead.org>", "List-Unsubscribe": "<http://lists.infradead.org/mailman/options/lede-dev>,\n\t<mailto:lede-dev-request@lists.infradead.org?subject=unsubscribe>", "List-Archive": "<http://lists.infradead.org/pipermail/lede-dev/>", "List-Post": "<mailto:lede-dev@lists.infradead.org>", "List-Help": "<mailto:lede-dev-request@lists.infradead.org?subject=help>", "List-Subscribe": "<http://lists.infradead.org/mailman/listinfo/lede-dev>,\n\t<mailto:lede-dev-request@lists.infradead.org?subject=subscribe>", "Cc": "Michal Sojka <sojkam1@fel.cvut.cz>", "MIME-Version": "1.0", "Content-Type": "text/plain; charset=\"us-ascii\"", "Content-Transfer-Encoding": "7bit", "Sender": "\"Lede-dev\" <lede-dev-bounces@lists.infradead.org>", "Errors-To": "lede-dev-bounces+incoming=patchwork.ozlabs.org@lists.infradead.org" }, "content": "Without this change, utrace can trace only a single process. When the\nprocess forks, syscalls of its children do not appear in utrace\noutput. This is a problem, because seccomp filters are inherited by\nchildren and therefore filters generated by utrace may lack legitimate\nsyscalls.\n\nThis commit enables utrace to trace processes across forks. The\nfunctionality can be demonstrated by the following examples:\n\n utrace /bin/touch /tmp/xxx\n\nproduces:\n\n {\n \"whitelist\": [\n \"rt_sigaction\",\n \"rt_sigreturn\",\n \"exit\",\n \"getuid\",\n \"exit_group\",\n \"utimensat\"\n ],\n \"policy\": 1\n }\n\nThe command:\n\n utrace /bin/sh -c 'touch /tmp/xxx'\n\nwithout this commit produces:\n\n {\n \"whitelist\": [\n \"stat\",\n \"rt_sigaction\",\n \"rt_sigprocmask\",\n \"rt_sigreturn\",\n \"getpid\",\n \"fork\",\n \"exit\",\n \"wait4\",\n \"uname\",\n \"getcwd\",\n \"getuid\",\n \"getppid\",\n \"exit_group\"\n ],\n \"policy\": 1\n }\n\nbut with this commit, the output is the following:\n\n {\n \"whitelist\": [\n \"read\",\n \"open\",\n \"close\",\n \"stat\",\n \"fstat\",\n \"mmap\",\n \"mprotect\",\n \"rt_sigaction\",\n \"rt_sigprocmask\",\n \"rt_sigreturn\",\n \"getpid\",\n \"fork\",\n \"execve\",\n \"exit\",\n \"wait4\",\n \"uname\",\n \"fcntl\",\n \"getcwd\",\n \"getuid\",\n \"getppid\",\n \"arch_prctl\",\n \"gettid\",\n \"set_tid_address\",\n \"exit_group\",\n \"utimensat\"\n ],\n \"policy\": 1\n }\n\nNote that in addition to utimensat syscall from touch, this output\ncontains more syscalls than what is in the union of single-process sh\nand touch traces. The reason is that single-process traces do not\ninclude syscalls from dynamic linker (due to preload trick), but the\ntrace of forked processes includes the dynamic linker syscalls. This\nis unavoidable, because dynamic linker of the forked processes will be\nsubject to seccomp filters of the parent process.\n\nSigned-off-by: Michal Sojka <sojkam1@fel.cvut.cz>\n---\n trace/trace.c | 64 +++++++++++++++++++++++++++++++++++++++++------------------\n 1 file changed, 45 insertions(+), 19 deletions(-)", "diff": "diff --git a/trace/trace.c b/trace/trace.c\nindex 35bc548..f882c2e 100644\n--- a/trace/trace.c\n+++ b/trace/trace.c\n@@ -57,11 +57,15 @@\n \tfprintf(stderr, \"utrace: \"fmt, ## __VA_ARGS__); \\\n } while (0)\n \n-static struct uloop_process tracer;\n+struct tracee {\n+\tstruct uloop_process proc;\n+\tint in_syscall;\n+};\n+\n+static struct tracee tracer;\n static int *syscall_count;\n static struct blob_buf b;\n static int syscall_max;\n-static int in_syscall;\n static int debug;\n \n static int max_syscall = ARRAY_SIZE(syscall_names);\n@@ -143,25 +147,45 @@ static void print_syscalls(int policy, const char *json)\n \n static void tracer_cb(struct uloop_process *c, int ret)\n {\n-\tif (WIFSTOPPED(ret) && WSTOPSIG(ret) & 0x80) {\n-\t\tif (!in_syscall) {\n-\t\t\tint syscall = ptrace(PTRACE_PEEKUSER, c->pid, reg_syscall_nr);\n-\n-\t\t\tif (syscall < syscall_max) {\n-\t\t\t\tsyscall_count[syscall]++;\n-\t\t\t\tif (debug)\n-\t\t\t\t\tfprintf(stderr, \"%s()\\n\", syscall_names[syscall]);\n-\t\t\t} else if (debug) {\n-\t\t\t\tfprintf(stderr, \"syscal(%d)\\n\", syscall);\n+\tstruct tracee *tracee = container_of(c, struct tracee, proc);\n+\n+\tif (WIFSTOPPED(ret)) {\n+\t\tif (WSTOPSIG(ret) & 0x80) {\n+\t\t\tif (!tracee->in_syscall) {\n+\t\t\t\tint syscall = ptrace(PTRACE_PEEKUSER, c->pid, reg_syscall_nr);\n+\n+\t\t\t\tif (syscall < syscall_max) {\n+\t\t\t\t\tsyscall_count[syscall]++;\n+\t\t\t\t\tif (debug)\n+\t\t\t\t\t\tfprintf(stderr, \"%s()\\n\", syscall_names[syscall]);\n+\t\t\t\t} else if (debug) {\n+\t\t\t\t\tfprintf(stderr, \"syscal(%d)\\n\", syscall);\n+\t\t\t\t}\n \t\t\t}\n+\t\t\ttracee->in_syscall = !tracee->in_syscall;\n+\t\t} else if ((ret >> 8) == (SIGTRAP | (PTRACE_EVENT_FORK << 8))) {\n+\t\t\tstruct tracee *child = calloc(1, sizeof(struct tracee));\n+\n+\t\t\tptrace(PTRACE_GETEVENTMSG, c->pid, 0, &child->proc.pid);\n+\t\t\tchild->proc.cb = tracer_cb;\n+\t\t\tptrace(PTRACE_SYSCALL, child->proc.pid, 0, 0);\n+\t\t\tuloop_process_add(&child->proc);\n+\t\t\tif (debug)\n+\t\t\t\tfprintf(stderr, \"Tracing new child %d\\n\", child->proc.pid);\n \t\t}\n-\t\tin_syscall = !in_syscall;\n \t} else if (WIFEXITED(ret)) {\n-\t\tuloop_end();\n+\t\tif (tracee == &tracer) {\n+\t\t\tuloop_end(); /* Main process exit */\n+\t\t} else {\n+\t\t\tif (debug)\n+\t\t\t\tfprintf(stderr, \"Child %d exited\\n\", tracee->proc.pid);\n+\t\t\tfree(tracee);\n+\t\t}\n \t\treturn;\n \t}\n+\n \tptrace(PTRACE_SYSCALL, c->pid, 0, 0);\n-\tuloop_process_add(&tracer);\n+\tuloop_process_add(c);\n }\n \n int main(int argc, char **argv, char **envp)\n@@ -228,13 +252,15 @@ int main(int argc, char **argv, char **envp)\n \t\treturn -1;\n \t}\n \n-\tptrace(PTRACE_SETOPTIONS, child, 0, PTRACE_O_TRACESYSGOOD);\n+\tptrace(PTRACE_SETOPTIONS, child, 0,\n+\t PTRACE_O_TRACESYSGOOD |\n+\t PTRACE_O_TRACEFORK);\n \tptrace(PTRACE_SYSCALL, child, 0, 0);\n \n \tuloop_init();\n-\ttracer.pid = child;\n-\ttracer.cb = tracer_cb;\n-\tuloop_process_add(&tracer);\n+\ttracer.proc.pid = child;\n+\ttracer.proc.cb = tracer_cb;\n+\tuloop_process_add(&tracer.proc);\n \tuloop_run();\n \tuloop_done();\n \n", "prefixes": [ "LEDE-DEV", "procd", "06/17" ] }