Skip to content

Commit 88f6a1b

Browse files
gianlucaborelloluca3m
gianlucaborello
authored and
luca3m
committed
Parse processes tty (#792)
* Extract tty from /proc + kernel * typo * Proper include for 2.6.32 * A couple more initializations
1 parent 139fd7c commit 88f6a1b

File tree

11 files changed

+191
-94
lines changed

11 files changed

+191
-94
lines changed

‎driver/event_table.c‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -303,5 +303,7 @@ const struct ppm_event_info g_event_info[PPM_EVENT_MAX] = {
303303
/* PPME_SYSCALL_RMDIR_2_E */{"rmdir", EC_FILE, EF_NONE, 0},
304304
/* PPME_SYSCALL_RMDIR_2_X */{"rmdir", EC_FILE, EF_NONE, 2, {{"res", PT_ERRNO, PF_DEC}, {"path", PT_FSPATH, PF_NA} } },
305305
/* PPME_NOTIFICATION_E */{"notification", EC_OTHER, EF_SKIPPARSERESET, 2, {{"id", PT_CHARBUF, PF_DEC}, {"desc", PT_CHARBUF, PF_NA}, } },
306-
/* PPME_NOTIFICATION_X */{"NA4", EC_SYSTEM, EF_UNUSED, 0}
306+
/* PPME_NOTIFICATION_X */{"NA4", EC_SYSTEM, EF_UNUSED, 0},
307+
/* PPME_SYSCALL_EXECVE_17_E */{"execve", EC_PROCESS, EF_MODIFIES_STATE, 0},
308+
/* PPME_SYSCALL_EXECVE_17_X */{"execve", EC_PROCESS, EF_MODIFIES_STATE, 17, {{"res", PT_ERRNO, PF_DEC}, {"exe", PT_CHARBUF, PF_NA}, {"args", PT_BYTEBUF, PF_NA}, {"tid", PT_PID, PF_DEC}, {"pid", PT_PID, PF_DEC}, {"ptid", PT_PID, PF_DEC}, {"cwd", PT_CHARBUF, PF_NA}, {"fdlimit", PT_UINT64, PF_DEC}, {"pgft_maj", PT_UINT64, PF_DEC}, {"pgft_min", PT_UINT64, PF_DEC}, {"vm_size", PT_UINT32, PF_DEC}, {"vm_rss", PT_UINT32, PF_DEC}, {"vm_swap", PT_UINT32, PF_DEC}, {"comm", PT_CHARBUF, PF_NA}, {"cgroups", PT_BYTEBUF, PF_NA}, {"env", PT_BYTEBUF, PF_NA}, {"tty", PT_INT32, PF_DEC} } }
307309
};

‎driver/ppm_events_public.h‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -776,7 +776,9 @@ enum ppm_event_type {
776776
PPME_SYSCALL_RMDIR_2_X = 279,
777777
PPME_NOTIFICATION_E = 280,
778778
PPME_NOTIFICATION_X = 281,
779-
PPM_EVENT_MAX = 282
779+
PPME_SYSCALL_EXECVE_17_E = 282,
780+
PPME_SYSCALL_EXECVE_17_X = 283,
781+
PPM_EVENT_MAX = 284
780782
};
781783
/*@}*/
782784

‎driver/ppm_fillers.c‎

Lines changed: 61 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -34,6 +34,8 @@ along with sysdig. If not, see <http://www.gnu.org/licenses/>.
3434
#include <linux/version.h>
3535
#include <linux/module.h>
3636
#include <linux/quota.h>
37+
#include <linux/tty.h>
38+
#include <linux/uaccess.h>
3739
#ifdef CONFIG_CGROUPS
3840
#include <linux/cgroup.h>
3941
#endif
@@ -292,8 +294,8 @@ const struct ppm_event_entry g_ppm_events[PPM_EVENT_MAX] = {
292294
[PPME_DROP_X] = {f_sched_drop},
293295
[PPME_SYSCALL_FCNTL_E] = {f_sched_fcntl_e},
294296
[PPME_SYSCALL_FCNTL_X] = {f_sys_single_x},
295-
[PPME_SYSCALL_EXECVE_16_E] = {f_sys_empty},
296-
[PPME_SYSCALL_EXECVE_16_X] = {f_proc_startupdate},
297+
[PPME_SYSCALL_EXECVE_17_E] = {f_sys_empty},
298+
[PPME_SYSCALL_EXECVE_17_X] = {f_proc_startupdate},
297299
[PPME_SYSCALL_CLONE_20_E] = {f_sys_empty},
298300
[PPME_SYSCALL_CLONE_20_X] = {f_proc_startupdate},
299301
[PPME_SYSCALL_BRK_4_E] = {PPM_AUTOFILL, 1, APT_REG, {{0} } },
@@ -1011,6 +1013,52 @@ static int compat_accumulate_argv_or_env(compat_uptr_t argv,
10111013

10121014
#endif
10131015

1016+
static int ppm_get_tty(void)
1017+
{
1018+
/* Locking of the signal structures seems too complicated across
1019+
* multiple kernel versions to get it right, so simply do protected
1020+
* memory accesses, and in the worst case we get some garbage,
1021+
* which is not the end of the world. In the vast majority of accesses,
1022+
* we'll be just fine.
1023+
*/
1024+
struct signal_struct *sig;
1025+
struct tty_struct *tty;
1026+
struct tty_driver *driver;
1027+
int major;
1028+
int minor_start;
1029+
int index;
1030+
int tty_nr = 0;
1031+
1032+
sig = current->signal;
1033+
if (!sig)
1034+
return 0;
1035+
1036+
if (unlikely(probe_kernel_read(&tty, &sig->tty, sizeof(tty))))
1037+
return 0;
1038+
1039+
if (!tty)
1040+
return 0;
1041+
1042+
if (unlikely(probe_kernel_read(&index, &tty->index, sizeof(index))))
1043+
return 0;
1044+
1045+
if (unlikely(probe_kernel_read(&driver, &tty->driver, sizeof(driver))))
1046+
return 0;
1047+
1048+
if (!driver)
1049+
return 0;
1050+
1051+
if (unlikely(probe_kernel_read(&major, &driver->major, sizeof(major))))
1052+
return 0;
1053+
1054+
if (unlikely(probe_kernel_read(&minor_start, &driver->minor_start, sizeof(minor_start))))
1055+
return 0;
1056+
1057+
tty_nr = new_encode_dev(MKDEV(major, minor_start) + index);
1058+
1059+
return tty_nr;
1060+
}
1061+
10141062
static int f_proc_startupdate(struct event_filler_arguments *args)
10151063
{
10161064
unsigned long val;
@@ -1035,7 +1083,7 @@ static int f_proc_startupdate(struct event_filler_arguments *args)
10351083
return res;
10361084

10371085
if (unlikely(retval < 0 &&
1038-
args->event_type != PPME_SYSCALL_EXECVE_16_X)) {
1086+
args->event_type != PPME_SYSCALL_EXECVE_17_X)) {
10391087

10401088
/* The call failed, but this syscall has no exe, args
10411089
* anyway, so I report empty ones */
@@ -1311,11 +1359,12 @@ static int f_proc_startupdate(struct event_filler_arguments *args)
13111359
if (unlikely(res != PPM_SUCCESS))
13121360
return res;
13131361

1314-
} else if (args->event_type == PPME_SYSCALL_EXECVE_16_X) {
1362+
} else if (args->event_type == PPME_SYSCALL_EXECVE_17_X) {
13151363
/*
13161364
* execve-only parameters
13171365
*/
13181366
long env_len = 0;
1367+
int tty_nr = 0;
13191368

13201369
if (likely(retval >= 0)) {
13211370
/*
@@ -1357,6 +1406,14 @@ static int f_proc_startupdate(struct event_filler_arguments *args)
13571406
res = val_to_ring(args, (int64_t)(long)args->str_storage, env_len, false, 0);
13581407
if (unlikely(res != PPM_SUCCESS))
13591408
return res;
1409+
1410+
/*
1411+
* tty
1412+
*/
1413+
tty_nr = ppm_get_tty();
1414+
res = val_to_ring(args, tty_nr, 0, false, 0);
1415+
if (unlikely(res != PPM_SUCCESS))
1416+
return res;
13601417
}
13611418

13621419
return add_sentinel(args);

‎driver/syscall_table.c‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -52,7 +52,7 @@ const struct syscall_evt_pair g_syscall_table[SYSCALL_TABLE_SIZE] = {
5252
[__NR_brk - SYSCALL_TABLE_ID0] = {UF_USED | UF_ALWAYS_DROP, PPME_SYSCALL_BRK_4_E, PPME_SYSCALL_BRK_4_X},
5353
[__NR_read - SYSCALL_TABLE_ID0] = {UF_USED, PPME_SYSCALL_READ_E, PPME_SYSCALL_READ_X},
5454
[__NR_write - SYSCALL_TABLE_ID0] = {UF_USED, PPME_SYSCALL_WRITE_E, PPME_SYSCALL_WRITE_X},
55-
[__NR_execve - SYSCALL_TABLE_ID0] = {UF_USED | UF_NEVER_DROP, PPME_SYSCALL_EXECVE_16_E, PPME_SYSCALL_EXECVE_16_X},
55+
[__NR_execve - SYSCALL_TABLE_ID0] = {UF_USED | UF_NEVER_DROP, PPME_SYSCALL_EXECVE_17_E, PPME_SYSCALL_EXECVE_17_X},
5656
[__NR_clone - SYSCALL_TABLE_ID0] = {UF_USED | UF_NEVER_DROP, PPME_SYSCALL_CLONE_20_E, PPME_SYSCALL_CLONE_20_X},
5757
[__NR_fork - SYSCALL_TABLE_ID0] = {UF_USED | UF_NEVER_DROP, PPME_SYSCALL_FORK_20_E, PPME_SYSCALL_FORK_20_X},
5858
[__NR_vfork - SYSCALL_TABLE_ID0] = {UF_USED | UF_NEVER_DROP, PPME_SYSCALL_VFORK_20_E, PPME_SYSCALL_VFORK_20_X},
@@ -838,7 +838,7 @@ const struct syscall_evt_pair g_syscall_ia32_table[SYSCALL_TABLE_SIZE] = {
838838
[__NR_ia32_brk - SYSCALL_TABLE_ID0] = {UF_USED | UF_ALWAYS_DROP, PPME_SYSCALL_BRK_4_E, PPME_SYSCALL_BRK_4_X},
839839
[__NR_ia32_read - SYSCALL_TABLE_ID0] = {UF_USED, PPME_SYSCALL_READ_E, PPME_SYSCALL_READ_X},
840840
[__NR_ia32_write - SYSCALL_TABLE_ID0] = {UF_USED, PPME_SYSCALL_WRITE_E, PPME_SYSCALL_WRITE_X},
841-
[__NR_ia32_execve - SYSCALL_TABLE_ID0] = {UF_USED | UF_NEVER_DROP, PPME_SYSCALL_EXECVE_16_E, PPME_SYSCALL_EXECVE_16_X},
841+
[__NR_ia32_execve - SYSCALL_TABLE_ID0] = {UF_USED | UF_NEVER_DROP, PPME_SYSCALL_EXECVE_17_E, PPME_SYSCALL_EXECVE_17_X},
842842
[__NR_ia32_clone - SYSCALL_TABLE_ID0] = {UF_USED | UF_NEVER_DROP, PPME_SYSCALL_CLONE_20_E, PPME_SYSCALL_CLONE_20_X},
843843
[__NR_ia32_fork - SYSCALL_TABLE_ID0] = {UF_USED | UF_NEVER_DROP, PPME_SYSCALL_FORK_20_E, PPME_SYSCALL_FORK_20_X},
844844
[__NR_ia32_vfork - SYSCALL_TABLE_ID0] = {UF_USED | UF_NEVER_DROP, PPME_SYSCALL_VFORK_20_E, PPME_SYSCALL_VFORK_20_X},

‎userspace/libscap/event_table.c‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -303,5 +303,7 @@ const struct ppm_event_info g_event_info[PPM_EVENT_MAX] = {
303303
/* PPME_SYSCALL_RMDIR_2_E */{"rmdir", EC_FILE, EF_NONE, 0},
304304
/* PPME_SYSCALL_RMDIR_2_X */{"rmdir", EC_FILE, EF_NONE, 2, {{"res", PT_ERRNO, PF_DEC}, {"path", PT_FSPATH, PF_NA} } },
305305
/* PPME_NOTIFICATION_E */{"notification", EC_OTHER, EF_SKIPPARSERESET, 2, {{"id", PT_CHARBUF, PF_DEC}, {"desc", PT_CHARBUF, PF_NA}, } },
306-
/* PPME_NOTIFICATION_X */{"NA4", EC_SYSTEM, EF_UNUSED, 0}
306+
/* PPME_NOTIFICATION_X */{"NA4", EC_SYSTEM, EF_UNUSED, 0},
307+
/* PPME_SYSCALL_EXECVE_17_E */{"execve", EC_PROCESS, EF_MODIFIES_STATE, 0},
308+
/* PPME_SYSCALL_EXECVE_17_X */{"execve", EC_PROCESS, EF_MODIFIES_STATE, 17, {{"res", PT_ERRNO, PF_DEC}, {"exe", PT_CHARBUF, PF_NA}, {"args", PT_BYTEBUF, PF_NA}, {"tid", PT_PID, PF_DEC}, {"pid", PT_PID, PF_DEC}, {"ptid", PT_PID, PF_DEC}, {"cwd", PT_CHARBUF, PF_NA}, {"fdlimit", PT_UINT64, PF_DEC}, {"pgft_maj", PT_UINT64, PF_DEC}, {"pgft_min", PT_UINT64, PF_DEC}, {"vm_size", PT_UINT32, PF_DEC}, {"vm_rss", PT_UINT32, PF_DEC}, {"vm_swap", PT_UINT32, PF_DEC}, {"comm", PT_CHARBUF, PF_NA}, {"cgroups", PT_BYTEBUF, PF_NA}, {"env", PT_BYTEBUF, PF_NA}, {"tty", PT_INT32, PF_DEC} } }
307309
};

‎userspace/libscap/scap.h‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -220,6 +220,7 @@ typedef struct scap_threadinfo
220220
int filtered_out; ///< nonzero if this entry should not be saved to file
221221
scap_fdinfo* fdlist; ///< The fd table for this process
222222
uint64_t clone_ts;
223+
int32_t tty;
223224

224225
UT_hash_handle hh; ///< makes this structure hashable
225226
}scap_threadinfo;
@@ -888,7 +889,7 @@ int32_t scap_proc_add(scap_t* handle, uint64_t tid, scap_threadinfo* tinfo);
888889
int32_t scap_fd_add(scap_threadinfo* tinfo, uint64_t fd, scap_fdinfo* fdinfo);
889890
scap_dumper_t *scap_memory_dump_open(scap_t *handle, uint8_t* targetbuf, uint64_t targetbufsize);
890891
int32_t compr(uint8_t* dest, uint64_t* destlen, const uint8_t* source, uint64_t sourcelen, int level);
891-
uint8_t* scap_get_memorydumper_curpos(scap_dumper_t *d);
892+
uint8_t* scap_get_memorydumper_curpos(scap_dumper_t *d);
892893

893894
#ifdef __cplusplus
894895
}

‎userspace/libscap/scap_procs.c‎

Lines changed: 5 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -65,6 +65,7 @@ int32_t scap_proc_fill_info_from_stats(char* procdirname, struct scap_threadinfo
6565
uint32_t vmswap_kb;
6666
uint64_t pfmajor;
6767
uint64_t pfminor;
68+
int32_t tty;
6869
char line[512];
6970
char tmpc;
7071
char* s;
@@ -78,6 +79,7 @@ int32_t scap_proc_fill_info_from_stats(char* procdirname, struct scap_threadinfo
7879
tinfo->pfmajor = 0;
7980
tinfo->pfminor = 0;
8081
tinfo->filtered_out = 0;
82+
tinfo->tty = 0;
8183

8284
snprintf(filename, sizeof(filename), "%sstatus", procdirname);
8385

@@ -230,12 +232,12 @@ int32_t scap_proc_fill_info_from_stats(char* procdirname, struct scap_threadinfo
230232
//
231233
// Extract the line content
232234
//
233-
if(sscanf(s + 2, "%c %" PRId64 " %" PRId64 " %" PRId64 " %" PRId64 " %" PRId64 " %" PRId64 " %" PRId64 " %" PRId64 " %" PRId64,
235+
if(sscanf(s + 2, "%c %" PRId64 " %" PRId64 " %" PRId64 " %" PRId32 " %" PRId64 " %" PRId64 " %" PRId64 " %" PRId64 " %" PRId64,
234236
&tmpc,
235237
&tmp,
236238
&sid,
237239
&tmp,
238-
&tmp,
240+
&tty,
239241
&tmp,
240242
&tmp,
241243
&pfminor,
@@ -250,6 +252,7 @@ int32_t scap_proc_fill_info_from_stats(char* procdirname, struct scap_threadinfo
250252
tinfo->pfmajor = pfmajor;
251253
tinfo->pfminor = pfminor;
252254
tinfo->sid = (uint64_t) sid;
255+
tinfo->tty = tty;
253256

254257
fclose(f);
255258
return SCAP_SUCCESS;

‎userspace/libscap/scap_savefile.c‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -950,7 +950,8 @@ static int32_t scap_read_proclist(scap_t *handle, gzFile f, uint32_t block_lengt
950950
tinfo.root[0] = 0;
951951
tinfo.sid = -1;
952952
tinfo.clone_ts = 0;
953-
953+
tinfo.tty = 0;
954+
954955
while(((int32_t)block_length - (int32_t)totreadsize) >= 4)
955956
{
956957
//

‎userspace/libsinsp/parsers.cpp‎

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -335,6 +335,7 @@ void sinsp_parser::process_event(sinsp_evt *evt)
335335
case PPME_SYSCALL_EXECVE_14_X:
336336
case PPME_SYSCALL_EXECVE_15_X:
337337
case PPME_SYSCALL_EXECVE_16_X:
338+
case PPME_SYSCALL_EXECVE_17_X:
338339
parse_execve_exit(evt);
339340
break;
340341
case PPME_PROCEXIT_E:
@@ -1116,6 +1117,8 @@ void sinsp_parser::parse_clone_exit(sinsp_evt *evt)
11161117

11171118
// Copy the session id from the parent
11181119
tinfo.m_sid = ptinfo->m_sid;
1120+
1121+
tinfo.m_tty = ptinfo->m_tty;
11191122
}
11201123
else
11211124
{
@@ -1148,6 +1151,7 @@ void sinsp_parser::parse_clone_exit(sinsp_evt *evt)
11481151
tinfo.m_args = ptinfo->m_args;
11491152
tinfo.m_root = ptinfo->m_root;
11501153
tinfo.m_sid = ptinfo->m_sid;
1154+
tinfo.m_tty = ptinfo->m_tty;
11511155
}
11521156
else
11531157
{
@@ -1489,6 +1493,7 @@ void sinsp_parser::parse_execve_exit(sinsp_evt *evt)
14891493
break;
14901494
case PPME_SYSCALL_EXECVE_15_X:
14911495
case PPME_SYSCALL_EXECVE_16_X:
1496+
case PPME_SYSCALL_EXECVE_17_X:
14921497
// Get the comm
14931498
parinfo = evt->get_param(13);
14941499
evt->m_tinfo->m_comm = parinfo->m_val;
@@ -1519,6 +1524,7 @@ void sinsp_parser::parse_execve_exit(sinsp_evt *evt)
15191524
case PPME_SYSCALL_EXECVE_14_X:
15201525
case PPME_SYSCALL_EXECVE_15_X:
15211526
case PPME_SYSCALL_EXECVE_16_X:
1527+
case PPME_SYSCALL_EXECVE_17_X:
15221528
// Get the pgflt_maj
15231529
parinfo = evt->get_param(8);
15241530
ASSERT(parinfo->m_len == sizeof(uint64_t));
@@ -1564,6 +1570,7 @@ void sinsp_parser::parse_execve_exit(sinsp_evt *evt)
15641570
evt->m_tinfo->set_env(parinfo->m_val, parinfo->m_len);
15651571
break;
15661572
case PPME_SYSCALL_EXECVE_16_X:
1573+
case PPME_SYSCALL_EXECVE_17_X:
15671574
// Get the environment
15681575
parinfo = evt->get_param(15);
15691576
evt->m_tinfo->set_env(parinfo->m_val, parinfo->m_len);
@@ -1588,6 +1595,25 @@ void sinsp_parser::parse_execve_exit(sinsp_evt *evt)
15881595
ASSERT(false);
15891596
}
15901597

1598+
switch(etype)
1599+
{
1600+
case PPME_SYSCALL_EXECVE_8_X:
1601+
case PPME_SYSCALL_EXECVE_13_X:
1602+
case PPME_SYSCALL_EXECVE_14_X:
1603+
case PPME_SYSCALL_EXECVE_15_X:
1604+
case PPME_SYSCALL_EXECVE_16_X:
1605+
break;
1606+
case PPME_SYSCALL_EXECVE_17_X:
1607+
// Get the tty
1608+
parinfo = evt->get_param(16);
1609+
ASSERT(parinfo->m_len == sizeof(int32_t));
1610+
evt->m_tinfo->m_tty = *(int32_t *) parinfo->m_val;
1611+
break;
1612+
default:
1613+
ASSERT(false);
1614+
}
1615+
1616+
15911617
//
15921618
// execve starts with a clean fd list, so we get rid of the fd list that clone
15931619
// copied from the parent

0 commit comments

Comments
 (0)