1 | /* SAMHAIN file system integrity testing */
|
---|
2 | /* Copyright (C) 2006 Rainer Wichmann */
|
---|
3 | /* */
|
---|
4 | /* This program is free software; you can redistribute it */
|
---|
5 | /* and/or modify */
|
---|
6 | /* it under the terms of the GNU General Public License as */
|
---|
7 | /* published by */
|
---|
8 | /* the Free Software Foundation; either version 2 of the License, or */
|
---|
9 | /* (at your option) any later version. */
|
---|
10 | /* */
|
---|
11 | /* This program is distributed in the hope that it will be useful, */
|
---|
12 | /* but WITHOUT ANY WARRANTY; without even the implied warranty of */
|
---|
13 | /* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the */
|
---|
14 | /* GNU General Public License for more details. */
|
---|
15 | /* */
|
---|
16 | /* You should have received a copy of the GNU General Public License */
|
---|
17 | /* along with this program; if not, write to the Free Software */
|
---|
18 | /* Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA. */
|
---|
19 |
|
---|
20 | /***************************************************************************
|
---|
21 | *
|
---|
22 | * This file provides a module for samhain to check for hidden/faked/missing
|
---|
23 | * processes on the host.
|
---|
24 | *
|
---|
25 | */
|
---|
26 |
|
---|
27 | #include "config_xor.h"
|
---|
28 |
|
---|
29 | #define _XOPEN_SOURCE 500
|
---|
30 |
|
---|
31 | #include <stdio.h>
|
---|
32 | #include <stdlib.h>
|
---|
33 | #include <ctype.h>
|
---|
34 | #include <string.h>
|
---|
35 | #include <sys/types.h>
|
---|
36 | #include <dirent.h>
|
---|
37 | #include <sys/stat.h>
|
---|
38 | #include <signal.h>
|
---|
39 | #include <unistd.h>
|
---|
40 |
|
---|
41 | #ifdef _POSIX_PRIORITY_SCHEDULING
|
---|
42 | #include <sched.h>
|
---|
43 | #endif
|
---|
44 |
|
---|
45 | #ifdef HAVE_GETPRIORITY
|
---|
46 | #include <errno.h>
|
---|
47 | #include <sys/resource.h>
|
---|
48 | #endif
|
---|
49 |
|
---|
50 | #ifdef HAVE_SYS_STATVFS_H
|
---|
51 | #include <sys/statvfs.h>
|
---|
52 | #endif
|
---|
53 |
|
---|
54 |
|
---|
55 | #ifdef HAVE_REGEX_H
|
---|
56 | #include <regex.h>
|
---|
57 | #endif
|
---|
58 |
|
---|
59 | #include "samhain.h"
|
---|
60 | #include "sh_modules.h"
|
---|
61 | #include "sh_processcheck.h"
|
---|
62 | #include "sh_utils.h"
|
---|
63 | #include "sh_error.h"
|
---|
64 | #include "sh_extern.h"
|
---|
65 | #include "sh_calls.h"
|
---|
66 | #include "sh_pthread.h"
|
---|
67 |
|
---|
68 | #ifdef SH_USE_PROCESSCHECK
|
---|
69 |
|
---|
70 | #define FIL__ _("sh_processcheck.c")
|
---|
71 |
|
---|
72 | #ifdef __linux__
|
---|
73 | #define PS_THREADS
|
---|
74 | #endif
|
---|
75 |
|
---|
76 | /* We won't want to build this into yule
|
---|
77 | */
|
---|
78 | #if defined (SH_WITH_CLIENT) || defined (SH_STANDALONE)
|
---|
79 |
|
---|
80 | SH_MUTEX_STATIC(mutex_proc_check, PTHREAD_MUTEX_INITIALIZER);
|
---|
81 |
|
---|
82 | /* sh_prochk_maxpid is one more than the largest pid
|
---|
83 | */
|
---|
84 | static size_t sh_prochk_minpid = 0x0001;
|
---|
85 | static size_t sh_prochk_maxpid = 0x8000;
|
---|
86 | static size_t sh_prochk_size = 0;
|
---|
87 |
|
---|
88 | static int ShProchkActive = S_TRUE;
|
---|
89 | static short * sh_prochk_res = NULL;
|
---|
90 |
|
---|
91 | static char * sh_prochk_pspath = NULL;
|
---|
92 | static char * sh_prochk_psarg = NULL;
|
---|
93 |
|
---|
94 | #define SH_PROCHK_INTERVAL 300
|
---|
95 | static time_t sh_prochk_interval = SH_PROCHK_INTERVAL;
|
---|
96 | static int sh_prochk_severity = SH_ERR_SEVERE;
|
---|
97 | static int sh_prochk_openvz = S_FALSE;
|
---|
98 |
|
---|
99 | static int sh_prochk_set_maxpid (const char * str);
|
---|
100 | static int sh_prochk_set_minpid (const char * str);
|
---|
101 | static int sh_prochk_set_active (const char *str);
|
---|
102 | static int sh_prochk_add_process (const char *str);
|
---|
103 | static int sh_prochk_set_pspath (const char *str);
|
---|
104 | static int sh_prochk_set_psarg (const char *str);
|
---|
105 | static int sh_prochk_set_interval(const char *str);
|
---|
106 | static int sh_prochk_set_severity(const char *str);
|
---|
107 | static int sh_prochk_set_openvz (const char *str);
|
---|
108 |
|
---|
109 | sh_rconf sh_prochk_table[] = {
|
---|
110 | {
|
---|
111 | N_("severityprocesscheck"),
|
---|
112 | sh_prochk_set_severity,
|
---|
113 | },
|
---|
114 | {
|
---|
115 | N_("processcheckexists"),
|
---|
116 | sh_prochk_add_process,
|
---|
117 | },
|
---|
118 | {
|
---|
119 | N_("processcheckactive"),
|
---|
120 | sh_prochk_set_active,
|
---|
121 | },
|
---|
122 | {
|
---|
123 | N_("processcheckminpid"),
|
---|
124 | sh_prochk_set_minpid,
|
---|
125 | },
|
---|
126 | {
|
---|
127 | N_("processcheckmaxpid"),
|
---|
128 | sh_prochk_set_maxpid,
|
---|
129 | },
|
---|
130 | {
|
---|
131 | N_("processcheckpspath"),
|
---|
132 | sh_prochk_set_pspath,
|
---|
133 | },
|
---|
134 | {
|
---|
135 | N_("processcheckpsarg"),
|
---|
136 | sh_prochk_set_psarg,
|
---|
137 | },
|
---|
138 | {
|
---|
139 | N_("processcheckinterval"),
|
---|
140 | sh_prochk_set_interval,
|
---|
141 | },
|
---|
142 | {
|
---|
143 | N_("processcheckisopenvz"),
|
---|
144 | sh_prochk_set_openvz,
|
---|
145 | },
|
---|
146 | {
|
---|
147 | NULL,
|
---|
148 | NULL
|
---|
149 | }
|
---|
150 | };
|
---|
151 |
|
---|
152 | #define SH_PROC_MISSING 1
|
---|
153 | #define SH_PROC_FAKED 2
|
---|
154 | #define SH_PROC_HIDDEN 4
|
---|
155 | #define SH_PROC_EXISTS 8
|
---|
156 |
|
---|
157 | #ifndef HAVE_LSTAT
|
---|
158 | #define lstat(x,y) stat(x,y)
|
---|
159 | #endif /* HAVE_LSTAT */
|
---|
160 |
|
---|
161 | #if defined(S_IFLNK) && !defined(S_ISLNK)
|
---|
162 | #define S_ISLNK(mode) (((mode) & S_IFMT) == S_IFLNK)
|
---|
163 | #else
|
---|
164 | #if !defined(S_ISLNK)
|
---|
165 | #define S_ISLNK(mode) (0)
|
---|
166 | #endif
|
---|
167 | #endif
|
---|
168 |
|
---|
169 | static const short SH_PR_PS = 0x0001;
|
---|
170 |
|
---|
171 | static const short SH_PR_GETSID = 0x0002;
|
---|
172 | static const short SH_PR_KILL = 0x0004;
|
---|
173 | static const short SH_PR_GETPGID = 0x0008;
|
---|
174 |
|
---|
175 | static const short SH_PR_LSTAT = 0x0010;
|
---|
176 | static const short SH_PR_OPENDIR = 0x0020;
|
---|
177 | static const short SH_PR_CHDIR = 0x0040;
|
---|
178 | static const short SH_PR_SCHED = 0x0080;
|
---|
179 |
|
---|
180 | static const short SH_PR_PRIORITY = 0x0100;
|
---|
181 | static const short SH_PR_STATVSF = 0x0200;
|
---|
182 |
|
---|
183 | static const short SH_PR_PS2 = 0x1000;
|
---|
184 | static const short SH_PR_PS_ANY = 0x2000;
|
---|
185 | static const short SH_PR_ALL = 0x4000;
|
---|
186 | static const short SH_PR_ANY = 0x8000;
|
---|
187 |
|
---|
188 | /* /proc:
|
---|
189 | * linux: /proc/pid/exe
|
---|
190 | * freebsd: /proc/pid/file
|
---|
191 | * solaris10: /proc/pid/path/a.out
|
---|
192 | */
|
---|
193 | static char * get_user_and_path (pid_t pid, char * user, size_t usrlen)
|
---|
194 | {
|
---|
195 | extern char * sh_unix_getUIDname (int level, uid_t uid, char * out, size_t len);
|
---|
196 |
|
---|
197 | char path[128];
|
---|
198 | char * buf;
|
---|
199 | struct stat sbuf;
|
---|
200 | int len;
|
---|
201 | char * tmp;
|
---|
202 |
|
---|
203 | sl_snprintf (path, sizeof(path), _("/proc/%ld/exe"), (unsigned long) pid);
|
---|
204 |
|
---|
205 | if (0 == retry_lstat(FIL__, __LINE__, path, &sbuf) && S_ISLNK(sbuf.st_mode))
|
---|
206 | {
|
---|
207 | goto linkread;
|
---|
208 | }
|
---|
209 |
|
---|
210 | sl_snprintf (path, sizeof(path), _("/proc/%ld/file"), (unsigned long) pid);
|
---|
211 |
|
---|
212 | if (0 == retry_lstat(FIL__, __LINE__, path, &sbuf) && S_ISLNK(sbuf.st_mode))
|
---|
213 | {
|
---|
214 | goto linkread;
|
---|
215 | }
|
---|
216 |
|
---|
217 | sl_snprintf (path, sizeof(path), _("/proc/%ld/path/a.out"), (unsigned long) pid);
|
---|
218 |
|
---|
219 | if (0 == retry_lstat(FIL__, __LINE__, path, &sbuf) && S_ISLNK(sbuf.st_mode))
|
---|
220 | {
|
---|
221 | goto linkread;
|
---|
222 | }
|
---|
223 |
|
---|
224 | return NULL;
|
---|
225 |
|
---|
226 | linkread:
|
---|
227 |
|
---|
228 | buf = SH_ALLOC(PATH_MAX);
|
---|
229 | len = readlink(path, buf, PATH_MAX); /* flawfinder: ignore */
|
---|
230 | len = (len >= PATH_MAX) ? (PATH_MAX-1) : len;
|
---|
231 |
|
---|
232 | if (len > 0)
|
---|
233 | {
|
---|
234 | buf[len] = '\0';
|
---|
235 | }
|
---|
236 | else
|
---|
237 | {
|
---|
238 | SH_FREE(buf);
|
---|
239 | return NULL;
|
---|
240 | }
|
---|
241 |
|
---|
242 | tmp = sh_unix_getUIDname (SH_ERR_ALL, sbuf.st_uid, user, usrlen);
|
---|
243 |
|
---|
244 | if (!tmp)
|
---|
245 | sl_snprintf (user, usrlen, "%ld", (unsigned long) sbuf.st_uid);
|
---|
246 |
|
---|
247 | return buf;
|
---|
248 | }
|
---|
249 |
|
---|
250 |
|
---|
251 | struct watchlist {
|
---|
252 | char * str;
|
---|
253 | unsigned long pid;
|
---|
254 | #ifdef HAVE_REGEX_H
|
---|
255 | regex_t preg;
|
---|
256 | #endif
|
---|
257 | int seen;
|
---|
258 |
|
---|
259 | struct watchlist *next;
|
---|
260 | };
|
---|
261 |
|
---|
262 | static struct watchlist * process_check = NULL;
|
---|
263 |
|
---|
264 | static struct watchlist * list_missing = NULL;
|
---|
265 | static struct watchlist * list_fake = NULL;
|
---|
266 | static struct watchlist * list_hidden = NULL;
|
---|
267 |
|
---|
268 | /* recursively remove all list entries
|
---|
269 | */
|
---|
270 | static void kill_list (struct watchlist * head)
|
---|
271 | {
|
---|
272 | if (head->next)
|
---|
273 | kill_list (head->next);
|
---|
274 |
|
---|
275 | if (head->str)
|
---|
276 | SH_FREE(head->str);
|
---|
277 | SH_FREE(head);
|
---|
278 |
|
---|
279 | return;
|
---|
280 | }
|
---|
281 |
|
---|
282 |
|
---|
283 | /* check the list for old entries; clean out old entries; reset others
|
---|
284 | * Return number of non-obsolete entries
|
---|
285 | */
|
---|
286 | static size_t clean_list (struct watchlist ** head_ptr)
|
---|
287 | {
|
---|
288 | size_t count = 0;
|
---|
289 | struct watchlist * ptr = *head_ptr;
|
---|
290 | struct watchlist * pre = *head_ptr;
|
---|
291 |
|
---|
292 | while (ptr)
|
---|
293 | {
|
---|
294 | if (ptr->seen == S_FALSE) /* obsolete entry */
|
---|
295 | {
|
---|
296 | if (ptr == pre) /* at head */
|
---|
297 | {
|
---|
298 | ptr = pre->next;
|
---|
299 | *head_ptr = pre->next;
|
---|
300 | if (pre->str)
|
---|
301 | SH_FREE(pre->str);
|
---|
302 | SH_FREE(pre);
|
---|
303 | pre = ptr;
|
---|
304 | }
|
---|
305 | else
|
---|
306 | {
|
---|
307 | pre->next = ptr->next;
|
---|
308 | if (ptr->str)
|
---|
309 | SH_FREE(ptr->str);
|
---|
310 | SH_FREE(ptr);
|
---|
311 | ptr = pre->next;
|
---|
312 | }
|
---|
313 | }
|
---|
314 | else
|
---|
315 | {
|
---|
316 | ++count;
|
---|
317 | ptr->seen = S_FALSE; /* reset status */
|
---|
318 | pre = ptr;
|
---|
319 | ptr = ptr->next;
|
---|
320 | }
|
---|
321 | }
|
---|
322 | return count;
|
---|
323 | }
|
---|
324 |
|
---|
325 | /* check if process is in list; if not, add it and return false
|
---|
326 | */
|
---|
327 | static int is_in_list (struct watchlist ** head_ptr,
|
---|
328 | char * str, unsigned long pid)
|
---|
329 | {
|
---|
330 | struct watchlist * ptr = *head_ptr;
|
---|
331 |
|
---|
332 | if (str)
|
---|
333 | {
|
---|
334 | while (ptr)
|
---|
335 | {
|
---|
336 | if (ptr->str && (0 == strcmp(str, ptr->str)))
|
---|
337 | {
|
---|
338 | ptr->seen = S_TRUE;
|
---|
339 | return S_TRUE;
|
---|
340 | }
|
---|
341 | ptr = ptr->next;
|
---|
342 | }
|
---|
343 | }
|
---|
344 | else
|
---|
345 | {
|
---|
346 | while (ptr)
|
---|
347 | {
|
---|
348 | if (ptr->pid == pid)
|
---|
349 | {
|
---|
350 | ptr->seen = S_TRUE;
|
---|
351 | return S_TRUE;
|
---|
352 | }
|
---|
353 | ptr = ptr->next;
|
---|
354 | }
|
---|
355 | }
|
---|
356 |
|
---|
357 | ptr = SH_ALLOC(sizeof(struct watchlist));
|
---|
358 |
|
---|
359 | if (str)
|
---|
360 | {
|
---|
361 | ptr->str = sh_util_strdup(str);
|
---|
362 | }
|
---|
363 | else
|
---|
364 | {
|
---|
365 | ptr->str = NULL;
|
---|
366 | ptr->pid = pid;
|
---|
367 | }
|
---|
368 | ptr->next = *head_ptr;
|
---|
369 | ptr->seen = S_TRUE;
|
---|
370 | *head_ptr = ptr;
|
---|
371 |
|
---|
372 | return S_FALSE;
|
---|
373 | }
|
---|
374 |
|
---|
375 | static int is_in_watchlist (const char *str, unsigned long num)
|
---|
376 | {
|
---|
377 | struct watchlist * list = process_check;
|
---|
378 |
|
---|
379 | while (list)
|
---|
380 | {
|
---|
381 | #ifdef HAVE_REGEX_H
|
---|
382 | if (0 == regexec(&(list->preg), str, 0, NULL, 0))
|
---|
383 | {
|
---|
384 | list->seen = S_TRUE;
|
---|
385 | list->pid = num;
|
---|
386 | return S_TRUE;
|
---|
387 | }
|
---|
388 | #else
|
---|
389 | if (strstr(str, list->str))
|
---|
390 | {
|
---|
391 | list->seen = S_TRUE;
|
---|
392 | list->pid = num;
|
---|
393 | return S_TRUE;
|
---|
394 | }
|
---|
395 | #endif
|
---|
396 | list = list->next;
|
---|
397 | }
|
---|
398 | return S_FALSE;
|
---|
399 | }
|
---|
400 |
|
---|
401 | /* These variables are not used anywhere. They only exist
|
---|
402 | * to assign &userold, &user to them, which keeps gcc from
|
---|
403 | * putting them into a register, and avoids the 'clobbered
|
---|
404 | * by longjmp' warning. And no, 'volatile' proved insufficient.
|
---|
405 | */
|
---|
406 | static void * sh_dummy_watchlist = NULL;
|
---|
407 |
|
---|
408 | static void check_watchlist (short * res)
|
---|
409 | {
|
---|
410 | struct watchlist * list = process_check;
|
---|
411 | char * tmp;
|
---|
412 | size_t indx;
|
---|
413 |
|
---|
414 | /* Take the address to keep gcc from putting them into registers.
|
---|
415 | * Avoids the 'clobbered by longjmp' warning.
|
---|
416 | */
|
---|
417 | sh_dummy_watchlist = (void*) &list;
|
---|
418 |
|
---|
419 | while (list)
|
---|
420 | {
|
---|
421 | if (list->seen == S_FALSE)
|
---|
422 | {
|
---|
423 | /* avoid repetition of messages
|
---|
424 | */
|
---|
425 | if (S_FALSE == is_in_list(&list_missing, list->str, 0))
|
---|
426 | {
|
---|
427 | SH_MUTEX_LOCK(mutex_thread_nolog);
|
---|
428 | tmp = sh_util_safe_name (list->str);
|
---|
429 | sh_error_handle(sh_prochk_severity, FIL__, __LINE__, 0,
|
---|
430 | MSG_PCK_MISS,
|
---|
431 | tmp);
|
---|
432 | SH_FREE(tmp);
|
---|
433 | SH_MUTEX_UNLOCK(mutex_thread_nolog);
|
---|
434 | }
|
---|
435 | }
|
---|
436 | else
|
---|
437 | {
|
---|
438 | indx = list->pid - sh_prochk_minpid;
|
---|
439 |
|
---|
440 | if (list->pid < sh_prochk_maxpid && list->pid >= sh_prochk_minpid &&
|
---|
441 | ((res[indx] & SH_PR_ANY) == 0) && /* not found */
|
---|
442 | ((res[indx] & SH_PR_PS) != 0) && /* seen in first ps */
|
---|
443 | ((res[indx] & SH_PR_PS2) != 0)) /* seen in second ps */
|
---|
444 | {
|
---|
445 | /* fake process, thus considered missing
|
---|
446 | */
|
---|
447 | if (S_FALSE == is_in_list(&list_missing, list->str, 0))
|
---|
448 | {
|
---|
449 | SH_MUTEX_LOCK(mutex_thread_nolog);
|
---|
450 | tmp = sh_util_safe_name (list->str);
|
---|
451 | sh_error_handle(sh_prochk_severity, FIL__, __LINE__, 0,
|
---|
452 | MSG_PCK_MISS,
|
---|
453 | tmp);
|
---|
454 | SH_FREE(tmp);
|
---|
455 | SH_MUTEX_UNLOCK(mutex_thread_nolog);
|
---|
456 | }
|
---|
457 | }
|
---|
458 | list->seen = S_FALSE;
|
---|
459 | }
|
---|
460 | list = list->next;
|
---|
461 | }
|
---|
462 |
|
---|
463 | sh_dummy_watchlist = NULL;
|
---|
464 | return;
|
---|
465 | }
|
---|
466 |
|
---|
467 | /* Add 'str' to the list of watched processes for which
|
---|
468 | * existence should be checked.
|
---|
469 | */
|
---|
470 | int sh_prochk_add_process (const char *str)
|
---|
471 | {
|
---|
472 | struct watchlist *new;
|
---|
473 | int status;
|
---|
474 | char errbuf[256];
|
---|
475 |
|
---|
476 | SL_ENTER(_("sh_prochk_add_process"));
|
---|
477 |
|
---|
478 | if( str == NULL )
|
---|
479 | SL_RETURN(-1, _("sh_prochk_add_process") );
|
---|
480 |
|
---|
481 | new = SH_ALLOC(sizeof(struct watchlist));
|
---|
482 | new->next = process_check;
|
---|
483 | new->str = sh_util_strdup(str);
|
---|
484 | #ifdef HAVE_REGEX_H
|
---|
485 | status = regcomp(&(new->preg), str, REG_NOSUB|REG_EXTENDED);
|
---|
486 | if (status != 0)
|
---|
487 | {
|
---|
488 | regerror(status, &(new->preg), errbuf, sizeof(errbuf));
|
---|
489 | SH_MUTEX_LOCK(mutex_thread_nolog);
|
---|
490 | sh_error_handle((-1), FIL__, __LINE__, status, MSG_E_SUBGEN,
|
---|
491 | errbuf, _("sh_processes_add_process"));
|
---|
492 | SH_MUTEX_UNLOCK(mutex_thread_nolog);
|
---|
493 | SH_FREE(new->str);
|
---|
494 | SH_FREE(new);
|
---|
495 | SL_RETURN(-1, _("sh_prochk_add_process") );
|
---|
496 | }
|
---|
497 | #endif
|
---|
498 | new->pid = 0;
|
---|
499 | new->seen = S_FALSE;
|
---|
500 |
|
---|
501 | process_check = new;
|
---|
502 | SL_RETURN(0, _("sh_prochk_add_process") );
|
---|
503 | }
|
---|
504 |
|
---|
505 | /* severity
|
---|
506 | */
|
---|
507 | int sh_prochk_set_severity (const char * c)
|
---|
508 | {
|
---|
509 | char tmp[32];
|
---|
510 | tmp[0] = '='; tmp[1] = '\0';
|
---|
511 | sl_strlcat (tmp, c, 32);
|
---|
512 | return sh_error_set_level (tmp, &sh_prochk_severity);
|
---|
513 | }
|
---|
514 |
|
---|
515 |
|
---|
516 |
|
---|
517 | /* Path to ps
|
---|
518 | */
|
---|
519 | int sh_prochk_set_pspath(const char *str)
|
---|
520 | {
|
---|
521 | SL_ENTER(_("sh_prochk_set_pspath"));
|
---|
522 |
|
---|
523 | if (!str || ('/' != str[0]))
|
---|
524 | SL_RETURN((-1), _("sh_prochk_set_pspath"));
|
---|
525 | if (sh_prochk_pspath)
|
---|
526 | SH_FREE(sh_prochk_pspath);
|
---|
527 | #ifdef SH_EVAL_SHELL
|
---|
528 | sh_prochk_pspath = sh_util_strdup (str);
|
---|
529 | SL_RETURN((0), _("sh_prochk_set_pspath"));
|
---|
530 | #else
|
---|
531 | sh_prochk_pspath = NULL;
|
---|
532 | SL_RETURN((-1), _("sh_prochk_set_pspath"));
|
---|
533 | #endif
|
---|
534 | }
|
---|
535 |
|
---|
536 | /* argument for ps
|
---|
537 | */
|
---|
538 | int sh_prochk_set_psarg(const char *str)
|
---|
539 | {
|
---|
540 | SL_ENTER(_("sh_prochk_set_psarg"));
|
---|
541 |
|
---|
542 | if (sh_prochk_psarg)
|
---|
543 | SH_FREE(sh_prochk_psarg);
|
---|
544 | #ifdef SH_EVAL_SHELL
|
---|
545 | sh_prochk_psarg = sh_util_strdup (str);
|
---|
546 | SL_RETURN((0), _("sh_prochk_set_psarg"));
|
---|
547 | #else
|
---|
548 | sh_prochk_psarg = NULL;
|
---|
549 | SL_RETURN((-1), _("sh_prochk_set_psarg"));
|
---|
550 | #endif
|
---|
551 | }
|
---|
552 |
|
---|
553 |
|
---|
554 | /* Decide if we're active.
|
---|
555 | */
|
---|
556 | int sh_prochk_set_active(const char *str)
|
---|
557 | {
|
---|
558 | int value;
|
---|
559 |
|
---|
560 | SL_ENTER(_("sh_prochk_set_active"));
|
---|
561 |
|
---|
562 | value = sh_util_flagval(str, &ShProchkActive);
|
---|
563 |
|
---|
564 | SL_RETURN((value), _("sh_prochk_set_active"));
|
---|
565 | }
|
---|
566 |
|
---|
567 | /* Are we on openvz.
|
---|
568 | */
|
---|
569 | static int openvz_hidden = 0;
|
---|
570 |
|
---|
571 | int sh_prochk_set_openvz(const char *str)
|
---|
572 | {
|
---|
573 | int value;
|
---|
574 |
|
---|
575 | SL_ENTER(_("sh_prochk_set_openvz"));
|
---|
576 |
|
---|
577 | value = sh_util_flagval(str, &sh_prochk_openvz);
|
---|
578 |
|
---|
579 | if (sh_prochk_openvz != S_FALSE) {
|
---|
580 | openvz_hidden = 1;
|
---|
581 | }
|
---|
582 |
|
---|
583 | SL_RETURN((value), _("sh_prochk_set_openvz"));
|
---|
584 | }
|
---|
585 |
|
---|
586 | /* Minimum PID
|
---|
587 | */
|
---|
588 | int sh_prochk_set_minpid(const char * str)
|
---|
589 | {
|
---|
590 | size_t value;
|
---|
591 | char * foo;
|
---|
592 | int retval = 0;
|
---|
593 |
|
---|
594 | SL_ENTER(_("sh_prochk_set_minpid"));
|
---|
595 |
|
---|
596 | value = (size_t) strtoul(str, &foo, 0);
|
---|
597 | if (*foo != '\0')
|
---|
598 | retval = -1;
|
---|
599 | else
|
---|
600 | sh_prochk_minpid = value;
|
---|
601 |
|
---|
602 | SL_RETURN((retval), _("sh_prochk_set_minpid"));
|
---|
603 | }
|
---|
604 |
|
---|
605 | /* Maximum PID
|
---|
606 | */
|
---|
607 | static int userdef_maxpid = 0;
|
---|
608 |
|
---|
609 | int sh_prochk_set_maxpid(const char * str)
|
---|
610 | {
|
---|
611 | size_t value;
|
---|
612 | char * foo;
|
---|
613 | int retval = -1;
|
---|
614 |
|
---|
615 | SL_ENTER(_("sh_prochk_set_maxpid"));
|
---|
616 |
|
---|
617 | value = (size_t) strtoul(str, &foo, 0);
|
---|
618 |
|
---|
619 | if (*foo == '\0' && SL_TRUE == sl_ok_adds(value, 1)) {
|
---|
620 | sh_prochk_maxpid = value + 1;
|
---|
621 | userdef_maxpid = 1;
|
---|
622 | retval = 0;
|
---|
623 | }
|
---|
624 |
|
---|
625 | SL_RETURN((retval), _("sh_prochk_set_maxpid"));
|
---|
626 | }
|
---|
627 |
|
---|
628 | int sh_prochk_set_interval (const char * c)
|
---|
629 | {
|
---|
630 | int retval = 0;
|
---|
631 | long val;
|
---|
632 |
|
---|
633 | SL_ENTER(_("sh_prochk_set_interval"));
|
---|
634 | val = strtol (c, (char **)NULL, 10);
|
---|
635 | if (val <= 0)
|
---|
636 | {
|
---|
637 | SH_MUTEX_LOCK(mutex_thread_nolog);
|
---|
638 | sh_error_handle ((-1), FIL__, __LINE__, EINVAL, MSG_EINVALS,
|
---|
639 | _("process check interval"), c);
|
---|
640 | SH_MUTEX_UNLOCK(mutex_thread_nolog);
|
---|
641 | retval = -1;
|
---|
642 | }
|
---|
643 | else
|
---|
644 | {
|
---|
645 | sh_prochk_interval = (time_t) val;
|
---|
646 | }
|
---|
647 | SL_RETURN(retval, _("sh_prochk_set_interval"));
|
---|
648 | }
|
---|
649 |
|
---|
650 |
|
---|
651 |
|
---|
652 | /* Recurse to the end of the list and then free the data as we return
|
---|
653 | * back up towards the start, making sure to free any strdupped strings
|
---|
654 | */
|
---|
655 | static void sh_prochk_free_list(struct watchlist *head)
|
---|
656 | {
|
---|
657 | if ( head != NULL )
|
---|
658 | {
|
---|
659 | sh_prochk_free_list(head->next);
|
---|
660 | if (head->str)
|
---|
661 | SH_FREE(head->str);
|
---|
662 | #ifdef HAVE_REGEX_H
|
---|
663 | regfree(&(head->preg));
|
---|
664 | #endif
|
---|
665 | SH_FREE(head);
|
---|
666 | }
|
---|
667 | return;
|
---|
668 | }
|
---|
669 |
|
---|
670 | #if defined(__linux__)
|
---|
671 | #define PROC_PID_MAX _("/proc/sys/kernel/pid_max")
|
---|
672 |
|
---|
673 | static int proc_max_pid (size_t * procpid)
|
---|
674 | {
|
---|
675 | char * ret;
|
---|
676 | unsigned long pid;
|
---|
677 | FILE * fd;
|
---|
678 | char str[128];
|
---|
679 | char * ptr;
|
---|
680 |
|
---|
681 | SL_ENTER(_("proc_max_pid"));
|
---|
682 |
|
---|
683 | if (userdef_maxpid != 0)
|
---|
684 | SL_RETURN((-1), _("proc_max_pid"));
|
---|
685 |
|
---|
686 | if (0 == access(PROC_PID_MAX, R_OK)) /* flawfinder: ignore */
|
---|
687 | {
|
---|
688 | if (NULL != (fd = fopen(PROC_PID_MAX, "r")))
|
---|
689 | {
|
---|
690 | str[0] = '\0';
|
---|
691 | ret = fgets(str, 128, fd);
|
---|
692 | if (ret && *str != '\0')
|
---|
693 | {
|
---|
694 | pid = strtoul(str, &ptr, 0);
|
---|
695 | if (*ptr == '\0' || *ptr == '\n')
|
---|
696 | {
|
---|
697 | sl_fclose(FIL__, __LINE__, fd);
|
---|
698 | *procpid = (size_t) pid;
|
---|
699 | SL_RETURN(0, _("proc_max_pid"));
|
---|
700 | }
|
---|
701 | }
|
---|
702 | sl_fclose(FIL__, __LINE__, fd);
|
---|
703 | }
|
---|
704 | }
|
---|
705 | SL_RETURN((-1), _("proc_max_pid"));
|
---|
706 | }
|
---|
707 | #else
|
---|
708 | static int proc_max_pid(size_t * dummy)
|
---|
709 | {
|
---|
710 | (void) dummy;
|
---|
711 | return -1;
|
---|
712 | }
|
---|
713 | #endif
|
---|
714 |
|
---|
715 | static void sh_processes_tlist (char * list, size_t len, short res)
|
---|
716 | {
|
---|
717 | if (res & SH_PR_PS) sl_strlcat(list, _(" ps(initial)"), len);
|
---|
718 | if (res & SH_PR_CHDIR) sl_strlcat(list, _(" chdir"), len);
|
---|
719 | if (res & SH_PR_OPENDIR) sl_strlcat(list, _(" opendir"), len);
|
---|
720 | if (res & SH_PR_LSTAT) sl_strlcat(list, _(" lstat"), len);
|
---|
721 | if (res & SH_PR_PRIORITY) sl_strlcat(list, _(" getpriority"), len);
|
---|
722 | if (res & SH_PR_SCHED) sl_strlcat(list, _(" sched_getparam"), len);
|
---|
723 | if (res & SH_PR_GETSID) sl_strlcat(list, _(" getsid"), len);
|
---|
724 | if (res & SH_PR_GETPGID) sl_strlcat(list, _(" getpgid"), len);
|
---|
725 | if (res & SH_PR_KILL) sl_strlcat(list, _(" kill"), len);
|
---|
726 | if (res & SH_PR_STATVSF) sl_strlcat(list, _(" statvfs"), len);
|
---|
727 | if (res & SH_PR_PS2) sl_strlcat(list, _(" ps(final)"), len);
|
---|
728 | return;
|
---|
729 | }
|
---|
730 |
|
---|
731 |
|
---|
732 | static short sh_processes_check (pid_t pid, short res)
|
---|
733 | {
|
---|
734 | int have_checks = 0;
|
---|
735 | int need_checks = 0;
|
---|
736 | #ifdef HAVE_PROCFS
|
---|
737 | char path[128];
|
---|
738 | struct stat buf;
|
---|
739 | DIR * dir;
|
---|
740 | int retval;
|
---|
741 | #if defined(HAVE_STATVFS) && !defined(__FreeBSD__)
|
---|
742 | struct statvfs vfsbuf;
|
---|
743 | #endif
|
---|
744 | #endif
|
---|
745 |
|
---|
746 | #if !defined(sun) && !defined(__sun) && !defined(__sun__)
|
---|
747 | #ifdef _POSIX_PRIORITY_SCHEDULING
|
---|
748 | struct sched_param p;
|
---|
749 | #endif
|
---|
750 | #endif
|
---|
751 |
|
---|
752 | if (0 == kill(pid, 0))
|
---|
753 | {
|
---|
754 | res |= SH_PR_KILL; res |= SH_PR_ANY; ++have_checks;
|
---|
755 | ++need_checks;
|
---|
756 | }
|
---|
757 | else if (errno != EPERM)
|
---|
758 | {
|
---|
759 | ++need_checks;
|
---|
760 | }
|
---|
761 |
|
---|
762 |
|
---|
763 | #ifdef HAVE_GETPGID
|
---|
764 | if ((pid_t)-1 != getpgid(pid))
|
---|
765 | {
|
---|
766 | res |= SH_PR_GETPGID; res |= SH_PR_ANY; ++have_checks;
|
---|
767 | }
|
---|
768 | ++need_checks;
|
---|
769 | #endif
|
---|
770 |
|
---|
771 | #ifdef HAVE_GETSID
|
---|
772 | if ((pid_t)-1 != getsid(pid))
|
---|
773 | {
|
---|
774 | res |= SH_PR_GETSID; res |= SH_PR_ANY; ++have_checks;
|
---|
775 | }
|
---|
776 | ++need_checks;
|
---|
777 | #endif
|
---|
778 |
|
---|
779 | /* sched_getparam() is broken on solaris 10, may segfault in librt
|
---|
780 | */
|
---|
781 | #if !defined(sun) && !defined(__sun) && !defined(__sun__)
|
---|
782 | #ifdef _POSIX_PRIORITY_SCHEDULING
|
---|
783 | if (0 == sched_getparam (pid, &p))
|
---|
784 | {
|
---|
785 | res |= SH_PR_SCHED; res |= SH_PR_ANY; ++have_checks;
|
---|
786 | }
|
---|
787 | ++need_checks;
|
---|
788 | #endif
|
---|
789 | #endif
|
---|
790 |
|
---|
791 | #ifdef HAVE_GETPRIORITY
|
---|
792 | errno = 0;
|
---|
793 | if (((-1) == getpriority (PRIO_PROCESS, (int) pid)) && (errno == ESRCH));
|
---|
794 | else
|
---|
795 | {
|
---|
796 | res |= SH_PR_PRIORITY; res |= SH_PR_ANY; ++have_checks;
|
---|
797 | }
|
---|
798 | ++need_checks;
|
---|
799 | #endif
|
---|
800 |
|
---|
801 | #ifdef HAVE_PROCFS
|
---|
802 | sl_snprintf (path, sizeof(path), "/proc/%ld", (unsigned long) pid);
|
---|
803 |
|
---|
804 | do {
|
---|
805 | retval = lstat (path, &buf);
|
---|
806 | } while (retval < 0 && errno == EINTR);
|
---|
807 |
|
---|
808 | if (0 == retval)
|
---|
809 | {
|
---|
810 | res |= SH_PR_LSTAT; res |= SH_PR_ANY; ++have_checks;
|
---|
811 | }
|
---|
812 | ++need_checks;
|
---|
813 |
|
---|
814 | if (NULL != (dir = opendir(path)))
|
---|
815 | {
|
---|
816 | res |= SH_PR_OPENDIR; res |= SH_PR_ANY; ++have_checks;
|
---|
817 | closedir(dir);
|
---|
818 | }
|
---|
819 | ++need_checks;
|
---|
820 |
|
---|
821 | #if defined(HAVE_STATVFS) && !defined(__FreeBSD__)
|
---|
822 | do {
|
---|
823 | retval = statvfs (path, &vfsbuf);
|
---|
824 | } while (retval < 0 && errno == EINTR);
|
---|
825 |
|
---|
826 | if (0 == retval)
|
---|
827 | {
|
---|
828 | res |= SH_PR_STATVSF; res |= SH_PR_ANY; ++have_checks;
|
---|
829 | }
|
---|
830 | ++need_checks;
|
---|
831 | #endif
|
---|
832 |
|
---|
833 | #if !defined(SH_PROFILE)
|
---|
834 | if (0 == chdir(path))
|
---|
835 | {
|
---|
836 | res |= SH_PR_CHDIR; res |= SH_PR_ANY; ++have_checks;
|
---|
837 | do {
|
---|
838 | retval = chdir ("/");
|
---|
839 | } while (retval < 0 && errno == EINTR);
|
---|
840 | }
|
---|
841 | ++need_checks;
|
---|
842 | #endif
|
---|
843 | #endif
|
---|
844 |
|
---|
845 | if (have_checks == need_checks)
|
---|
846 | {
|
---|
847 | res |= SH_PR_ALL;
|
---|
848 | }
|
---|
849 | return res;
|
---|
850 | }
|
---|
851 |
|
---|
852 | extern int flag_err_debug;
|
---|
853 |
|
---|
854 | static int sh_processes_readps (FILE * in, short * res,
|
---|
855 | char * str, size_t len,
|
---|
856 | short flag, pid_t pid)
|
---|
857 | {
|
---|
858 | int cc;
|
---|
859 | unsigned int lnum = 0;
|
---|
860 | unsigned long num = 0;
|
---|
861 | char c;
|
---|
862 | unsigned int pos = 0;
|
---|
863 | char tstr[256];
|
---|
864 | enum { SKIP_TO_WS, SKIP_WS, SKIP_TO_WS2, SKIP_WS2, GET_NUM, SKIP_END, GET_NUM2 } line;
|
---|
865 |
|
---|
866 | SL_ENTER(_("sh_processes_readps"));
|
---|
867 |
|
---|
868 | if (!in) {
|
---|
869 | SL_RETURN((-1), _("sh_processes_readps"));
|
---|
870 | }
|
---|
871 |
|
---|
872 | tstr[(sizeof(tstr)-1)] = '\0';
|
---|
873 | tstr[0] = '\0';
|
---|
874 | line = SKIP_END; /* Skip 1st line */
|
---|
875 |
|
---|
876 | do
|
---|
877 | {
|
---|
878 | cc = fgetc(in);
|
---|
879 |
|
---|
880 | if (EOF == cc)
|
---|
881 | {
|
---|
882 | if (feof(in))
|
---|
883 | {
|
---|
884 | break;
|
---|
885 | }
|
---|
886 | else if (errno == EAGAIN)
|
---|
887 | {
|
---|
888 | clearerr(in);
|
---|
889 | continue;
|
---|
890 | }
|
---|
891 | #ifdef HOST_IS_OPENBSD
|
---|
892 | else if (errno == ENODEV)
|
---|
893 | {
|
---|
894 | clearerr(in);
|
---|
895 | continue;
|
---|
896 | }
|
---|
897 | #endif
|
---|
898 | else
|
---|
899 | {
|
---|
900 | char errbuf[SH_ERRBUF_SIZE];
|
---|
901 |
|
---|
902 | /* SH_MUTEX_LOCK(mutex_thread_nolog) is in caller */
|
---|
903 | sh_error_handle(SH_ERR_ALL, FIL__, __LINE__, errno, MSG_E_SUBGEN,
|
---|
904 | sh_error_message(errno, errbuf, sizeof(errbuf)),
|
---|
905 | _("sh_processes_readps"));
|
---|
906 | break;
|
---|
907 | }
|
---|
908 | }
|
---|
909 |
|
---|
910 | c = (char) cc;
|
---|
911 |
|
---|
912 | if (pos < (sizeof(tstr)-1))
|
---|
913 | {
|
---|
914 | tstr[pos] = c; ++pos;
|
---|
915 | }
|
---|
916 |
|
---|
917 | switch(line)
|
---|
918 | {
|
---|
919 | case SKIP_END:
|
---|
920 | if (c == '\n')
|
---|
921 | {
|
---|
922 | tstr[pos-1] = '\0';
|
---|
923 | if (flag_err_debug == SL_TRUE)
|
---|
924 | {
|
---|
925 | /* SH_MUTEX_LOCK(mutex_thread_nolog) is in caller */
|
---|
926 | sh_error_handle(SH_ERR_ALL, FIL__, __LINE__, num,
|
---|
927 | MSG_E_SUBGEN,
|
---|
928 | tstr,
|
---|
929 | _("sh_processes_readps"));
|
---|
930 | }
|
---|
931 | /* fprintf(stderr, "<%ld> %s\n", num, tstr); */
|
---|
932 | line = SKIP_WS; pos = 0;
|
---|
933 | if (str != NULL && num == (unsigned long) pid)
|
---|
934 | sl_strlcpy(str, tstr, len);
|
---|
935 | if (lnum != 0)
|
---|
936 | is_in_watchlist (tstr, num);
|
---|
937 | ++lnum;
|
---|
938 | }
|
---|
939 | break;
|
---|
940 | case SKIP_TO_WS:
|
---|
941 | if (!isspace(cc))
|
---|
942 | break;
|
---|
943 | line = SKIP_WS;
|
---|
944 | /* fallthrough */
|
---|
945 | case SKIP_WS:
|
---|
946 | if (isspace(cc))
|
---|
947 | break;
|
---|
948 | num = 0;
|
---|
949 | line = GET_NUM;
|
---|
950 | /* fallthrough */
|
---|
951 | case GET_NUM:
|
---|
952 | if (isdigit(cc))
|
---|
953 | {
|
---|
954 | num = num * 10 + (c - '0');
|
---|
955 | break;
|
---|
956 | }
|
---|
957 | else if (isspace(cc))
|
---|
958 | {
|
---|
959 | #ifdef PS_THREADS
|
---|
960 | num = 0;
|
---|
961 | line = SKIP_WS2;
|
---|
962 | #else
|
---|
963 | if (num < sh_prochk_maxpid && num >= sh_prochk_minpid)
|
---|
964 | {
|
---|
965 | res[num - sh_prochk_minpid] |= flag;
|
---|
966 | }
|
---|
967 | line = SKIP_END;
|
---|
968 | #endif
|
---|
969 | break;
|
---|
970 | }
|
---|
971 | else
|
---|
972 | {
|
---|
973 | line = SKIP_TO_WS;
|
---|
974 | break;
|
---|
975 | }
|
---|
976 | case SKIP_TO_WS2:
|
---|
977 | if (!isspace(cc))
|
---|
978 | break;
|
---|
979 | line = SKIP_WS2;
|
---|
980 | /* fallthrough */
|
---|
981 | case SKIP_WS2:
|
---|
982 | if (isspace(cc))
|
---|
983 | break;
|
---|
984 | num = 0;
|
---|
985 | line = GET_NUM2;
|
---|
986 | /* fallthrough */
|
---|
987 | case GET_NUM2:
|
---|
988 | if (isdigit(cc))
|
---|
989 | {
|
---|
990 | num = num * 10 + (c - '0');
|
---|
991 | break;
|
---|
992 | }
|
---|
993 | else if (isspace(cc))
|
---|
994 | {
|
---|
995 | if (num < sh_prochk_maxpid && num >= sh_prochk_minpid)
|
---|
996 | {
|
---|
997 | res[num - sh_prochk_minpid] |= flag;
|
---|
998 | }
|
---|
999 | line = SKIP_END;
|
---|
1000 | break;
|
---|
1001 | }
|
---|
1002 | else
|
---|
1003 | {
|
---|
1004 | line = SKIP_TO_WS2;
|
---|
1005 | break;
|
---|
1006 | }
|
---|
1007 | default:
|
---|
1008 | SL_RETURN ((-1), _("sh_processes_readps"));
|
---|
1009 | }
|
---|
1010 | } while (1);
|
---|
1011 |
|
---|
1012 | if (ferror(in))
|
---|
1013 | {
|
---|
1014 | SL_RETURN ((-1), _("sh_processes_readps"));
|
---|
1015 | }
|
---|
1016 |
|
---|
1017 | SL_RETURN ((0), _("sh_processes_readps"));
|
---|
1018 | }
|
---|
1019 |
|
---|
1020 | static int sh_processes_runps (short * res, char * str, size_t len,
|
---|
1021 | short flag, pid_t pid)
|
---|
1022 | {
|
---|
1023 | sh_tas_t task;
|
---|
1024 |
|
---|
1025 | int status = 0;
|
---|
1026 | char * p;
|
---|
1027 | int retval = 0;
|
---|
1028 | char dir[SH_PATHBUF];
|
---|
1029 |
|
---|
1030 | SL_ENTER(_("sh_processes_runps"));
|
---|
1031 |
|
---|
1032 | sh_ext_tas_init(&task);
|
---|
1033 | p = sh_unix_getUIDdir (SH_ERR_ERR, task.run_user_uid, dir, sizeof(dir));
|
---|
1034 | if (p)
|
---|
1035 | {
|
---|
1036 | (void) sh_ext_tas_add_envv (&task, _("HOME"), p);
|
---|
1037 | }
|
---|
1038 | (void) sh_ext_tas_add_envv (&task, _("SHELL"),
|
---|
1039 | _("/bin/sh"));
|
---|
1040 | (void) sh_ext_tas_add_envv (&task, _("PATH"),
|
---|
1041 | _("/sbin:/usr/sbin:/bin:/usr/bin"));
|
---|
1042 | if (sh.timezone != NULL)
|
---|
1043 | {
|
---|
1044 | (void) sh_ext_tas_add_envv(&task, "TZ", sh.timezone);
|
---|
1045 | }
|
---|
1046 |
|
---|
1047 | if (!sh_prochk_pspath)
|
---|
1048 | sh_ext_tas_command(&task, PSPATH);
|
---|
1049 | else
|
---|
1050 | sh_ext_tas_command(&task, sh_prochk_pspath);
|
---|
1051 |
|
---|
1052 | (void) sh_ext_tas_add_argv(&task, _("ps"));
|
---|
1053 |
|
---|
1054 | if (!sh_prochk_psarg)
|
---|
1055 | {
|
---|
1056 | #ifdef PS_THREADS
|
---|
1057 | (void) sh_ext_tas_add_argv(&task, _("-eT"));
|
---|
1058 | #else
|
---|
1059 | (void) sh_ext_tas_add_argv(&task, PSARG);
|
---|
1060 | #endif
|
---|
1061 | }
|
---|
1062 | else
|
---|
1063 | {
|
---|
1064 | (void) sh_ext_tas_add_argv(&task, sh_prochk_psarg);
|
---|
1065 | }
|
---|
1066 |
|
---|
1067 | task.rw = 'r';
|
---|
1068 | task.fork_twice = S_FALSE;
|
---|
1069 |
|
---|
1070 | status = sh_ext_popen(&task);
|
---|
1071 | if (status != 0)
|
---|
1072 | {
|
---|
1073 | /* SH_MUTEX_LOCK(mutex_thread_nolog) is in caller */
|
---|
1074 | sh_error_handle(SH_ERR_ALL, FIL__, __LINE__, status, MSG_E_SUBGEN,
|
---|
1075 | _("Could not open pipe"), _("sh_processes_runps"));
|
---|
1076 | SL_RETURN ((-1), _("sh_processes_runps"));
|
---|
1077 | }
|
---|
1078 |
|
---|
1079 | /* read from the open pipe
|
---|
1080 | */
|
---|
1081 | if (task.pipe != NULL)
|
---|
1082 | {
|
---|
1083 | retval = sh_processes_readps (task.pipe, res, str, len, flag, pid);
|
---|
1084 | }
|
---|
1085 |
|
---|
1086 | /* close pipe and return exit status
|
---|
1087 | */
|
---|
1088 | (void) sh_ext_pclose(&task);
|
---|
1089 | sh_ext_tas_free (&task);
|
---|
1090 | SL_RETURN ((retval), _("sh_processes_runps"));
|
---|
1091 | }
|
---|
1092 |
|
---|
1093 | /* Check whether there is a visible process
|
---|
1094 | * with PID = i + 1024
|
---|
1095 | */
|
---|
1096 | static size_t p_store = 0;
|
---|
1097 |
|
---|
1098 | static int openvz_ok(short * res, size_t i)
|
---|
1099 | {
|
---|
1100 |
|
---|
1101 | if (sh_prochk_openvz == S_FALSE) {
|
---|
1102 | return 0;
|
---|
1103 | }
|
---|
1104 |
|
---|
1105 | i += 1024;
|
---|
1106 |
|
---|
1107 | if (i >= sh_prochk_size) {
|
---|
1108 | return 0;
|
---|
1109 | }
|
---|
1110 |
|
---|
1111 | if ( ((res[i] & SH_PR_PS) || (res[i] & SH_PR_PS2)) && (res[i] & SH_PR_ANY))
|
---|
1112 | {
|
---|
1113 | /* This is a system process corresponding to a 'virtual'
|
---|
1114 | * process that has a PID offset by 1024
|
---|
1115 | */
|
---|
1116 | return 1;
|
---|
1117 | }
|
---|
1118 |
|
---|
1119 | if (openvz_hidden > 0)
|
---|
1120 | {
|
---|
1121 | p_store = i;
|
---|
1122 | --openvz_hidden;
|
---|
1123 | return 1;
|
---|
1124 | }
|
---|
1125 | else if (i == p_store)
|
---|
1126 | {
|
---|
1127 | return 1;
|
---|
1128 | }
|
---|
1129 |
|
---|
1130 | return 0;
|
---|
1131 | }
|
---|
1132 |
|
---|
1133 | static int sh_process_check_int (short * res)
|
---|
1134 | {
|
---|
1135 | volatile size_t i;
|
---|
1136 | size_t j;
|
---|
1137 | char tests[512];
|
---|
1138 | volatile int retval;
|
---|
1139 |
|
---|
1140 | pid_t this_pid;
|
---|
1141 |
|
---|
1142 | SL_ENTER(_("sh_process_check_int"));
|
---|
1143 |
|
---|
1144 | this_pid = getpid();
|
---|
1145 |
|
---|
1146 | if (!res)
|
---|
1147 | {
|
---|
1148 | SH_MUTEX_LOCK(mutex_thread_nolog);
|
---|
1149 | sh_error_handle((-1), FIL__, __LINE__, 0, MSG_E_SUBGEN,
|
---|
1150 | _("Internal error: NULL argument, switching off"),
|
---|
1151 | _("sh_process_check_int"));
|
---|
1152 | SH_MUTEX_UNLOCK(mutex_thread_nolog);
|
---|
1153 | SL_RETURN ((-1), _("sh_process_check_int"));
|
---|
1154 | }
|
---|
1155 |
|
---|
1156 | SH_MUTEX_LOCK(mutex_thread_nolog);
|
---|
1157 | retval = sh_processes_runps (res, NULL, 0, SH_PR_PS, 0);
|
---|
1158 | SH_MUTEX_UNLOCK(mutex_thread_nolog);
|
---|
1159 | for (i = sh_prochk_minpid; i != sh_prochk_maxpid; ++i)
|
---|
1160 | {
|
---|
1161 | j = i - sh_prochk_minpid;
|
---|
1162 | res[j] = sh_processes_check ((pid_t) i, res[j]);
|
---|
1163 | }
|
---|
1164 | SH_MUTEX_LOCK(mutex_thread_nolog);
|
---|
1165 | retval += sh_processes_runps (res, NULL, 0, SH_PR_PS2, 0);
|
---|
1166 | SH_MUTEX_UNLOCK(mutex_thread_nolog);
|
---|
1167 |
|
---|
1168 | if (retval != 0)
|
---|
1169 | {
|
---|
1170 | SH_MUTEX_LOCK(mutex_thread_nolog);
|
---|
1171 | sh_error_handle((-1), FIL__, __LINE__, 0, MSG_E_SUBGEN,
|
---|
1172 | _("Failed to run ps, switching off"),
|
---|
1173 | _("sh_process_check_int"));
|
---|
1174 | SH_MUTEX_UNLOCK(mutex_thread_nolog);
|
---|
1175 | SL_RETURN ((-1), _("sh_process_check_int"));
|
---|
1176 | }
|
---|
1177 |
|
---|
1178 | /* Evaluate results
|
---|
1179 | */
|
---|
1180 | for (i = sh_prochk_minpid; i != sh_prochk_maxpid; ++i)
|
---|
1181 | {
|
---|
1182 | /* don't check the current process
|
---|
1183 | */
|
---|
1184 | if (i == (size_t) this_pid)
|
---|
1185 | continue;
|
---|
1186 |
|
---|
1187 | j = i - sh_prochk_minpid;
|
---|
1188 |
|
---|
1189 | if (((res[j] & SH_PR_PS) != 0) || ((res[j] & SH_PR_PS2) != 0))
|
---|
1190 | {
|
---|
1191 | res[j] |= SH_PR_PS_ANY;
|
---|
1192 | }
|
---|
1193 | else
|
---|
1194 | {
|
---|
1195 | res[j] &= ~SH_PR_PS_ANY;
|
---|
1196 | }
|
---|
1197 |
|
---|
1198 | tests[0] = '\0';
|
---|
1199 |
|
---|
1200 | if ((res[j] & SH_PR_ANY) || (res[j] & SH_PR_PS_ANY))
|
---|
1201 | {
|
---|
1202 | /* list all tests where the pid was found
|
---|
1203 | */
|
---|
1204 | sh_processes_tlist (tests, sizeof(tests), res[j]);
|
---|
1205 |
|
---|
1206 | /*
|
---|
1207 | * case 1: in ps and found
|
---|
1208 | */
|
---|
1209 | if ((res[j] & SH_PR_PS_ANY) && (res[j] & SH_PR_ANY))
|
---|
1210 | {
|
---|
1211 | SH_MUTEX_LOCK(mutex_thread_nolog);
|
---|
1212 | sh_error_handle((-1), FIL__, __LINE__, 0, MSG_PCK_OK,
|
---|
1213 | (unsigned long) i, tests);
|
---|
1214 | SH_MUTEX_UNLOCK(mutex_thread_nolog);
|
---|
1215 | }
|
---|
1216 |
|
---|
1217 | /*
|
---|
1218 | * case 2: not in ps and found
|
---|
1219 | */
|
---|
1220 | else if ((res[j] & SH_PR_PS_ANY) == 0)
|
---|
1221 | {
|
---|
1222 | res[j] = sh_processes_check ((pid_t) i, 0);
|
---|
1223 | /*
|
---|
1224 | * if still there, it is real and hidden
|
---|
1225 | */
|
---|
1226 | if ((res[j] & SH_PR_ANY) && !openvz_ok(res, j))
|
---|
1227 | {
|
---|
1228 | if (S_FALSE == is_in_list(&list_hidden, NULL, i))
|
---|
1229 | {
|
---|
1230 | char user[16];
|
---|
1231 | char * aout;
|
---|
1232 | char * safe;
|
---|
1233 |
|
---|
1234 | SH_MUTEX_LOCK(mutex_thread_nolog);
|
---|
1235 | aout = get_user_and_path ((pid_t) i, user, sizeof(user));
|
---|
1236 | SH_MUTEX_UNLOCK(mutex_thread_nolog);
|
---|
1237 |
|
---|
1238 | if (aout)
|
---|
1239 | {
|
---|
1240 | safe = sh_util_safe_name (aout);
|
---|
1241 | SH_MUTEX_LOCK(mutex_thread_nolog);
|
---|
1242 | sh_error_handle(sh_prochk_severity, FIL__, __LINE__, 0,
|
---|
1243 | MSG_PCK_P_HIDDEN,
|
---|
1244 | (unsigned long) i, tests, safe, user);
|
---|
1245 | SH_MUTEX_UNLOCK(mutex_thread_nolog);
|
---|
1246 | SH_FREE(safe);
|
---|
1247 | SH_FREE(aout);
|
---|
1248 | }
|
---|
1249 | else
|
---|
1250 | {
|
---|
1251 | SH_MUTEX_LOCK(mutex_thread_nolog);
|
---|
1252 | sh_error_handle(sh_prochk_severity, FIL__, __LINE__, 0,
|
---|
1253 | MSG_PCK_HIDDEN,
|
---|
1254 | (unsigned long) i, tests);
|
---|
1255 | SH_MUTEX_UNLOCK(mutex_thread_nolog);
|
---|
1256 | }
|
---|
1257 | }
|
---|
1258 | }
|
---|
1259 | }
|
---|
1260 |
|
---|
1261 | /*
|
---|
1262 | * case 3: in ps, but not found
|
---|
1263 | */
|
---|
1264 | else
|
---|
1265 | {
|
---|
1266 | if (((res[j] & SH_PR_PS) != 0) && ((res[j] & SH_PR_PS2) != 0))
|
---|
1267 | {
|
---|
1268 | if (S_FALSE == is_in_list(&list_fake, NULL, i))
|
---|
1269 | {
|
---|
1270 | SH_MUTEX_LOCK(mutex_thread_nolog);
|
---|
1271 | sh_error_handle(sh_prochk_severity, FIL__, __LINE__, 0,
|
---|
1272 | MSG_PCK_FAKE,
|
---|
1273 | (unsigned long) i, tests);
|
---|
1274 | SH_MUTEX_UNLOCK(mutex_thread_nolog);
|
---|
1275 | }
|
---|
1276 | }
|
---|
1277 | }
|
---|
1278 | }
|
---|
1279 | } /* loop end */
|
---|
1280 |
|
---|
1281 | check_watchlist (res);
|
---|
1282 |
|
---|
1283 | SL_RETURN (0, _("sh_process_check_int"));
|
---|
1284 | }
|
---|
1285 |
|
---|
1286 | /* Initialise.
|
---|
1287 | */
|
---|
1288 | static int sh_prochk_init_internal(void)
|
---|
1289 | {
|
---|
1290 | SL_ENTER(_("sh_prochk_init"));
|
---|
1291 |
|
---|
1292 | (void) proc_max_pid (&sh_prochk_maxpid);
|
---|
1293 |
|
---|
1294 | if (sh_prochk_minpid > sh_prochk_maxpid)
|
---|
1295 | ShProchkActive = S_FALSE;
|
---|
1296 |
|
---|
1297 | /* We need to free anything allocated by the configuration functions if
|
---|
1298 | * we find that the module is to be left inactive - otherwise _reconf()
|
---|
1299 | * won't quite work.
|
---|
1300 | */
|
---|
1301 | if( ShProchkActive == S_FALSE )
|
---|
1302 | {
|
---|
1303 | sh_prochk_free_list(process_check);
|
---|
1304 | process_check = NULL;
|
---|
1305 | SL_RETURN(-1, _("sh_prochk_init"));
|
---|
1306 | }
|
---|
1307 |
|
---|
1308 | sh_prochk_size = sh_prochk_maxpid - sh_prochk_minpid;
|
---|
1309 |
|
---|
1310 | if (sh_prochk_res == NULL)
|
---|
1311 | {
|
---|
1312 | sh_prochk_res = SH_ALLOC(sizeof(short) * sh_prochk_size);
|
---|
1313 | }
|
---|
1314 | memset (sh_prochk_res, 0, sizeof(short) * sh_prochk_size);
|
---|
1315 |
|
---|
1316 | SL_RETURN(0, _("sh_prochk_init"));
|
---|
1317 | }
|
---|
1318 |
|
---|
1319 | int sh_prochk_init (struct mod_type * arg)
|
---|
1320 | {
|
---|
1321 | #ifndef HAVE_PTHREAD
|
---|
1322 | (void) arg;
|
---|
1323 | #endif
|
---|
1324 |
|
---|
1325 | if (ShProchkActive == S_FALSE)
|
---|
1326 | return SH_MOD_FAILED;
|
---|
1327 | #ifdef HAVE_PTHREAD
|
---|
1328 | if (arg != NULL && arg->initval < 0 &&
|
---|
1329 | (sh.flag.isdaemon == S_TRUE || sh.flag.loop == S_TRUE))
|
---|
1330 | {
|
---|
1331 | if (0 == sh_pthread_create(sh_threaded_module_run, (void *)arg))
|
---|
1332 | return SH_MOD_THREAD;
|
---|
1333 | else
|
---|
1334 | return SH_MOD_FAILED;
|
---|
1335 | }
|
---|
1336 | else if (arg != NULL && arg->initval == SH_MOD_THREAD &&
|
---|
1337 | (sh.flag.isdaemon == S_TRUE || sh.flag.loop == S_TRUE))
|
---|
1338 | {
|
---|
1339 | sh_prochk_init_internal();
|
---|
1340 | return SH_MOD_THREAD;
|
---|
1341 | }
|
---|
1342 | #endif
|
---|
1343 | return sh_prochk_init_internal();
|
---|
1344 | }
|
---|
1345 |
|
---|
1346 | int sh_prochk_timer(time_t tcurrent)
|
---|
1347 | {
|
---|
1348 | static time_t lastcheck = 0;
|
---|
1349 |
|
---|
1350 | SL_ENTER(_("sh_prochk_timer"));
|
---|
1351 | if ((time_t) (tcurrent - lastcheck) >= sh_prochk_interval)
|
---|
1352 | {
|
---|
1353 | lastcheck = tcurrent;
|
---|
1354 | SL_RETURN((-1), _("sh_prochk_timer"));
|
---|
1355 | }
|
---|
1356 | SL_RETURN(0, _("sh_prochk_timer"));
|
---|
1357 | }
|
---|
1358 |
|
---|
1359 | int sh_prochk_check(void)
|
---|
1360 | {
|
---|
1361 | int status;
|
---|
1362 |
|
---|
1363 | SL_ENTER(_("sh_prochk_check"));
|
---|
1364 |
|
---|
1365 | SH_MUTEX_LOCK(mutex_proc_check);
|
---|
1366 |
|
---|
1367 | status = 0;
|
---|
1368 |
|
---|
1369 | if( ShProchkActive != S_FALSE )
|
---|
1370 | {
|
---|
1371 | SH_MUTEX_LOCK(mutex_thread_nolog);
|
---|
1372 | sh_error_handle((-1), FIL__, __LINE__, 0, MSG_PCK_CHECK,
|
---|
1373 | (unsigned long) sh_prochk_minpid,
|
---|
1374 | (unsigned long) (sh_prochk_maxpid-1));
|
---|
1375 | SH_MUTEX_UNLOCK(mutex_thread_nolog);
|
---|
1376 |
|
---|
1377 | if (sh_prochk_res) {
|
---|
1378 | memset (sh_prochk_res, 0, sizeof(short) * sh_prochk_size);
|
---|
1379 | }
|
---|
1380 | status = sh_process_check_int(sh_prochk_res);
|
---|
1381 |
|
---|
1382 | if (status != 0)
|
---|
1383 | ShProchkActive = S_FALSE;
|
---|
1384 |
|
---|
1385 | /* clean out old entries which are not marked
|
---|
1386 | * as missing/hidden/fake anymore
|
---|
1387 | */
|
---|
1388 | clean_list (&list_missing);
|
---|
1389 | clean_list (&list_hidden);
|
---|
1390 | clean_list (&list_fake);
|
---|
1391 | }
|
---|
1392 |
|
---|
1393 | SH_MUTEX_UNLOCK(mutex_proc_check);
|
---|
1394 |
|
---|
1395 | SL_RETURN(status, _("sh_prochk_check"));
|
---|
1396 | }
|
---|
1397 |
|
---|
1398 | /* Free our lists and the associated memory
|
---|
1399 | */
|
---|
1400 | int sh_prochk_cleanup(void)
|
---|
1401 | {
|
---|
1402 | SL_ENTER(_("sh_prochk_cleanup"));
|
---|
1403 |
|
---|
1404 | sh_prochk_reconf();
|
---|
1405 |
|
---|
1406 | if (list_missing) {
|
---|
1407 | kill_list(list_missing);
|
---|
1408 | list_missing = NULL;
|
---|
1409 | }
|
---|
1410 | if (list_hidden) {
|
---|
1411 | kill_list(list_hidden);
|
---|
1412 | list_hidden = NULL;
|
---|
1413 | }
|
---|
1414 | if (list_fake) {
|
---|
1415 | kill_list(list_fake);
|
---|
1416 | list_fake = NULL;
|
---|
1417 | }
|
---|
1418 |
|
---|
1419 | SL_RETURN(0, _("sh_prochk_cleanup"));
|
---|
1420 | }
|
---|
1421 |
|
---|
1422 | /* Free our lists and the associated memory
|
---|
1423 | */
|
---|
1424 | int sh_prochk_reconf(void)
|
---|
1425 | {
|
---|
1426 | SL_ENTER(_("sh_prochk_reconf"));
|
---|
1427 |
|
---|
1428 | SH_MUTEX_LOCK(mutex_proc_check);
|
---|
1429 | userdef_maxpid = 0;
|
---|
1430 | sh_prochk_maxpid = 0x8000;
|
---|
1431 | sh_prochk_minpid = 0x0001;
|
---|
1432 | sh_prochk_interval = SH_PROCHK_INTERVAL;
|
---|
1433 | sh_prochk_openvz = S_FALSE;
|
---|
1434 | p_store = 0;
|
---|
1435 | openvz_hidden = 0;
|
---|
1436 |
|
---|
1437 | sh_prochk_free_list(process_check);
|
---|
1438 | process_check = NULL;
|
---|
1439 | if (sh_prochk_res != NULL)
|
---|
1440 | SH_FREE(sh_prochk_res);
|
---|
1441 | sh_prochk_res = NULL;
|
---|
1442 |
|
---|
1443 | if (sh_prochk_psarg)
|
---|
1444 | SH_FREE(sh_prochk_psarg);
|
---|
1445 | sh_prochk_psarg = NULL;
|
---|
1446 | if (sh_prochk_pspath)
|
---|
1447 | SH_FREE(sh_prochk_pspath);
|
---|
1448 | sh_prochk_pspath = NULL;
|
---|
1449 | SH_MUTEX_UNLOCK(mutex_proc_check);
|
---|
1450 |
|
---|
1451 | SL_RETURN(0, _("sh_prochk_reconf"));
|
---|
1452 | }
|
---|
1453 |
|
---|
1454 | /* #if defined (SH_WITH_CLIENT) || defined (SH_STANDALONE) */
|
---|
1455 | #endif
|
---|
1456 |
|
---|
1457 | /* #ifdef SH_USE_PROCESSCHECK */
|
---|
1458 | #endif
|
---|
1459 |
|
---|
1460 |
|
---|
1461 | #ifdef SH_CUTEST
|
---|
1462 | #include "CuTest.h"
|
---|
1463 |
|
---|
1464 | void Test_processcheck_watchlist_ok (CuTest *tc) {
|
---|
1465 | #if defined(SH_USE_PROCESSCHECK) && (defined(SH_WITH_CLIENT) || defined(SH_STANDALONE))
|
---|
1466 | CuAssertTrue(tc, 0 == sh_prochk_add_process("init"));
|
---|
1467 | CuAssertTrue(tc,
|
---|
1468 | S_TRUE == is_in_watchlist(" 1 ? 00:00:00 init", 0));
|
---|
1469 | CuAssertTrue(tc,
|
---|
1470 | S_FALSE == is_in_watchlist(" 1 ? 00:00:00 flix", 0));
|
---|
1471 | CuAssertTrue(tc,
|
---|
1472 | S_TRUE == is_in_watchlist("25218 ? SNs 0:01 /usr/sbin/init -k start -DSSL", 0));
|
---|
1473 | CuAssertTrue(tc,
|
---|
1474 | S_FALSE == is_in_watchlist("25218 ? SNs 0:01 /usr/sbin/apache2 -k start -DSSL", 0));
|
---|
1475 |
|
---|
1476 |
|
---|
1477 | sh_prochk_free_list(process_check);
|
---|
1478 | process_check = NULL;
|
---|
1479 | CuAssertTrue(tc, S_FALSE == is_in_watchlist("init", 0));
|
---|
1480 |
|
---|
1481 | CuAssertTrue(tc, 0 == sh_prochk_add_process("init"));
|
---|
1482 | CuAssertTrue(tc, 0 == sh_prochk_add_process("ssh"));
|
---|
1483 | CuAssertTrue(tc, 0 == sh_prochk_add_process("syslog"));
|
---|
1484 | CuAssertTrue(tc, S_TRUE == is_in_watchlist("init", 0));
|
---|
1485 | CuAssertTrue(tc, S_TRUE == is_in_watchlist("ssh", 0));
|
---|
1486 | CuAssertTrue(tc, S_TRUE == is_in_watchlist("syslog", 0));
|
---|
1487 |
|
---|
1488 | sh_prochk_free_list(process_check);
|
---|
1489 | process_check = NULL;
|
---|
1490 | CuAssertTrue(tc, S_FALSE == is_in_watchlist("init", 0));
|
---|
1491 | CuAssertTrue(tc, S_FALSE == is_in_watchlist("ssh", 0));
|
---|
1492 | CuAssertTrue(tc, S_FALSE == is_in_watchlist("syslog", 0));
|
---|
1493 | #else
|
---|
1494 | (void) tc; /* fix compiler warning */
|
---|
1495 | #endif
|
---|
1496 | return;
|
---|
1497 | }
|
---|
1498 |
|
---|
1499 | void Test_processcheck_listhandle_ok (CuTest *tc) {
|
---|
1500 | #if defined(SH_USE_PROCESSCHECK) && (defined(SH_WITH_CLIENT) || defined(SH_STANDALONE))
|
---|
1501 | CuAssertTrue(tc, S_FALSE == is_in_list(&list_missing, "init", 0));
|
---|
1502 | CuAssertTrue(tc, S_TRUE == is_in_list(&list_missing, "init", 0));
|
---|
1503 | CuAssertTrue(tc, S_FALSE == is_in_list(&list_missing, "foobar", 0));
|
---|
1504 | CuAssertTrue(tc, S_TRUE == is_in_list(&list_missing, "foobar", 0));
|
---|
1505 |
|
---|
1506 | if (list_missing)
|
---|
1507 | kill_list(list_missing);
|
---|
1508 | list_missing = NULL;
|
---|
1509 |
|
---|
1510 | CuAssertTrue(tc, S_FALSE == is_in_list(&list_missing, "init", 0));
|
---|
1511 | CuAssertTrue(tc, S_TRUE == is_in_list(&list_missing, "init", 0));
|
---|
1512 | CuAssertTrue(tc, S_FALSE == is_in_list(&list_missing, "foobar", 0));
|
---|
1513 | CuAssertTrue(tc, S_TRUE == is_in_list(&list_missing, "foobar", 0));
|
---|
1514 |
|
---|
1515 | if (list_missing)
|
---|
1516 | kill_list(list_missing);
|
---|
1517 | list_missing = NULL;
|
---|
1518 |
|
---|
1519 | CuAssertTrue(tc, S_FALSE == is_in_list(&list_missing, "init", 0));
|
---|
1520 | CuAssertTrue(tc, S_TRUE == is_in_list(&list_missing, "init", 0));
|
---|
1521 | CuAssertTrue(tc, S_FALSE == is_in_list(&list_missing, "foobar", 0));
|
---|
1522 | CuAssertTrue(tc, S_TRUE == is_in_list(&list_missing, "foobar", 0));
|
---|
1523 |
|
---|
1524 | CuAssertTrue(tc, 2 == clean_list(&list_missing));
|
---|
1525 | CuAssertPtrNotNull(tc, list_missing);
|
---|
1526 |
|
---|
1527 | CuAssertTrue(tc, S_TRUE == is_in_list(&list_missing, "init", 0));
|
---|
1528 | CuAssertTrue(tc, S_TRUE == is_in_list(&list_missing, "foobar", 0));
|
---|
1529 |
|
---|
1530 | CuAssertTrue(tc, 2 == clean_list(&list_missing));
|
---|
1531 | CuAssertPtrNotNull(tc, list_missing);
|
---|
1532 |
|
---|
1533 | CuAssertTrue(tc, 0 == clean_list(&list_missing));
|
---|
1534 | CuAssertTrue(tc, NULL == list_missing);
|
---|
1535 | #else
|
---|
1536 | (void) tc; /* fix compiler warning */
|
---|
1537 | #endif
|
---|
1538 | return;
|
---|
1539 | }
|
---|
1540 |
|
---|
1541 |
|
---|
1542 | /* #ifdef SH_CUTEST */
|
---|
1543 | #endif
|
---|
1544 |
|
---|