mirror of
https://git.hardenedbsd.org/hardenedbsd/HardenedBSD.git
synced 2024-12-26 21:13:11 +01:00
245 lines
6.9 KiB
Bash
Executable File
245 lines
6.9 KiB
Bash
Executable File
#!/bin/sh
|
|
#
|
|
# opensnoop - snoop file opens as they occur.
|
|
# Written using DTrace (Solaris 10 3/05).
|
|
#
|
|
# $Id: opensnoop 3 2007-08-01 10:50:08Z brendan $
|
|
#
|
|
# USAGE: opensnoop [-a|-A|-ceghsvxZ] [-f pathname] [-n name] [-p PID]
|
|
#
|
|
# opensnoop # default output
|
|
#
|
|
# -a # print most data
|
|
# -A # dump all data, space delimited
|
|
# -c # print cwd of process
|
|
# -e # print errno value
|
|
# -g # print command arguments
|
|
# -s # print start time, us
|
|
# -v # print start time, string
|
|
# -x # only print failed opens
|
|
# -Z # print zonename
|
|
# -f pathname # file pathname to snoop
|
|
# -n name # command name to snoop
|
|
# -p PID # process ID to snoop
|
|
# eg,
|
|
# opensnoop -v # human readable timestamps
|
|
# opensnoop -e # see error codes
|
|
# opensnoop -f /etc/passwd # snoop this file only
|
|
#
|
|
# FIELDS:
|
|
# ZONE Zone name
|
|
# UID User ID
|
|
# PID Process ID
|
|
# PPID Parent Process ID
|
|
# FD file descriptor (-1 for error)
|
|
# ERR errno value (see /usr/include/sys/errno.h)
|
|
# CWD print current working directory of process
|
|
# PATH pathname for file open
|
|
# COMM command name for the process
|
|
# ARGS argument listing for the process
|
|
# TIME timestamp for the open event, us
|
|
# STRTIME timestamp for the open event, string
|
|
#
|
|
# SEE ALSO: truss, BSM auditing.
|
|
#
|
|
# COPYRIGHT: Copyright (c) 2006 Brendan Gregg.
|
|
#
|
|
# CDDL HEADER START
|
|
#
|
|
# The contents of this file are subject to the terms of the
|
|
# Common Development and Distribution License, Version 1.0 only
|
|
# (the "License"). You may not use this file except in compliance
|
|
# with the License.
|
|
#
|
|
# You can obtain a copy of the license at Docs/cddl1.txt
|
|
# or http://www.opensolaris.org/os/licensing.
|
|
# See the License for the specific language governing permissions
|
|
# and limitations under the License.
|
|
#
|
|
# CDDL HEADER END
|
|
#
|
|
# Author: Brendan Gregg [Sydney, Australia]
|
|
#
|
|
# 09-May-2004 Brendan Gregg Created this.
|
|
# 21-Jan-2005 " " Wrapped in sh to provide options.
|
|
# 08-May-2005 " " Rewritten for performance.
|
|
# 14-May-2005 " " Added errno.
|
|
# 28-Jun-2005 " " Added cwd, zonename.
|
|
# 17-Sep-2005 " " Increased switchrate, fixed page fault bug.
|
|
# 16-Jan-2006 " " Added -n, -p.
|
|
# 16-Jan-2006 " " Last update.
|
|
#
|
|
|
|
|
|
##############################
|
|
# --- Process Arguments ---
|
|
#
|
|
|
|
### Default variables
|
|
opt_dump=0; opt_file=0; opt_time=0; opt_timestr=0; opt_args=0
|
|
opt_zone=0; opt_cwd=0; opt_failonly=0; opt_err=0; filter=0; pathname=.
|
|
opt_name=0; opt_pid=0; pname=.; pid=0
|
|
|
|
### Process options
|
|
while getopts aAcef:ghn:p:svxZ name
|
|
do
|
|
case $name in
|
|
a) opt_time=1; opt_timestr=1; opt_args=1; opt_err=1 ;;
|
|
A) opt_dump=1 ;;
|
|
c) opt_cwd=1 ;;
|
|
e) opt_err=1 ;;
|
|
g) opt_args=1 ;;
|
|
f) opt_file=1; pathname=$OPTARG ;;
|
|
n) opt_name=1; pname=$OPTARG ;;
|
|
p) opt_pid=1; pid=$OPTARG ;;
|
|
s) opt_time=1 ;;
|
|
v) opt_timestr=1 ;;
|
|
x) opt_failonly=1 ;;
|
|
Z) opt_zone=1 ;;
|
|
h|?) cat <<-END >&2
|
|
USAGE: opensnoop [-a|-A|-ceghsvxZ] [-f pathname]
|
|
[-n name] [-p PID]
|
|
opensnoop # default output
|
|
-a # print most data
|
|
-A # dump all data, space delimited
|
|
-c # print cwd of process
|
|
-e # print errno value
|
|
-g # print command arguments
|
|
-s # print start time, us
|
|
-v # print start time, string
|
|
-x # only print failed opens
|
|
-Z # print zonename
|
|
-f pathname # pathname name to snoop
|
|
-n name # process name to snoop
|
|
-p PID # process ID to snoop
|
|
eg,
|
|
opensnoop -v # human readable timestamps
|
|
opensnoop -e # see error codes
|
|
opensnoop -f /etc/motd # snoop this file only
|
|
END
|
|
exit 1
|
|
esac
|
|
done
|
|
|
|
### Option logic
|
|
if [ $opt_dump -eq 1 ]; then
|
|
opt_zone=0; opt_cwd=0; opt_time=0; opt_timestr=0; opt_args=2
|
|
fi
|
|
if [ $opt_name -eq 1 -o $opt_pid -eq 1 ]; then
|
|
filter=1
|
|
fi
|
|
|
|
|
|
#################################
|
|
# --- Main Program, DTrace ---
|
|
#
|
|
/usr/sbin/dtrace -n '
|
|
/*
|
|
* Command line arguments
|
|
*/
|
|
inline int OPT_dump = '$opt_dump';
|
|
inline int OPT_file = '$opt_file';
|
|
inline int OPT_args = '$opt_args';
|
|
inline int OPT_cwd = '$opt_cwd';
|
|
inline int OPT_err = '$opt_err';
|
|
inline int OPT_zone = '$opt_zone';
|
|
inline int OPT_time = '$opt_time';
|
|
inline int OPT_timestr = '$opt_timestr';
|
|
inline int OPT_failonly = '$opt_failonly';
|
|
inline int OPT_pid = '$opt_pid';
|
|
inline int OPT_name = '$opt_name';
|
|
inline int FILTER = '$filter';
|
|
inline int PID = '$pid';
|
|
inline string PATHNAME = "'$pathname'";
|
|
inline string NAME = "'$pname'";
|
|
|
|
#pragma D option quiet
|
|
#pragma D option switchrate=10hz
|
|
|
|
/*
|
|
* Print header
|
|
*/
|
|
dtrace:::BEGIN
|
|
{
|
|
/*
|
|
* ternary operators are used to improve performance.
|
|
* OPT_args is unusual in that it can have one of three values.
|
|
*/
|
|
|
|
/* print optional headers */
|
|
OPT_time ? printf("%-14s ", "TIME") : 1;
|
|
OPT_timestr ? printf("%-20s ", "STRTIME") : 1;
|
|
OPT_zone ? printf("%-10s ", "ZONE") : 1;
|
|
|
|
/* print dump headers */
|
|
OPT_dump ? printf("%s %s %s %s %s %s %s %s %s %s %s", "ZONE",
|
|
"TIME", "UID", "PID", "PPID", "COMM", "FD", "ERR", "CWD",
|
|
"PATH", "ARGS") : printf("%5s %6s ","UID","PID");
|
|
|
|
/* print main headers */
|
|
OPT_args == 0 ? printf("%-12s ", "COMM") : 1;
|
|
OPT_dump == 0 ? printf("%3s ", "FD") : 1;
|
|
OPT_err ? printf("%3s ", "ERR") : 1;
|
|
OPT_cwd ? printf("%-20s ", "CWD") : 1;
|
|
OPT_dump == 0 ? printf("%-20s ", "PATH") : 1;
|
|
OPT_args == 1 ? printf("%s", "ARGS") : 1;
|
|
printf("\n");
|
|
}
|
|
|
|
/*
|
|
* Print open event
|
|
*/
|
|
syscall::open:entry
|
|
{
|
|
/* save pathname */
|
|
self->pathp = arg0;
|
|
|
|
/* default is to trace unless filtering */
|
|
self->ok = FILTER ? 0 : 1;
|
|
|
|
/* check each filter */
|
|
(OPT_name == 1 && NAME == execname) ? self->ok = 1 : 1;
|
|
(OPT_pid == 1 && PID == pid) ? self->ok = 1 : 1;
|
|
/* OPT_file is checked on return to ensure pathp is mapped */
|
|
}
|
|
|
|
syscall::open:return
|
|
/self->ok && (! OPT_failonly || (int)arg0 < 0) &&
|
|
((OPT_file == 0) || (OPT_file == 1 && PATHNAME == copyinstr(self->pathp)))/
|
|
{
|
|
/* print optional fields */
|
|
OPT_time ? printf("%-14d ", timestamp/1000) : 1;
|
|
OPT_timestr ? printf("%-20Y ", walltimestamp) : 1;
|
|
OPT_zone ? printf("%-10s ", zonename) : 1;
|
|
|
|
/* print dump fields */
|
|
OPT_dump ? printf("%s %d %d %d %d %s %d %d %s %s %S", zonename,
|
|
timestamp/1000, uid, pid, ppid, execname, (int)arg0, errno,
|
|
cwd, copyinstr(self->pathp), curpsinfo->pr_psargs) :
|
|
printf("%5d %6d ", uid, pid);
|
|
|
|
/* print main fields */
|
|
OPT_args == 0 ? printf("%-12s ", execname) : 1;
|
|
OPT_dump == 0 ? printf("%3d ", (int)arg0) : 1;
|
|
OPT_err ? printf("%3d ", errno) : 1;
|
|
OPT_cwd ? printf("%-20s ", cwd) : 1;
|
|
OPT_dump == 0 ? printf("%-20s ", copyinstr(self->pathp)) : 1;
|
|
OPT_args == 1 ? printf("%S", curpsinfo->pr_psargs) : 1;
|
|
printf("\n");
|
|
|
|
/* cleanup */
|
|
self->pathp = 0;
|
|
self->ok = 0;
|
|
}
|
|
|
|
/*
|
|
* Cleanup
|
|
*/
|
|
syscall::open:return
|
|
/self->ok/
|
|
{
|
|
self->pathp = 0;
|
|
self->ok = 0;
|
|
}
|
|
'
|