Skip to content
This repository was archived by the owner on Jan 6, 2025. It is now read-only.

Commit a60a97c

Browse files
author
Sarah Jelinek
authored
Merge pull request #35 from GBuella/log_bin_example
Add syscall logging example
2 parents 0c6d03d + 5639458 commit a60a97c

File tree

4 files changed

+601
-0
lines changed

4 files changed

+601
-0
lines changed

‎examples/CMakeLists.txt‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -36,3 +36,6 @@ target_link_libraries(icap PRIVATE syscall_intercept_shared)
3636
add_library(fork_ban SHARED fork_ban.c)
3737

3838
target_link_libraries(fork_ban PRIVATE syscall_intercept_shared)
39+
40+
add_library(syscall_logger SHARED syscall_logger.c syscall_desc.c)
41+
target_link_libraries(syscall_logger PRIVATE syscall_intercept_shared)

‎examples/syscall_desc.c‎

Lines changed: 267 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,267 @@
1+
/*
2+
* Copyright 2017, Intel Corporation
3+
*
4+
* Redistribution and use in source and binary forms, with or without
5+
* modification, are permitted provided that the following conditions
6+
* are met:
7+
*
8+
* * Redistributions of source code must retain the above copyright
9+
* notice, this list of conditions and the following disclaimer.
10+
*
11+
* * Redistributions in binary form must reproduce the above copyright
12+
* notice, this list of conditions and the following disclaimer in
13+
* the documentation and/or other materials provided with the
14+
* distribution.
15+
*
16+
* * Neither the name of the copyright holder nor the names of its
17+
* contributors may be used to endorse or promote products derived
18+
* from this software without specific prior written permission.
19+
*
20+
* THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
21+
* "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
22+
* LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
23+
* A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
24+
* OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
25+
* SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
26+
* LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
27+
* DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
28+
* THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
29+
* (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
30+
* OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
31+
*/
32+
33+
#include "syscall_desc.h"
34+
35+
#include <stddef.h>
36+
#include <syscall.h>
37+
38+
#define SARGS(name, r, ...) \
39+
[SYS_##name] = {#name, r, {__VA_ARGS__, }}
40+
41+
static const struct syscall_desc table[] = {
42+
SARGS(read, rdec, arg_fd, arg_, arg_),
43+
SARGS(write, rdec, arg_fd, arg_, arg_),
44+
SARGS(open, rdec, arg_cstr, arg_, arg_),
45+
SARGS(close, rdec, arg_fd),
46+
SARGS(stat, rdec, arg_cstr, arg_),
47+
SARGS(fstat, rdec, arg_fd, arg_),
48+
SARGS(lstat, rdec, arg_cstr, arg_),
49+
SARGS(poll, rdec, arg_, arg_, arg_),
50+
SARGS(lseek, rdec, arg_fd, arg_, arg_),
51+
SARGS(mmap, rhex, arg_, arg_, arg_, arg_, arg_fd, arg_),
52+
SARGS(mprotect, rdec, arg_, arg_, arg_),
53+
SARGS(munmap, rdec, arg_, arg_, arg_, arg_, arg_fd, arg_),
54+
SARGS(brk, rdec, arg_),
55+
SARGS(rt_sigaction, rdec, arg_, arg_, arg_),
56+
SARGS(rt_sigprocmask, rdec, arg_, arg_, arg_, arg_),
57+
SARGS(rt_sigreturn, rdec, arg_none),
58+
SARGS(ioctl, rdec, arg_fd, arg_, arg_),
59+
SARGS(pread64, rdec, arg_fd, arg_, arg_, arg_),
60+
SARGS(pwrite64, rdec, arg_fd, arg_, arg_, arg_),
61+
SARGS(readv, rdec, arg_fd, arg_, arg_),
62+
SARGS(writev, rdec, arg_fd, arg_, arg_),
63+
SARGS(access, rdec, arg_cstr, arg_),
64+
SARGS(pipe, rdec, arg_),
65+
SARGS(select, rdec, arg_, arg_, arg_, arg_, arg_),
66+
SARGS(sched_yield, rdec, arg_none),
67+
SARGS(mremap, rhex, arg_, arg_, arg_, arg_, arg_),
68+
SARGS(msync, rdec, arg_, arg_, arg_),
69+
SARGS(mincore, rdec, arg_, arg_, arg_),
70+
SARGS(madvise, rdec, arg_, arg_, arg_),
71+
SARGS(shmget, rdec, arg_, arg_, arg_),
72+
SARGS(shmat, rhex, arg_, arg_, arg_),
73+
SARGS(shmctl, rdec, arg_, arg_, arg_),
74+
SARGS(dup, rdec, arg_fd),
75+
SARGS(dup2, rdec, arg_fd, arg_fd),
76+
SARGS(pause, rdec, arg_none),
77+
SARGS(nanosleep, rdec, arg_, arg_),
78+
SARGS(getitimer, rdec, arg_, arg_),
79+
SARGS(alarm, runsigned, arg_),
80+
SARGS(setitimer, rdec, arg_, arg_, arg_),
81+
SARGS(getpid, rdec, arg_none),
82+
SARGS(sendfile, rdec, arg_fd, arg_fd, arg_, arg_),
83+
SARGS(socket, rdec, arg_, arg_, arg_),
84+
SARGS(connect, rdec, arg_fd, arg_, arg_),
85+
SARGS(accept, rdec, arg_fd, arg_, arg_),
86+
SARGS(sendto, rdec, arg_fd, arg_, arg_, arg_),
87+
SARGS(recvfrom, rdec, arg_fd, arg_, arg_, arg_, arg_, arg_),
88+
SARGS(sendmsg, rdec, arg_fd, arg_, arg_),
89+
SARGS(recvmsg, rdec, arg_fd, arg_, arg_),
90+
SARGS(shutdown, rdec, arg_fd, arg_),
91+
SARGS(bind, rdec, arg_fd, arg_, arg_),
92+
SARGS(listen, rdec, arg_fd, arg_),
93+
SARGS(getsockname, rdec, arg_fd, arg_, arg_),
94+
SARGS(getpeername, rdec, arg_fd, arg_, arg_),
95+
SARGS(socketpair, rdec, arg_, arg_, arg_, arg_),
96+
SARGS(setsockopt, rdec, arg_fd, arg_, arg_, arg_, arg_),
97+
SARGS(getsockopt, rdec, arg_fd, arg_, arg_, arg_, arg_),
98+
SARGS(clone, rdec, arg_, arg_, arg_, arg_, arg_, arg_),
99+
SARGS(fork, rdec, arg_none),
100+
SARGS(vfork, rdec, arg_none),
101+
SARGS(execve, rdec, arg_, arg_, arg_),
102+
SARGS(exit, rdec, arg_),
103+
SARGS(wait4, rdec, arg_, arg_, arg_, arg_),
104+
SARGS(kill, rdec, arg_, arg_),
105+
SARGS(uname, rdec, arg_),
106+
SARGS(semget, rdec, arg_, arg_, arg_),
107+
SARGS(semop, rdec, arg_, arg_, arg_),
108+
SARGS(semctl, rdec, arg_, arg_, arg_, arg_, arg_, arg_),
109+
SARGS(shmdt, rdec, arg_),
110+
SARGS(msgget, rdec, arg_, arg_),
111+
SARGS(msgsnd, rdec, arg_, arg_, arg_, arg_),
112+
SARGS(msgrcv, rdec, arg_, arg_, arg_, arg_, arg_),
113+
SARGS(msgctl, rdec, arg_, arg_, arg_),
114+
SARGS(fcntl, rdec, arg_fd, arg_, arg_),
115+
SARGS(flock, rdec, arg_fd, arg_),
116+
SARGS(fsync, rdec, arg_fd),
117+
SARGS(fdatasync, rdec, arg_fd),
118+
SARGS(truncate, rdec, arg_cstr, arg_),
119+
SARGS(ftruncate, rdec, arg_fd, arg_),
120+
SARGS(getdents, rdec, arg_fd, arg_, arg_),
121+
SARGS(getcwd, rdec, arg_, arg_),
122+
SARGS(chdir, rdec, arg_cstr),
123+
SARGS(fchdir, rdec, arg_fd),
124+
SARGS(rename, rdec, arg_cstr, arg_cstr),
125+
SARGS(mkdir, rdec, arg_cstr, arg_),
126+
SARGS(rmdir, rdec, arg_cstr),
127+
SARGS(creat, rdec, arg_cstr, arg_),
128+
SARGS(link, rdec, arg_cstr, arg_cstr),
129+
SARGS(unlink, rdec, arg_cstr),
130+
SARGS(symlink, rdec, arg_cstr, arg_cstr),
131+
SARGS(readlink, rdec, arg_cstr, arg_, arg_),
132+
SARGS(chmod, rdec, arg_cstr, arg_),
133+
SARGS(fchmod, rdec, arg_fd, arg_),
134+
SARGS(chown, rdec, arg_cstr, arg_, arg_),
135+
SARGS(fchown, rdec, arg_fd, arg_, arg_),
136+
SARGS(lchown, rdec, arg_cstr, arg_, arg_),
137+
SARGS(umask, roct, arg_),
138+
SARGS(gettimeofday, rdec, arg_, arg_),
139+
SARGS(getrlimit, rdec, arg_, arg_),
140+
SARGS(getrusage, rdec, arg_, arg_),
141+
SARGS(sysinfo, rdec, arg_, arg_),
142+
SARGS(times, rdec, arg_),
143+
SARGS(ptrace, rhex, arg_, arg_, arg_, arg_),
144+
SARGS(getuid, rdec, arg_none),
145+
SARGS(syslog, rdec, arg_, arg_, arg_),
146+
SARGS(getgid, rdec, arg_none),
147+
SARGS(setuid, rdec, arg_),
148+
SARGS(setgid, rdec, arg_),
149+
SARGS(geteuid, rdec, arg_none),
150+
SARGS(getegid, rdec, arg_none),
151+
SARGS(setpgid, rdec, arg_none),
152+
SARGS(getpgrp, rdec, arg_none),
153+
SARGS(setsid, rdec, arg_none),
154+
SARGS(setreuid, rdec, arg_, arg_),
155+
SARGS(setregid, rdec, arg_, arg_),
156+
SARGS(getgroups, rdec, arg_, arg_),
157+
SARGS(setgroups, rdec, arg_, arg_),
158+
SARGS(setresuid, rdec, arg_, arg_, arg_),
159+
SARGS(getresuid, rdec, arg_, arg_, arg_),
160+
SARGS(setresgid, rdec, arg_, arg_, arg_),
161+
SARGS(getresgid, rdec, arg_, arg_, arg_),
162+
SARGS(getpgid, rdec, arg_),
163+
SARGS(setfsuid, rdec, arg_),
164+
SARGS(setfsgid, rdec, arg_),
165+
SARGS(getsid, rdec, arg_),
166+
SARGS(capget, rdec, arg_, arg_),
167+
SARGS(capset, rdec, arg_, arg_),
168+
SARGS(rt_sigpending, rdec, arg_),
169+
SARGS(rt_sigtimedwait, rdec, arg_, arg_, arg_, arg_),
170+
SARGS(rt_sigqueueinfo, rdec, arg_, arg_, arg_),
171+
SARGS(rt_sigsuspend, rdec, arg_, arg_),
172+
SARGS(sigaltstack, rdec, arg_, arg_),
173+
SARGS(utime, rdec, arg_cstr, arg_),
174+
SARGS(mknod, rdec, arg_cstr, arg_, arg_),
175+
SARGS(uselib, rdec, arg_cstr),
176+
SARGS(personality, rdec, arg_),
177+
SARGS(ustat, rdec, arg_, arg_),
178+
SARGS(statfs, rdec, arg_cstr, arg_),
179+
SARGS(fstatfs, rdec, arg_fd, arg_),
180+
SARGS(sysfs, rdec, arg_, arg_, arg_),
181+
SARGS(getpriority, rdec, arg_, arg_),
182+
SARGS(setpriority, rdec, arg_, arg_, arg_),
183+
SARGS(sched_setparam, rdec, arg_, arg_),
184+
SARGS(sched_getparam, rdec, arg_, arg_),
185+
SARGS(sched_setscheduler, rdec, arg_, arg_, arg_),
186+
SARGS(sched_getscheduler, rdec, arg_),
187+
SARGS(sched_get_priority_max, rdec, arg_),
188+
SARGS(sched_get_priority_min, rdec, arg_),
189+
SARGS(sched_rr_get_interval, rdec, arg_, arg_),
190+
SARGS(mlock, rdec, arg_, arg_),
191+
SARGS(munlock, rdec, arg_, arg_),
192+
SARGS(mlockall, rdec, arg_),
193+
SARGS(munlockall, rdec, arg_none),
194+
SARGS(vhangup, rdec, arg_none),
195+
SARGS(modify_ldt, rdec, arg_, arg_, arg_),
196+
SARGS(pivot_root, rdec, arg_cstr, arg_),
197+
SARGS(_sysctl, rdec, arg_),
198+
SARGS(prctl, rdec, arg_, arg_, arg_, arg_, arg_),
199+
SARGS(arch_prctl, rdec, arg_, arg_, arg_),
200+
SARGS(adjtimex, rdec, arg_),
201+
SARGS(setrlimit, rdec, arg_, arg_),
202+
SARGS(chroot, rdec, arg_cstr),
203+
SARGS(sync, rdec, arg_none),
204+
SARGS(acct, rdec, arg_cstr),
205+
SARGS(settimeofday, rdec, arg_, arg_),
206+
SARGS(mount, rdec, arg_cstr, arg_cstr, arg_, arg_, arg_),
207+
SARGS(umount2, rdec, arg_cstr, arg_),
208+
SARGS(swapon, rdec, arg_cstr, arg_),
209+
SARGS(swapoff, rdec, arg_cstr),
210+
SARGS(reboot, rdec, arg_, arg_, arg_, arg_),
211+
SARGS(sethostname, rdec, arg_, arg_),
212+
SARGS(setdomainname, rdec, arg_, arg_),
213+
SARGS(iopl, rdec, arg_),
214+
SARGS(ioperm, rdec, arg_, arg_, arg_),
215+
SARGS(gettid, rdec, arg_none),
216+
SARGS(readahead, rdec, arg_fd, arg_, arg_),
217+
SARGS(setxattr, rdec, arg_cstr, arg_cstr, arg_, arg_, arg_),
218+
SARGS(lsetxattr, rdec, arg_cstr, arg_cstr, arg_, arg_, arg_),
219+
SARGS(fsetxattr, rdec, arg_fd, arg_cstr, arg_, arg_, arg_),
220+
SARGS(getxattr, rdec, arg_cstr, arg_cstr, arg_, arg_),
221+
SARGS(lgetxattr, rdec, arg_cstr, arg_cstr, arg_, arg_),
222+
SARGS(fgetxattr, rdec, arg_fd, arg_cstr, arg_, arg_),
223+
SARGS(listxattr, rdec, arg_cstr, arg_, arg_),
224+
SARGS(llistxattr, rdec, arg_cstr, arg_, arg_),
225+
SARGS(flistxattr, rdec, arg_cstr, arg_, arg_),
226+
SARGS(removexattr, rdec, arg_cstr, arg_cstr),
227+
SARGS(lremovexattr, rdec, arg_cstr, arg_cstr),
228+
SARGS(fremovexattr, rdec, arg_fd, arg_cstr),
229+
SARGS(tkill, rdec, arg_, arg_),
230+
SARGS(time, rdec, arg_),
231+
SARGS(futex, rdec, arg_, arg_, arg_, arg_, arg_, arg_),
232+
SARGS(sched_setaffinity, rdec, arg_, arg_, arg_),
233+
SARGS(sched_getaffinity, rdec, arg_, arg_, arg_),
234+
SARGS(set_thread_area, rdec, arg_),
235+
SARGS(io_setup, rdec, arg_, arg_),
236+
SARGS(io_destroy, rdec, arg_),
237+
SARGS(io_getevents, rdec, arg_, arg_, arg_, arg_, arg_),
238+
SARGS(io_submit, rdec, arg_, arg_, arg_),
239+
SARGS(io_cancel, rdec, arg_, arg_, arg_),
240+
SARGS(get_thread_area, rdec, arg_),
241+
SARGS(lookup_dcookie, rdec, arg_, arg_, arg_),
242+
SARGS(epoll_create, rdec, arg_),
243+
SARGS(getdents64, rdec, arg_fd, arg_, arg_),
244+
SARGS(set_tid_address, rdec, arg_),
245+
SARGS(semtimedop, rdec, arg_, arg_, arg_, arg_),
246+
SARGS(fadvise64, rdec, arg_fd, arg_, arg_, arg_),
247+
SARGS(timer_create, rdec, arg_, arg_, arg_),
248+
SARGS(timer_settime, rdec, arg_, arg_, arg_, arg_),
249+
SARGS(timer_gettime, rdec, arg_, arg_),
250+
SARGS(timer_getoverrun, rdec, arg_),
251+
SARGS(timer_delete, rdec, arg_)
252+
/* to be continued... at this point I got tired */
253+
};
254+
255+
#undef SARGS
256+
257+
const struct syscall_desc *
258+
get_syscall_desc(long syscall_number)
259+
{
260+
if (syscall_number < 0)
261+
return NULL;
262+
263+
if ((size_t)syscall_number >= (sizeof(table) / sizeof(table[0])))
264+
return NULL;
265+
266+
return table + syscall_number;
267+
}

‎examples/syscall_desc.h‎

Lines changed: 58 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,58 @@
1+
/*
2+
* Copyright 2017, Intel Corporation
3+
*
4+
* Redistribution and use in source and binary forms, with or without
5+
* modification, are permitted provided that the following conditions
6+
* are met:
7+
*
8+
* * Redistributions of source code must retain the above copyright
9+
* notice, this list of conditions and the following disclaimer.
10+
*
11+
* * Redistributions in binary form must reproduce the above copyright
12+
* notice, this list of conditions and the following disclaimer in
13+
* the documentation and/or other materials provided with the
14+
* distribution.
15+
*
16+
* * Neither the name of the copyright holder nor the names of its
17+
* contributors may be used to endorse or promote products derived
18+
* from this software without specific prior written permission.
19+
*
20+
* THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
21+
* "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
22+
* LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
23+
* A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
24+
* OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
25+
* SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
26+
* LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
27+
* DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
28+
* THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
29+
* (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
30+
* OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
31+
*/
32+
33+
#ifndef SYSCALL_INTERCEPT_EXAMPLE_LOGGING_H
34+
#define SYSCALL_INTERCEPT_EXAMPLE_LOGGING_H
35+
36+
enum arg_type {
37+
arg_none,
38+
arg_fd,
39+
arg_cstr,
40+
arg_ /* no special formatting implemented yet, print as hex number */
41+
};
42+
43+
enum return_type {
44+
rhex,
45+
rdec,
46+
runsigned,
47+
roct
48+
};
49+
50+
struct syscall_desc {
51+
const char *name;
52+
enum return_type return_type;
53+
enum arg_type args[6];
54+
};
55+
56+
const struct syscall_desc *get_syscall_desc(long syscall_number);
57+
58+
#endif

0 commit comments

Comments
 (0)