new(driver,userspace): PT_MODES for file modes

fntlnz · fntlnz · commit 96de56464142 · 2019-08-12T11:05:35.000Z
Signed-off-by: Lorenzo Fontana &lt;lo@linux.com&gt;
diff --git a/driver/CMakeLists.txt b/driver/CMakeLists.txt
@@ -45,6 +45,7 @@ set(DRIVER_SOURCES
 	event_table.c
 	fillers_table.c
 	flags_table.c
+	modes_table.c
 	main.c
 	ppm.h
 	ppm_events.c
diff --git a/driver/bpf/filler_helpers.h b/driver/bpf/filler_helpers.h
@@ -830,6 +830,7 @@ static __always_inline int __bpf_val_to_ring(struct filler_data *data,
 		len = sizeof(u16);
 		break;
 	case PT_FLAGS32:
+	case PT_MODES:
 	case PT_UINT32:
 	case PT_UID:
 	case PT_GID:
diff --git a/driver/bpf/fillers.h b/driver/bpf/fillers.h
@@ -4183,6 +4183,7 @@ FILLER(sys_fchmodat_x, true)
 	unsigned long val;
 	int res;
 	long retval;
+	unsigned int mode;
 
 	retval = bpf_syscall_get_retval(data->ctx);
 	res = bpf_val_to_ring(data, retval);
@@ -4211,8 +4212,9 @@ FILLER(sys_fchmodat_x, true)
 	/*
 	 * mode
 	 */
-	val = bpf_syscall_get_argument(data, 2);
-	res = bpf_val_to_ring(data, val);
+	mode = bpf_syscall_get_argument(data, 2);
+	mode = chmod_modes_to_scap(mode);
+	res = bpf_val_to_ring(data, mode);
 
 	return res;
 }
diff --git a/driver/event_table.c b/driver/event_table.c
@@ -325,11 +325,11 @@ const struct ppm_event_info g_event_info[PPM_EVENT_MAX] = {
 	/* PPME_SYSCALL_LINKAT_2_E */{"linkat", EC_FILE, EF_NONE, 0},
 	/* PPME_SYSCALL_LINKAT_2_X */{"linkat", EC_FILE, EF_NONE, 6, {{"res", PT_ERRNO, PF_DEC}, {"olddir", PT_FD, PF_DEC}, {"oldpath", PT_CHARBUF, PF_NA}, {"newdir", PT_FD, PF_DEC}, {"newpath", PT_CHARBUF, PF_NA}, {"flags", PT_FLAGS32, PF_HEX, linkat_flags} } },
 	/* PPME_SYSCALL_FCHMODAT_E */{"fchmodat", EC_FILE, EF_MODIFIES_STATE, 0},
-	/* PPME_SYSCALL_FCHMODAT_X */{"fchmodat", EC_FILE, EF_MODIFIES_STATE, 4, {{"res", PT_ERRNO, PF_DEC}, {"dirfd", PT_FD, PF_DEC}, {"filename", PT_FSPATH, PF_NA}, {"mode", PT_UINT32, PF_OCT} } },
+	/* PPME_SYSCALL_FCHMODAT_X */{"fchmodat", EC_FILE, EF_MODIFIES_STATE, 4, {{"res", PT_ERRNO, PF_DEC}, {"dirfd", PT_FD, PF_DEC}, {"filename", PT_FSPATH, PF_NA}, {"mode", PT_MODES, PF_OCT, chmod_modes} } },
 	/* PPME_SYSCALL_CHMOD_E */{"chmod", EC_FILE, EF_MODIFIES_STATE, 0},
-	/* PPME_SYSCALL_CHMOD_X */{"chmod", EC_FILE, EF_MODIFIES_STATE, 3, {{"res", PT_ERRNO, PF_DEC}, {"filename", PT_FSPATH, PF_NA}, {"mode", PT_UINT32, PF_OCT} } },
+	/* PPME_SYSCALL_CHMOD_X */{"chmod", EC_FILE, EF_MODIFIES_STATE, 3, {{"res", PT_ERRNO, PF_DEC}, {"filename", PT_FSPATH, PF_NA}, {"mode", PT_MODES, PF_OCT, chmod_modes} } },
 	/* PPME_SYSCALL_FCHMOD_E */{"fchmod", EC_FILE, EF_MODIFIES_STATE, 0},
-	/* PPME_SYSCALL_FCHMOD_X */{"fchmod", EC_FILE, EF_MODIFIES_STATE, 3, {{"res", PT_ERRNO, PF_DEC}, {"fd", PT_FD, PF_DEC}, {"mode", PT_UINT32, PF_OCT} } }
+	/* PPME_SYSCALL_FCHMOD_X */{"fchmod", EC_FILE, EF_MODIFIES_STATE, 3, {{"res", PT_ERRNO, PF_DEC}, {"fd", PT_FD, PF_DEC}, {"mode", PT_MODES, PF_OCT, chmod_modes} } }
 
 	/* NB: Starting from scap version 1.2, event types will no longer be changed when an event is modified, and the only kind of change permitted for pre-existent events is adding parameters.
 	 *     New event types are allowed only for new syscalls or new internal events.
diff --git a/driver/modes_table.c b/driver/modes_table.c
@@ -0,0 +1,26 @@
+/*
+
+Copyright (c) 2013-2019 Draios Inc. dba Sysdig.
+
+This file is dual licensed under either the MIT or GPL 2. See MIT.txt
+or GPL2.txt for full copies of the license.
+
+*/
+
+#include "ppm_events_public.h"
+
+const struct ppm_name_value chmod_modes[] = {
+    {"S_IXOTH", PPM_S_IXOTH},
+    {"S_IWOTH", PPM_S_IWOTH},
+    {"S_IROTH", PPM_S_IROTH},
+    {"S_IXGRP", PPM_S_IXGRP},
+    {"S_IWGRP", PPM_S_IWGRP},
+    {"S_IRGRP", PPM_S_IRGRP},
+    {"S_IXUSR", PPM_S_IXUSR},
+    {"S_IWUSR", PPM_S_IWUSR},
+    {"S_IRUSR", PPM_S_IRUSR},
+    {"S_ISVTX", PPM_S_ISVTX},
+    {"S_ISGID", PPM_S_ISGID},
+    {"S_ISUID", PPM_S_ISUID},
+    {0, 0},
+};
diff --git a/driver/ppm_events.c b/driver/ppm_events.c
@@ -657,6 +657,7 @@ int val_to_ring(struct event_filler_arguments *args, uint64_t val, u32 val_len,
 		break;
 	case PT_FLAGS32:
 	case PT_UINT32:
+	case PT_MODES:
 	case PT_UID:
 	case PT_GID:
 	case PT_SIGSET:
diff --git a/driver/ppm_events_public.h b/driver/ppm_events_public.h
@@ -1364,7 +1364,8 @@ enum ppm_param_type {
 	PT_IPV6NET = 39, /* An IPv6 network. */
 	PT_IPADDR = 40,  /* Either an IPv4 or IPv6 address. The length indicates which one it is. */
 	PT_IPNET = 41,  /* Either an IPv4 or IPv6 network. The length indicates which one it is. */
-	PT_MAX = 42 /* array size */
+	PT_MAX = 42, /* array size */
+	PT_MODES = 43 /* a 32 bit bitmask to represent file modes. */
 };
 
 enum ppm_print_format {
@@ -1494,6 +1495,7 @@ extern const struct ppm_name_value access_flags[];
 extern const struct ppm_name_value pf_flags[];
 extern const struct ppm_name_value unlinkat_flags[];
 extern const struct ppm_name_value linkat_flags[];
+extern const struct ppm_name_value chmod_modes[];
 
 extern const struct ppm_param_info sockopt_dynamic_param[];
 extern const struct ppm_param_info ptrace_dynamic_param[];
diff --git a/driver/ppm_fillers.c b/driver/ppm_fillers.c
@@ -4842,7 +4842,7 @@ int f_sys_fchmodat_x(struct event_filler_arguments *args)
 	 * mode
 	 */
 	syscall_get_arguments_deprecated(current, args->regs, 2, 1, &val);
-	res = val_to_ring(args, val, 0, false, 0);
+	res = val_to_ring(args, chmod_modes_to_scap(val), 0, false, 0);
 	if (unlikely(res != PPM_SUCCESS))
 		return res;
 
@@ -4871,8 +4871,8 @@ int f_sys_chmod_x(struct event_filler_arguments *args)
 	/*
 	 * mode
 	 */
-	syscall_get_arguments_deprecated(current, args->regs, 1, 1, &val);
-	res = val_to_ring(args, val, 0, false, 0);
+	syscall_get_arguments_deprecated(current, args->regs, 2, 1, &val);
+	res = val_to_ring(args, chmod_modes_to_scap(val), 0, false, 0);
 	if (unlikely(res != PPM_SUCCESS))
 		return res;
 
@@ -4902,8 +4902,8 @@ int f_sys_fchmod_x(struct event_filler_arguments *args)
 	/*
 	 * mode
 	 */
-	syscall_get_arguments_deprecated(current, args->regs, 1, 1, &val);
-	res = val_to_ring(args, val, 0, false, 0);
+	syscall_get_arguments_deprecated(current, args->regs, 2, 1, &val);
+	res = val_to_ring(args, chmod_modes_to_scap(val), 0, false, 0);
 	if (unlikely(res != PPM_SUCCESS))
 		return res;
 
diff --git a/driver/ppm_flag_helpers.h b/driver/ppm_flag_helpers.h
@@ -1268,4 +1268,58 @@ static __always_inline u32 linkat_flags_to_scap(unsigned long flags)
 	return res;
 }
 
+static __always_inline u32 chmod_modes_to_scap(unsigned long modes)
+{
+	u32 res = 0;
+	if (modes & S_IRUSR)
+		res |= PPM_S_IRUSR;
+
+	if (modes & S_IWUSR)
+		res |= PPM_S_IWUSR;
+
+	if (modes & S_IXUSR)
+		res |= PPM_S_IXUSR;
+
+	/*
+	 * PPM_S_IRWXU == S_IRUSR | S_IWUSR | S_IXUSR
+	 */
+
+	if (modes & S_IRGRP)
+		res |= PPM_S_IRGRP;
+
+	if (modes & S_IWGRP)
+		res |= PPM_S_IWGRP;
+
+	if (modes & S_IXGRP)
+		res |= PPM_S_IXGRP;
+
+	/*
+	 * PPM_S_IRWXG == S_IRGRP | S_IWGRP | S_IXGRP
+	 */
+
+	if (modes & S_IROTH)
+		res |= PPM_S_IROTH;
+
+	if (modes & S_IWOTH)
+		res |= PPM_S_IWOTH;
+
+	if (modes & S_IXOTH)
+		res |= PPM_S_IXOTH;
+
+	/*
+	 * PPM_S_IRWXO == S_IROTH | S_IWOTH | S_IXOTH
+	 */
+
+	if (modes & S_ISUID)
+		res |= PPM_S_ISUID;
+
+	if (modes & S_ISGID)
+		res |= PPM_S_ISGID;
+
+	if (modes & S_ISVTX)
+		res |= PPM_S_ISVTX;
+
+	return res;
+}
+
 #endif /* PPM_FLAG_HELPERS_H_ */
diff --git a/userspace/libscap/CMakeLists.txt b/userspace/libscap/CMakeLists.txt
@@ -32,7 +32,8 @@ list(APPEND targetfiles
 	syscall_info_table.c
 	../../driver/dynamic_params_table.c
 	../../driver/event_table.c
-	../../driver/flags_table.c)
+	../../driver/flags_table.c
+	../../driver/modes_table.c)
 
 if(CMAKE_SYSTEM_NAME MATCHES "Linux")
 	list(APPEND targetfiles
diff --git a/userspace/libsinsp/chisel_api.cpp b/userspace/libsinsp/chisel_api.cpp
@@ -96,6 +96,7 @@ uint32_t lua_cbacks::rawval_to_lua_stack(lua_State *ls, uint8_t* rawval, ppm_par
 			return 1;
 		case PT_FLAGS32:
 		case PT_UINT32:
+		case PT_MODES:
 		case PT_UID:
 		case PT_GID:
 			lua_pushnumber(ls, *(uint32_t*)rawval);
diff --git a/userspace/libsinsp/cursestable.cpp b/userspace/libsinsp/cursestable.cpp
@@ -100,6 +100,7 @@ curses_table::curses_table(sinsp_cursesui* parent, sinsp* inspector, sinsp_table
 	m_colsizes[PT_FLAGS8] = 32;
 	m_colsizes[PT_FLAGS16] = 32;
 	m_colsizes[PT_FLAGS32] = 32;
+	m_colsizes[PT_MODES] = 32;
 	m_colsizes[PT_UID] = 12;
 	m_colsizes[PT_GID] = 12;
 	m_colsizes[PT_DOUBLE] = 8;
diff --git a/userspace/libsinsp/event.cpp b/userspace/libsinsp/event.cpp
@@ -1185,6 +1185,37 @@ Json::Value sinsp_evt::get_param_as_json(uint32_t id, OUT const char** resolved_
 				ret["flags"].append(flags->name);
 			}
 
+			break;
+		}
+	case PT_MODES:
+		{
+			uint32_t val = *(uint32_t *)payload & (((uint64_t)1 << payload_len * 8) - 1);
+			ret["val"] = val;
+			ret["modes"] = Json::arrayValue;
+
+			const struct ppm_name_value *modes = (const struct ppm_name_value *)m_info->params[id].info;
+			uint32_t initial_val = val;
+
+			while(modes != NULL && modes->name != NULL && modes->value != initial_val)
+			{
+				// If mode is 0, then initial_val needs to be 0 for the mode to be resolved
+				if((modes->value == 0 && initial_val == 0) ||
+				   (modes->value != 0 && (val & modes->value) == modes->value && val != 0))
+				{
+					ret["modes"].append(modes->name);
+
+					// We remove current modes value to avoid duplicates
+					val &= ~modes->value;
+				}
+
+				modes++;
+			}
+
+			if(modes != NULL && modes->name != NULL)
+			{
+				ret["modes"].append(modes->name);
+			}
+
 			break;
 		}
 	case PT_UID:
@@ -2007,6 +2038,55 @@ const char* sinsp_evt::get_param_as_str(uint32_t id, OUT const char** resolved_s
 							  flags->name);
 			}
 
+			break;
+		}
+	case PT_MODES:
+		{
+			uint32_t val = *(uint32_t *)payload;
+			SET_NUMERIC_FORMAT(prfmt, param_fmt, PRIo32, PRId32, PRIX32);
+			snprintf(&m_paramstr_storage[0],
+					m_paramstr_storage.size(),
+					prfmt, val);
+
+			const struct ppm_name_value *modes = (const struct ppm_name_value *)m_info->params[id].info;
+			const char *separator = "";
+			uint32_t initial_val = val;
+			uint32_t j = 0;
+
+			while(modes != NULL && modes->name != NULL && modes->value != initial_val)
+			{
+				// If mode is 0, then initial_val needs to be 0 for the mode to be resolved
+				if((modes->value == 0 && initial_val == 0) ||
+				   (modes->value != 0 && (val & modes->value) == modes->value && val != 0))
+				{
+					if(m_resolved_paramstr_storage.size() < j + strlen(separator) + strlen(modes->name))
+					{
+						m_resolved_paramstr_storage.resize(m_resolved_paramstr_storage.size() * 2);
+					}
+
+					j += snprintf(&m_resolved_paramstr_storage[j],
+								m_resolved_paramstr_storage.size(),
+								"%s%s",
+								separator,
+								modes->name);
+
+					separator = "|";
+					// We remove current modes value to avoid duplicates
+					val &= ~modes->value;
+				}
+
+				modes++;
+			}
+
+			if(modes != NULL && modes->name != NULL)
+			{
+				j += snprintf(&m_resolved_paramstr_storage[j],
+							  m_resolved_paramstr_storage.size(),
+							  "%s%s",
+							  separator,
+							  modes->name);
+			}
+
 			break;
 		}
 	case PT_ABSTIME:
diff --git a/userspace/libsinsp/filter.cpp b/userspace/libsinsp/filter.cpp
@@ -467,6 +467,7 @@ bool flt_compare(cmpop op, ppm_param_type type, void* operand1, void* operand2,
 		return flt_compare_uint64(op, (uint64_t)*(uint16_t*)operand1, (uint64_t)*(uint16_t*)operand2);
 	case PT_UINT32:
 	case PT_FLAGS32:
+	case PT_MODES:
 	case PT_BOOL:
 	case PT_IPV4ADDR:
 		return flt_compare_uint64(op, (uint64_t)*(uint32_t*)operand1, (uint64_t)*(uint32_t*)operand2);
@@ -598,6 +599,7 @@ bool flt_compare_avg(cmpop op,
 		return flt_compare_uint64(op, u641, u642);
 	case PT_UINT32:
 	case PT_FLAGS32:
+	case PT_MODES:
 	case PT_BOOL:
 	case PT_IPV4ADDR:
 	case PT_IPV6ADDR:
diff --git a/userspace/libsinsp/table.cpp b/userspace/libsinsp/table.cpp
@@ -1424,6 +1424,7 @@ uint32_t sinsp_table::get_field_len(uint32_t id)
 		return 2;
 	case PT_UINT32:
 	case PT_FLAGS32:
+	case PT_MODES:
 	case PT_BOOL:
 	case PT_IPV4ADDR:
 	case PT_SIGSET:
diff --git a/userspace/libsinsp/utils.cpp b/userspace/libsinsp/utils.cpp
@@ -1290,6 +1290,8 @@ const char* param_type_to_string(ppm_param_type pt)
 		return "FLAGS16";
 	case PT_FLAGS32:
 		return "FLAGS32";
+	case PT_MODES:
+		return "MODES";
 	case PT_UID:
 		return "UID";
 	case PT_GID:
diff --git a/userspace/libsinsp/value_parser.cpp b/userspace/libsinsp/value_parser.cpp
@@ -97,6 +97,7 @@ size_t sinsp_filter_value_parser::string_to_rawval(const char* str, uint32_t len
 			break;
 		case PT_FLAGS32:
 		case PT_UINT32:
+		case PT_MODES:
 			*(uint32_t*)storage = sinsp_numparser::parseu32(str);
 			parsed_len = sizeof(uint32_t);
 			break;
