Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Reworked trace-loop & adding support for the 27 syscalls from 424 to 450 #26

Merged
merged 5 commits into from
Aug 21, 2023
Merged

Reworked trace-loop & adding support for the 27 syscalls from 424 to 450 #26

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
4117427
Refactoring the main trace-loop and adding support for the 27 syscall…
tramasys Aug 17, 2023
9e4312e
Removing unused macro
tramasys Aug 17, 2023
13250dc
Properly break the tracing-loop on SIGKILL
tramasys Aug 17, 2023
16ceed4
Some cleanup & primitive signal forwarding
tramasys Aug 18, 2023
c56ff19
Minor cleanup & SoC of register functions
tramasys Aug 19, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
60 changes: 43 additions & 17 deletions src/arch/mod.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -94,27 +94,53 @@ pub fn read_string(pid: Pid, address: c_ulonglong) -> String {
string
}

pub fn enable_follow_forks(pid: Pid) -> nix::Result<()> {
pub fn ptrace_init_options(pid: Pid) -> nix::Result<()> {
ptrace::setoptions(
pid,
Options::PTRACE_O_TRACEFORK | Options::PTRACE_O_TRACEVFORK | Options::PTRACE_O_TRACECLONE,
Options::PTRACE_O_TRACESYSGOOD
| Options::PTRACE_O_TRACEEXIT
| Options::PTRACE_O_TRACEEXEC,
)
}

pub fn parse_args(pid: Pid, syscall: Sysno, registers: user_regs_struct) -> SyscallArgs {
#[allow(clippy::cast_sign_loss)]
SyscallArgs(
SYSCALLS[syscall.id() as usize]
.1
.iter()
.filter_map(Option::as_ref)
.enumerate()
.map(|(idx, arg)| (arg, get_arg_value(registers, idx)))
.map(|(arg, value)| match arg {
SyscallArgType::Int => SyscallArg::Int(value as i64),
SyscallArgType::Str => SyscallArg::Str(read_string(pid, value)),
SyscallArgType::Addr => SyscallArg::Addr(value as usize),
})
.collect(),
pub fn ptrace_init_options_fork(pid: Pid) -> nix::Result<()> {
ptrace::setoptions(
pid,
Options::PTRACE_O_TRACESYSGOOD
| Options::PTRACE_O_TRACEEXIT
| Options::PTRACE_O_TRACEEXEC
| Options::PTRACE_O_TRACEFORK
| Options::PTRACE_O_TRACEVFORK
| Options::PTRACE_O_TRACECLONE,
)
}

#[allow(clippy::cast_sign_loss)]
#[must_use]
// SAFTEY: In get_register_data we make sure that the syscall number will never be negative.
pub fn parse_args(pid: Pid, syscall: Sysno, registers: user_regs_struct) -> SyscallArgs {
SYSCALLS
.get(syscall.id() as usize)
.and_then(|option| option.as_ref())
.map_or_else(
|| SyscallArgs(vec![]),
|(_, args)| {
SyscallArgs(
args.iter()
.filter_map(Option::as_ref)
.enumerate()
.map(|(idx, arg_type)| map_arg(pid, registers, idx, *arg_type))
.collect(),
)
},
)
}

fn map_arg(pid: Pid, registers: user_regs_struct, idx: usize, arg: SyscallArgType) -> SyscallArg {
let value = get_arg_value(registers, idx);
match arg {
SyscallArgType::Int => SyscallArg::Int(value as i64),
SyscallArgType::Str => SyscallArg::Str(read_string(pid, value)),
SyscallArgType::Addr => SyscallArg::Addr(value as usize),
}
}
145 changes: 135 additions & 10 deletions src/arch/x86_64.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -227,6 +227,7 @@ pub static TRACE_SIGNAL: SysnoSet = SysnoSet::new(&[
signalfd,
signalfd4,
rt_tgsigqueueinfo,
pidfd_send_signal,
]);

pub static TRACE_MEMORY: SysnoSet = SysnoSet::new(&[
Expand Down Expand Up @@ -285,33 +286,33 @@ pub static TRACE_CLOCK: SysnoSet = SysnoSet::new(&[

macro_rules! syscall {
($name:ident $(,)?) => {
(Sysno::$name, [None, None, None, None, None, None])
Some((Sysno::$name, [None, None, None, None, None, None]))
};
($name:ident, $arg0:ident $(,)?) => {
(Sysno::$name, [$arg0, None, None, None, None, None])
Some((Sysno::$name, [$arg0, None, None, None, None, None]))
};
($name:ident, $arg0:ident, $arg1:ident $(,)?) => {
(Sysno::$name, [$arg0, $arg1, None, None, None, None])
Some((Sysno::$name, [$arg0, $arg1, None, None, None, None]))
};
($name:ident, $arg0:ident, $arg1:ident, $arg2:ident $(,)?) => {
(Sysno::$name, [$arg0, $arg1, $arg2, None, None, None])
Some((Sysno::$name, [$arg0, $arg1, $arg2, None, None, None]))
};
($name:ident, $arg0:ident, $arg1:ident, $arg2:ident, $arg3:ident $(,)?) => {
(Sysno::$name, [$arg0, $arg1, $arg2, $arg3, None, None])
Some((Sysno::$name, [$arg0, $arg1, $arg2, $arg3, None, None]))
};
($name:ident, $arg0:ident, $arg1:ident, $arg2:ident, $arg3:ident, $arg4:ident $(,)?) => {
(Sysno::$name, [$arg0, $arg1, $arg2, $arg3, $arg4, None])
Some((Sysno::$name, [$arg0, $arg1, $arg2, $arg3, $arg4, None]))
};
($name:ident, $arg0:ident, $arg1:ident, $arg2:ident, $arg3:ident, $arg4:ident, $arg5:ident $(,)?) => {
(Sysno::$name, [$arg0, $arg1, $arg2, $arg3, $arg4, $arg5])
Some((Sysno::$name, [$arg0, $arg1, $arg2, $arg3, $arg4, $arg5]))
};
}

const ADDR: Option<SyscallArgType> = Some(SyscallArgType::Addr);
const INT: Option<SyscallArgType> = Some(SyscallArgType::Int);
const STR: Option<SyscallArgType> = Some(SyscallArgType::Str);

pub static SYSCALLS: [(Sysno, [Option<SyscallArgType>; 6]); 335] = [
pub static SYSCALLS: [Option<(Sysno, [Option<SyscallArgType>; 6])>; 451] = [
// DESC
syscall!(read, INT, STR, INT),
// DESC
Expand Down Expand Up @@ -888,6 +889,127 @@ pub static SYSCALLS: [(Sysno, [Option<SyscallArgType>; 6]); 335] = [
syscall!(statx, INT, STR, INT, INT, STR),
syscall!(io_pgetevents),
syscall!(rseq),
// We jump from syscall number 334 to 424 here
// See: https://git.musl-libc.org/cgit/musl/commit/?id=f3f96f2daa4d00f0e38489fb465cd0244b531abe
// https://github.com/torvalds/linux/commit/0d6040d4681735dfc47565de288525de405a5c99
None,
None,
None,
None,
None,
None,
None,
None,
None,
None,
None,
None,
None,
None,
None,
None,
None,
None,
None,
None,
None,
None,
None,
None,
None,
None,
None,
None,
None,
None,
None,
None,
None,
None,
None,
None,
None,
None,
None,
None,
None,
None,
None,
None,
None,
None,
None,
None,
None,
None,
None,
None,
None,
None,
None,
None,
None,
None,
None,
None,
None,
None,
None,
None,
None,
None,
None,
None,
None,
None,
None,
None,
None,
None,
None,
None,
None,
None,
None,
None,
None,
None,
None,
None,
None,
None,
None,
None,
None,
syscall!(pidfd_send_signal, INT, INT, ADDR, INT),
syscall!(io_uring_setup, INT, ADDR),
syscall!(io_uring_enter, INT, INT, INT, INT, ADDR, INT),
syscall!(io_uring_register, INT, INT, ADDR, INT),
syscall!(open_tree, INT, STR, INT),
syscall!(move_mount, INT, STR, INT, STR, INT),
syscall!(fsopen, STR, INT),
syscall!(fsconfig, INT, INT, STR, ADDR, INT),
syscall!(fsmount, INT, INT, INT),
syscall!(fspick, INT, STR, INT),
syscall!(pidfd_open, INT, INT),
syscall!(clone3, ADDR, INT),
syscall!(close_range, INT, INT, INT),
syscall!(openat2, INT, STR, ADDR, INT),
syscall!(pidfd_getfd, INT, INT, INT),
syscall!(faccessat2, INT, STR, INT, INT),
syscall!(process_madvise, INT, ADDR, INT, INT, INT),
syscall!(epoll_pwait2, INT, ADDR, INT, ADDR, ADDR, INT),
syscall!(mount_setattr, INT, STR, INT, ADDR, INT),
syscall!(quotactl_fd, INT, INT, INT, ADDR),
syscall!(landlock_create_ruleset, ADDR, INT, INT),
syscall!(landlock_add_rule, INT, INT, ADDR, INT),
syscall!(landlock_restrict_self, INT, INT),
syscall!(memfd_secret, INT),
syscall!(process_mrelease, INT, INT),
syscall!(futex_waitv, ADDR, INT, INT, ADDR, INT),
syscall!(set_mempolicy_home_node, INT, INT, INT, INT),
// 451 - cachestat not yet implemented by the syscall crate
// syscall!(cachestat, INT, INT, INT, INT)
];

pub fn get_arg_value(registers: user_regs_struct, i: usize) -> c_ulonglong {
Expand All @@ -908,9 +1030,12 @@ mod tests {
use super::*;

#[test]
#[allow(clippy::cast_sign_loss)]
fn test_syscall_numbers() {
for (i, (sysno, ..)) in SYSCALLS.iter().enumerate() {
assert_eq!(i, sysno.id() as usize);
for (i, sysno, ..) in SYSCALLS.iter().enumerate() {
if let Some((sysno, _)) = sysno {
assert_eq!(i, sysno.id() as usize);
}
}
}
}
Loading