From 2408afa7c975216378a254eacacb86925068f77e Mon Sep 17 00:00:00 2001 From: Paul Moore Date: Thu, 23 May 2013 16:41:12 -0400 Subject: tools: rename some of the tools in preparation for installation Some of the tools are quite handy and would likely be useful for developers incorporating libseccomp into their applications so let's go ahead and namespace the tools in preparation for installing them. Signed-off-by: Paul Moore --- tests/regression | 11 +- tools/.gitignore | 8 +- tools/Makefile | 8 +- tools/arch_detect.c | 88 ------------- tools/bpf_disasm.c | 322 ---------------------------------------------- tools/bpf_sim.c | 309 -------------------------------------------- tools/scmp_app_inspector | 103 +++++++++++++++ tools/scmp_arch_detect.c | 88 +++++++++++++ tools/scmp_bpf_disasm.c | 322 ++++++++++++++++++++++++++++++++++++++++++++++ tools/scmp_bpf_sim.c | 309 ++++++++++++++++++++++++++++++++++++++++++++ tools/scmp_sys_resolver.c | 95 ++++++++++++++ tools/sys_inspector | 103 --------------- tools/sys_resolver.c | 95 -------------- 13 files changed, 932 insertions(+), 929 deletions(-) delete mode 100644 tools/arch_detect.c delete mode 100644 tools/bpf_disasm.c delete mode 100644 tools/bpf_sim.c create mode 100755 tools/scmp_app_inspector create mode 100644 tools/scmp_arch_detect.c create mode 100644 tools/scmp_bpf_disasm.c create mode 100644 tools/scmp_bpf_sim.c create mode 100644 tools/scmp_sys_resolver.c delete mode 100755 tools/sys_inspector delete mode 100644 tools/sys_resolver.c diff --git a/tests/regression b/tests/regression index b9f81f8..6e3d6d1 100755 --- a/tests/regression +++ b/tests/regression @@ -22,7 +22,10 @@ # GLBL_ARCH_SUPPORT="x86 x86_64 x32 arm" -GLBL_SYS_RESOLVER="../tools/sys_resolver" + +GLBL_SYS_ARCH="../tools/scmp_arch_detect" +GLBL_SYS_RESOLVER="../tools/scmp_sys_resolver" +GLBL_SYS_SIM="../tools/scmp_bpf_sim" #### # functions @@ -287,7 +290,7 @@ function run_test_bpf_sim_fuzz() { # simulate the fuzzed syscall data against the BPF filter, we # don't verify the resulting action since we're just testing for # stability - allow=$(../tools/bpf_sim -f $tmpfile -s $sys \ + allow=$($GLBL_SYS_SIM -f $tmpfile -s $sys \ ${arg[0]} ${arg[1]} ${arg[2]} ${arg[3]} ${arg[4]} \ ${arg[5]}) rc=$? @@ -473,7 +476,7 @@ function run_test_bpf_sim() { # simulate the specifed syscall against the BPF filter # and verify the results - action=$(../tools/bpf_sim -a $simarch -f $tmpfile \ + action=$($GLBL_SYS_SIM -a $simarch -f $tmpfile \ -s $sys ${arg[0]} ${arg[1]} ${arg[2]} \ ${arg[3]} ${arg[4]} ${arg[5]}) rc=$? @@ -804,7 +807,7 @@ else fi # determine the current system's architecture -arch=$(../tools/arch_detect) +arch=$($GLBL_SYS_ARCH) # display the test output and run the requested tests echo "=============== $(date) ===============" >&$logfd diff --git a/tools/.gitignore b/tools/.gitignore index 0822833..af4051c 100644 --- a/tools/.gitignore +++ b/tools/.gitignore @@ -1,4 +1,4 @@ -bpf_disasm -bpf_sim -sys_resolver -arch_detect +scmp_bpf_disasm +scmp_bpf_sim +scmp_sys_resolver +scmp_arch_detect diff --git a/tools/Makefile b/tools/Makefile index db6b609..0d8a0ab 100644 --- a/tools/Makefile +++ b/tools/Makefile @@ -33,10 +33,10 @@ include $(TOPDIR)/configure.mk LDFLAGS := ../src/libseccomp.a -TOOLS = bpf_disasm \ - bpf_sim \ - sys_resolver \ - arch_detect +TOOLS = scmp_bpf_disasm \ + scmp_bpf_sim \ + scmp_sys_resolver \ + scmp_arch_detect DEPS = $(TOOLS:%=%.d) diff --git a/tools/arch_detect.c b/tools/arch_detect.c deleted file mode 100644 index 0aca5a8..0000000 --- a/tools/arch_detect.c +++ /dev/null @@ -1,88 +0,0 @@ -/** - * Architecture Detector - * - * Copyright (c) 2013 Red Hat - * Author: Paul Moore - */ - -/* - * This library is free software; you can redistribute it and/or modify it - * under the terms of version 2.1 of the GNU Lesser General Public License as - * published by the Free Software Foundation. - * - * This library is distributed in the hope that it will be useful, but WITHOUT - * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or - * FITNESS FOR A PARTICULAR PURPOSE. See the GNU Lesser General Public License - * for more details. - * - * You should have received a copy of the GNU Lesser General Public License - * along with this library; if not, see . - */ - -#include -#include -#include -#include - -#include - -/** - * Print the usage information to stderr and exit - * @param program the name of the current program being invoked - * - * Print the usage information and exit with EINVAL. - * - */ -static void exit_usage(const char *program) -{ - fprintf(stderr, - "usage: %s [-h] [-t]\n", - program); - exit(EINVAL); -} - -/** - * main - */ -int main(int argc, char *argv[]) -{ - int opt; - int token = 0; - uint32_t arch; - - /* parse the command line */ - while ((opt = getopt(argc, argv, "ht"))> 0) { - switch (opt) { - case 't': - token = 1; - break; - case 'h': - default: - /* usage information */ - exit_usage(argv[0]); - } - } - - arch = seccomp_arch_native(); - if (token == 0) { - switch (arch) { - case SCMP_ARCH_X86: - printf("x86\n"); - break; - case SCMP_ARCH_X86_64: - printf("x86_64\n"); - break; - case SCMP_ARCH_X32: - printf("x32\n"); - break; - case SCMP_ARCH_ARM: - printf("arm\n"); - break; - default: - printf("unknown\n"); - } - } else - printf("%d\n", arch); - - return 0; -} diff --git a/tools/bpf_disasm.c b/tools/bpf_disasm.c deleted file mode 100644 index 5b63fe8..0000000 --- a/tools/bpf_disasm.c +++ /dev/null @@ -1,322 +0,0 @@ -/** - * BPF Disassembler - * - * Copyright (c) 2012 Red Hat - * Author: Paul Moore - */ - -/* - * This library is free software; you can redistribute it and/or modify it - * under the terms of version 2.1 of the GNU Lesser General Public License as - * published by the Free Software Foundation. - * - * This library is distributed in the hope that it will be useful, but WITHOUT - * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or - * FITNESS FOR A PARTICULAR PURPOSE. See the GNU Lesser General Public License - * for more details. - * - * You should have received a copy of the GNU Lesser General Public License - * along with this library; if not, see . - */ - -#include -#include -#include -#include -#include -#include -#include -#include -#include -#include - -#include "bpf.h" - -#define _OP_FMT "%-3s" - -/** - * Decode the BPF operand - * @param bpf the BPF instruction - * - * Decode the BPF operand and print it to stdout. - * - */ -static void bpf_decode_op(const bpf_instr_raw *bpf) -{ - switch (bpf->code) { - case BPF_LD+BPF_W+BPF_IMM: - case BPF_LD+BPF_W+BPF_ABS: - case BPF_LD+BPF_W+BPF_IND: - case BPF_LD+BPF_W+BPF_MEM: - case BPF_LD+BPF_W+BPF_LEN: - case BPF_LD+BPF_W+BPF_MSH: - printf(_OP_FMT, "ld"); - break; - case BPF_LD+BPF_H+BPF_IMM: - case BPF_LD+BPF_H+BPF_ABS: - case BPF_LD+BPF_H+BPF_IND: - case BPF_LD+BPF_H+BPF_MEM: - case BPF_LD+BPF_H+BPF_LEN: - case BPF_LD+BPF_H+BPF_MSH: - printf(_OP_FMT, "ldh"); - break; - case BPF_LD+BPF_B+BPF_IMM: - case BPF_LD+BPF_B+BPF_ABS: - case BPF_LD+BPF_B+BPF_IND: - case BPF_LD+BPF_B+BPF_MEM: - case BPF_LD+BPF_B+BPF_LEN: - case BPF_LD+BPF_B+BPF_MSH: - printf(_OP_FMT, "ldb"); - break; - case BPF_LDX+BPF_W+BPF_IMM: - case BPF_LDX+BPF_W+BPF_ABS: - case BPF_LDX+BPF_W+BPF_IND: - case BPF_LDX+BPF_W+BPF_MEM: - case BPF_LDX+BPF_W+BPF_LEN: - case BPF_LDX+BPF_W+BPF_MSH: - case BPF_LDX+BPF_H+BPF_IMM: - case BPF_LDX+BPF_H+BPF_ABS: - case BPF_LDX+BPF_H+BPF_IND: - case BPF_LDX+BPF_H+BPF_MEM: - case BPF_LDX+BPF_H+BPF_LEN: - case BPF_LDX+BPF_H+BPF_MSH: - case BPF_LDX+BPF_B+BPF_IMM: - case BPF_LDX+BPF_B+BPF_ABS: - case BPF_LDX+BPF_B+BPF_IND: - case BPF_LDX+BPF_B+BPF_MEM: - case BPF_LDX+BPF_B+BPF_LEN: - case BPF_LDX+BPF_B+BPF_MSH: - printf(_OP_FMT, "ldx"); - break; - case BPF_ST: - printf(_OP_FMT, "st"); - break; - case BPF_STX: - printf(_OP_FMT, "stx"); - break; - case BPF_ALU+BPF_ADD+BPF_K: - case BPF_ALU+BPF_ADD+BPF_X: - printf(_OP_FMT, "add"); - break; - case BPF_ALU+BPF_SUB+BPF_K: - case BPF_ALU+BPF_SUB+BPF_X: - printf(_OP_FMT, "sub"); - break; - case BPF_ALU+BPF_MUL+BPF_K: - case BPF_ALU+BPF_MUL+BPF_X: - printf(_OP_FMT, "mul"); - break; - case BPF_ALU+BPF_DIV+BPF_K: - case BPF_ALU+BPF_DIV+BPF_X: - printf(_OP_FMT, "div"); - break; - case BPF_ALU+BPF_OR+BPF_K: - case BPF_ALU+BPF_OR+BPF_X: - printf(_OP_FMT, "or"); - break; - case BPF_ALU+BPF_AND+BPF_K: - case BPF_ALU+BPF_AND+BPF_X: - printf(_OP_FMT, "and"); - break; - case BPF_ALU+BPF_LSH+BPF_K: - case BPF_ALU+BPF_LSH+BPF_X: - printf(_OP_FMT, "lsh"); - break; - case BPF_ALU+BPF_RSH+BPF_K: - case BPF_ALU+BPF_RSH+BPF_X: - printf(_OP_FMT, "rsh"); - break; - case BPF_ALU+BPF_NEG+BPF_K: - case BPF_ALU+BPF_NEG+BPF_X: - printf(_OP_FMT, "neg"); - break; - case BPF_JMP+BPF_JA+BPF_K: - case BPF_JMP+BPF_JA+BPF_X: - printf(_OP_FMT, "jmp"); - break; - case BPF_JMP+BPF_JEQ+BPF_K: - case BPF_JMP+BPF_JEQ+BPF_X: - printf(_OP_FMT, "jeq"); - break; - case BPF_JMP+BPF_JGT+BPF_K: - case BPF_JMP+BPF_JGT+BPF_X: - printf(_OP_FMT, "jgt"); - break; - case BPF_JMP+BPF_JGE+BPF_K: - case BPF_JMP+BPF_JGE+BPF_X: - printf(_OP_FMT, "jge"); - break; - case BPF_JMP+BPF_JSET+BPF_K: - case BPF_JMP+BPF_JSET+BPF_X: - printf(_OP_FMT, "jset"); - break; - case BPF_RET+BPF_K: - case BPF_RET+BPF_X: - case BPF_RET+BPF_A: - printf(_OP_FMT, "ret"); - break; - case BPF_MISC+BPF_TAX: - printf(_OP_FMT, "tax"); - break; - case BPF_MISC+BPF_TXA: - printf(_OP_FMT, "txa"); - break; - default: - printf(_OP_FMT, "???"); - } -} - -/** - * Decode the BPF arguments (JT, JF, and K) - * @param bpf the BPF instruction - * @param line the current line number - * - * Decode the BPF arguments (JT, JF, and K) and print the relevant information - * to stdout based on the operand. - * - */ -static void bpf_decode_args(const bpf_instr_raw *bpf, unsigned int line) -{ - switch (BPF_CLASS(bpf->code)) { - case BPF_LD: - case BPF_LDX: - switch (BPF_MODE(bpf->code)) { - case BPF_ABS: - printf("$data[%u]", bpf->k); - break; - case BPF_MEM: - printf("$temp[%u]", bpf->k); - break; - } - break; - case BPF_ST: - case BPF_STX: - printf("$temp[%u]", bpf->k); - break; - case BPF_ALU: - if (BPF_SRC(bpf->code) == BPF_K) { - switch (BPF_OP(bpf->code)) { - case BPF_OR: - case BPF_AND: - printf("0x%.8x", bpf->k); - break; - default: - printf("%u", bpf->k); - } - } else - printf("%u", bpf->k); - break; - case BPF_JMP: - if (BPF_OP(bpf->code) == BPF_JA) { - printf("%.4u", (line + 1) + bpf->k); - } else { - printf("%-4u true:%.4u false:%.4u", - bpf->k, - (line + 1) + bpf->jt, - (line + 1) + bpf->jf); - } - break; - case BPF_RET: - if (BPF_RVAL(bpf->code) == BPF_A) { - /* XXX - accumulator? */ - printf("$acc"); - } else if (BPF_SRC(bpf->code) == BPF_K) { - uint32_t act = bpf->k & SECCOMP_RET_ACTION; - uint32_t data = bpf->k & SECCOMP_RET_DATA; - - switch (act) { - case SECCOMP_RET_KILL: - printf("KILL"); - break; - case SECCOMP_RET_TRAP: - printf("TRAP"); - break; - case SECCOMP_RET_ERRNO: - printf("ERRNO(%u)", data); - break; - case SECCOMP_RET_TRACE: - printf("TRACE(%u)", data); - break; - case SECCOMP_RET_ALLOW: - printf("ALLOW"); - break; - default: - printf("0x%.8x", bpf->k); - } - } else if (BPF_SRC(bpf->code) == BPF_X) { - /* XXX - any idea? */ - printf("???"); - } - break; - case BPF_MISC: - break; - default: - printf("???"); - } -} - -/** - * Perform a simple decoding of the BPF program - * @param file the BPF program - * - * Read the BPF program and display the instructions. Returns zero on success, - * negative values on failure. - * - */ -static int bpf_decode(FILE *file) -{ - unsigned int line = 0; - size_t len; - bpf_instr_raw bpf; - - /* header */ - printf(" line OP JT JF K\n"); - printf("=================================\n"); - - while ((len = fread(&bpf, sizeof(bpf), 1, file))) { - printf(" %.4u: 0x%.2x 0x%.2x 0x%.2x 0x%.8x", - line, bpf.code, bpf.jt, bpf.jf, bpf.k); - - printf(" "); - bpf_decode_op(&bpf); - printf(" "); - bpf_decode_args(&bpf, line); - printf("\n"); - - line++; - } - - if (ferror(file)) - return errno; - return 0; -} - -/** - * main - */ -int main(int argc, char *argv[]) -{ - int rc; - FILE *file; - - if (argc > 2) { - fprintf(stderr, "usage: %s []\n", argv[0]); - return EINVAL; - } - - if (argc == 2) { - file = fopen(argv[1], "r"); - if (file == NULL) { - fprintf(stderr, "error: unable to open \"%s\" (%s)\n", - argv[1], strerror(errno)); - return errno; - } - } else - file = stdin; - - rc = bpf_decode(file); - fclose(file); - - return rc; -} - diff --git a/tools/bpf_sim.c b/tools/bpf_sim.c deleted file mode 100644 index 94c6648..0000000 --- a/tools/bpf_sim.c +++ /dev/null @@ -1,309 +0,0 @@ -/** - * BPF Simulator - * - * Copyright (c) 2012 Red Hat - * Author: Paul Moore - */ - -/* - * This library is free software; you can redistribute it and/or modify it - * under the terms of version 2.1 of the GNU Lesser General Public License as - * published by the Free Software Foundation. - * - * This library is distributed in the hope that it will be useful, but WITHOUT - * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or - * FITNESS FOR A PARTICULAR PURPOSE. See the GNU Lesser General Public License - * for more details. - * - * You should have received a copy of the GNU Lesser General Public License - * along with this library; if not, see . - */ - -#include -#include -#include -#include -#include -#include -#include -#include -#include -#include -#include - -#include "bpf.h" - -#define BPF_PRG_MAX_LEN 4096 - -/** - * BPF simulator machine state - */ -struct sim_state { - uint32_t acc; - uint32_t temp[BPF_SCRATCH_SIZE]; -}; - -struct bpf_program { - size_t i_cnt; - bpf_instr_raw *i; -}; - -static unsigned int opt_verbose = 0; - -/** - * Print the usage information to stderr and exit - * @param program the name of the current program being invoked - * - * Print the usage information and exit with EINVAL. - * - */ -static void exit_usage(const char *program) -{ - fprintf(stderr, "usage: %s -f [-v]" - " -a -s [-0 ] ... [-5 ]\n", - program); - exit(EINVAL); -} - -/** - * Handle a simulator fault - * @param rc the error or return code - * - * Print a "FAULT" to stderr to indicate a simulator fault, and an errno value - * if the simulator is running in verbose mode, then exit with EFAULT. - * - */ -static void exit_fault(unsigned int rc) -{ - if (opt_verbose) - fprintf(stderr, "FAULT: errno = %d\n", rc); - else - fprintf(stderr, "FAULT\n"); - exit(EFAULT); -} - -/** - * Handle a BPF program error - * @param rc the error or return code - * @param line the line number - * - * Print an "ERROR" to stderr to indicate a program error, and an errno value - * if the simulator is running in verbose mode, then exit with ENOEXEC. - * - */ -static void exit_error(unsigned int rc, unsigned int line) -{ - if (opt_verbose) - fprintf(stderr, "ERROR: errno = %d, line = %d\n", rc, line); - else - fprintf(stderr, "ERROR\n"); - exit(ENOEXEC); -} - -/** - * Handle a simulator return/action - * @param action the return value - * @param line the line number - * - * Display the action to stdout and exit with 0. - * - */ -static void end_action(uint32_t action, unsigned int line) -{ - uint32_t act = action & SECCOMP_RET_ACTION; - uint32_t data = action & SECCOMP_RET_DATA; - - switch (act) { - case SECCOMP_RET_KILL: - fprintf(stdout, "KILL\n"); - break; - case SECCOMP_RET_TRAP: - fprintf(stdout, "TRAP\n"); - break; - case SECCOMP_RET_ERRNO: - fprintf(stdout, "ERRNO(%u)\n", data); - break; - case SECCOMP_RET_TRACE: - fprintf(stdout, "TRACE(%u)\n", data); - break; - case SECCOMP_RET_ALLOW: - fprintf(stdout, "ALLOW\n"); - break; - default: - exit_error(EDOM, line); - } - - exit(0); -} - -/** - * Execute a BPF program - * @param prg the loaded BPF program - * @param sys_data the syscall record being tested - * - * Simulate the BPF program with the given syscall record. - * - */ -static void bpf_execute(const struct bpf_program *prg, - const struct seccomp_data *sys_data) -{ - unsigned int ip, ip_c; - struct sim_state state; - bpf_instr_raw *bpf; - unsigned char *sys_data_b = (unsigned char *)sys_data; - - /* initialize the machine state */ - ip_c = 0; - ip = 0; - memset(&state, 0, sizeof(state)); - - while (ip < prg->i_cnt) { - /* get the instruction and bump the ip */ - ip_c = ip; - bpf = &prg->i[ip++]; - - switch (bpf->code) { - case BPF_LD+BPF_W+BPF_ABS: - if (bpf->k < BPF_SYSCALL_MAX) - state.acc = *((uint32_t *)&sys_data_b[bpf->k]); - else - exit_error(ERANGE, ip_c); - break; - case BPF_ALU+BPF_OR+BPF_K: - state.acc |= bpf->k; - break; - case BPF_ALU+BPF_AND+BPF_K: - state.acc &= bpf->k; - break; - case BPF_JMP+BPF_JA: - ip += bpf->k; - break; - case BPF_JMP+BPF_JEQ+BPF_K: - if (state.acc == bpf->k) - ip += bpf->jt; - else - ip += bpf->jf; - break; - case BPF_JMP+BPF_JGT+BPF_K: - if (state.acc > bpf->k) - ip += bpf->jt; - else - ip += bpf->jf; - break; - case BPF_JMP+BPF_JGE+BPF_K: - if (state.acc >= bpf->k) - ip += bpf->jt; - else - ip += bpf->jf; - break; - case BPF_RET+BPF_K: - end_action(bpf->k, ip_c); - break; - default: - /* since we don't support the full bpf language just - * yet, this could be either a fault or an error, we'll - * treat it as a fault until we provide full support */ - exit_fault(EOPNOTSUPP); - } - } - - /* if we've reached here there is a problem with the program */ - exit_error(ERANGE, ip_c); -} - -/** - * main - */ -int main(int argc, char *argv[]) -{ - int opt; - char *opt_file = NULL; - FILE *file; - size_t file_read_len; - struct seccomp_data sys_data; - struct bpf_program bpf_prg; - - /* clear the syscall record */ - memset(&sys_data, 0, sizeof(sys_data)); - - /* parse the command line */ - while ((opt = getopt(argc, argv, "a:f:h:s:v0:1:2:3:4:5:")) > 0) { - switch (opt) { - case 'a': - if (strcmp(optarg, "x86") == 0) - sys_data.arch = AUDIT_ARCH_I386; - else if (strcmp(optarg, "x86_64") == 0) - sys_data.arch = AUDIT_ARCH_X86_64; - else if (strcmp(optarg, "x32") == 0) - sys_data.arch = AUDIT_ARCH_X86_64; - else if (strcmp(optarg, "arm") == 0) - sys_data.arch = AUDIT_ARCH_ARM; - else - exit_fault(EINVAL); - break; - case 'f': - opt_file = strdup(optarg); - if (opt_file == NULL) - exit_fault(ENOMEM); - break; - case 's': - sys_data.nr = strtol(optarg, NULL, 0); - break; - case 'v': - opt_verbose = 1; - break; - case '0': - sys_data.args[0] = strtoull(optarg, NULL, 0); - break; - case '1': - sys_data.args[1] = strtoull(optarg, NULL, 0); - break; - case '2': - sys_data.args[2] = strtoull(optarg, NULL, 0); - break; - case '3': - sys_data.args[3] = strtoull(optarg, NULL, 0); - break; - case '4': - sys_data.args[4] = strtoull(optarg, NULL, 0); - break; - case '5': - sys_data.args[5] = strtoull(optarg, NULL, 0); - break; - case 'h': - default: - /* usage information */ - exit_usage(argv[0]); - } - } - - /* allocate space for the bpf program */ - /* XXX - we should make this dynamic */ - bpf_prg.i_cnt = 0; - bpf_prg.i = calloc(BPF_PRG_MAX_LEN, sizeof(*bpf_prg.i)); - if (bpf_prg.i == NULL) - exit_fault(ENOMEM); - - /* load the bpf program */ - file = fopen(opt_file, "r"); - if (file == NULL) - exit_fault(errno); - do { - file_read_len = fread(&(bpf_prg.i[bpf_prg.i_cnt]), - sizeof(*bpf_prg.i), 1, file); - if (file_read_len == 1) - bpf_prg.i_cnt++; - - /* check the size */ - if (bpf_prg.i_cnt == BPF_PRG_MAX_LEN) - exit_fault(E2BIG); - } while (file_read_len > 0); - fclose(file); - - /* execute the bpf program */ - bpf_execute(&bpf_prg, &sys_data); - - /* we should never reach here */ - exit_fault(EFAULT); - return 0; -} diff --git a/tools/scmp_app_inspector b/tools/scmp_app_inspector new file mode 100755 index 0000000..37f880b --- /dev/null +++ b/tools/scmp_app_inspector @@ -0,0 +1,103 @@ +#!/bin/bash + +# +# Runtime syscall inspector +# +# Copyright (c) 2012 Red Hat +# Author: Paul Moore +# + +# +# This library is free software; you can redistribute it and/or modify it +# under the terms of version 2.1 of the GNU Lesser General Public License as +# published by the Free Software Foundation. +# +# This library is distributed in the hope that it will be useful, but WITHOUT +# ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or +# FITNESS FOR A PARTICULAR PURPOSE. See the GNU Lesser General Public License +# for more details. +# +# You should have received a copy of the GNU Lesser General Public License +# along with this library; if not, see . +# + +#### +# functions + +function verify_deps() { + [[ -z "$1" ]] && return + if ! which "$1" >& /dev/null; then + echo "error: install \"$1\" and include it in your \$PATH" + exit 1 + fi +} + +#### +# main + +# verify script dependencies +verify_deps strace +verify_deps sed +verify_deps sort +verify_deps uniq + +# get the command line arguments +opt_freq=0 +opt_args=0 +opt_out="/proc/self/fd/1" +while getopts "afo:h" opt; do + case $opt in + a) + opt_args=1 + ;; + f) + opt_freq=1 + ;; + o) + opt_out="$OPTARG" + ;; + h|*) + echo "usage $0 [-f] [-a] [-o ] []" + exit 1 + esac +done +shift $(expr $OPTIND - 1) + +# generate a temporary output file +raw=$(mktemp -t strace-raw_XXXXXX) +out="$raw-out" + +# capture the strace output +strace -o $raw -- $* + +# filter the raw strace +if [[ $opt_args -eq 0 ]]; then + if [[ $opt_freq -eq 0 ]]; then + cat $raw | sed -e 's/(.*//' | sort -u > $out + else + cat $raw | sed -e 's/(.*//' | sort | uniq -c | sort -nr > $out + fi +else + if [[ $opt_freq -eq 0 ]]; then + cat $raw | sed -e 's/)[ \t]*=.*$/)/' \ + | sed -e 's/".*,/"...",/g;s/\/\*.*\*\//.../g' \ + | sed -e 's/0x[a-f0-9]\+/.../g' \ + | sort -u > $out + else + cat $raw | sed -e 's/)[ \t]*=.*$/)/' \ + | sed -e 's/".*,/"...",/g;s/\/\*.*\*\//.../g' \ + | sed -e 's/0x[a-f0-9]\+/.../g' \ + | sort | uniq -c | sort -nr > $out + fi +fi + +# display the output +echo "============================================================" > $opt_out +echo "Syscall Report (\"$*\")" >> $opt_out +[[ $opt_freq -eq 1 ]] && echo " freq syscall" >> $opt_out +echo "============================================================" >> $opt_out +cat $out >> $opt_out + +# cleanup and exit +rm -f $raw $out +exit 0 diff --git a/tools/scmp_arch_detect.c b/tools/scmp_arch_detect.c new file mode 100644 index 0000000..0aca5a8 --- /dev/null +++ b/tools/scmp_arch_detect.c @@ -0,0 +1,88 @@ +/** + * Architecture Detector + * + * Copyright (c) 2013 Red Hat + * Author: Paul Moore + */ + +/* + * This library is free software; you can redistribute it and/or modify it + * under the terms of version 2.1 of the GNU Lesser General Public License as + * published by the Free Software Foundation. + * + * This library is distributed in the hope that it will be useful, but WITHOUT + * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or + * FITNESS FOR A PARTICULAR PURPOSE. See the GNU Lesser General Public License + * for more details. + * + * You should have received a copy of the GNU Lesser General Public License + * along with this library; if not, see . + */ + +#include +#include +#include +#include + +#include + +/** + * Print the usage information to stderr and exit + * @param program the name of the current program being invoked + * + * Print the usage information and exit with EINVAL. + * + */ +static void exit_usage(const char *program) +{ + fprintf(stderr, + "usage: %s [-h] [-t]\n", + program); + exit(EINVAL); +} + +/** + * main + */ +int main(int argc, char *argv[]) +{ + int opt; + int token = 0; + uint32_t arch; + + /* parse the command line */ + while ((opt = getopt(argc, argv, "ht"))> 0) { + switch (opt) { + case 't': + token = 1; + break; + case 'h': + default: + /* usage information */ + exit_usage(argv[0]); + } + } + + arch = seccomp_arch_native(); + if (token == 0) { + switch (arch) { + case SCMP_ARCH_X86: + printf("x86\n"); + break; + case SCMP_ARCH_X86_64: + printf("x86_64\n"); + break; + case SCMP_ARCH_X32: + printf("x32\n"); + break; + case SCMP_ARCH_ARM: + printf("arm\n"); + break; + default: + printf("unknown\n"); + } + } else + printf("%d\n", arch); + + return 0; +} diff --git a/tools/scmp_bpf_disasm.c b/tools/scmp_bpf_disasm.c new file mode 100644 index 0000000..5b63fe8 --- /dev/null +++ b/tools/scmp_bpf_disasm.c @@ -0,0 +1,322 @@ +/** + * BPF Disassembler + * + * Copyright (c) 2012 Red Hat + * Author: Paul Moore + */ + +/* + * This library is free software; you can redistribute it and/or modify it + * under the terms of version 2.1 of the GNU Lesser General Public License as + * published by the Free Software Foundation. + * + * This library is distributed in the hope that it will be useful, but WITHOUT + * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or + * FITNESS FOR A PARTICULAR PURPOSE. See the GNU Lesser General Public License + * for more details. + * + * You should have received a copy of the GNU Lesser General Public License + * along with this library; if not, see . + */ + +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include + +#include "bpf.h" + +#define _OP_FMT "%-3s" + +/** + * Decode the BPF operand + * @param bpf the BPF instruction + * + * Decode the BPF operand and print it to stdout. + * + */ +static void bpf_decode_op(const bpf_instr_raw *bpf) +{ + switch (bpf->code) { + case BPF_LD+BPF_W+BPF_IMM: + case BPF_LD+BPF_W+BPF_ABS: + case BPF_LD+BPF_W+BPF_IND: + case BPF_LD+BPF_W+BPF_MEM: + case BPF_LD+BPF_W+BPF_LEN: + case BPF_LD+BPF_W+BPF_MSH: + printf(_OP_FMT, "ld"); + break; + case BPF_LD+BPF_H+BPF_IMM: + case BPF_LD+BPF_H+BPF_ABS: + case BPF_LD+BPF_H+BPF_IND: + case BPF_LD+BPF_H+BPF_MEM: + case BPF_LD+BPF_H+BPF_LEN: + case BPF_LD+BPF_H+BPF_MSH: + printf(_OP_FMT, "ldh"); + break; + case BPF_LD+BPF_B+BPF_IMM: + case BPF_LD+BPF_B+BPF_ABS: + case BPF_LD+BPF_B+BPF_IND: + case BPF_LD+BPF_B+BPF_MEM: + case BPF_LD+BPF_B+BPF_LEN: + case BPF_LD+BPF_B+BPF_MSH: + printf(_OP_FMT, "ldb"); + break; + case BPF_LDX+BPF_W+BPF_IMM: + case BPF_LDX+BPF_W+BPF_ABS: + case BPF_LDX+BPF_W+BPF_IND: + case BPF_LDX+BPF_W+BPF_MEM: + case BPF_LDX+BPF_W+BPF_LEN: + case BPF_LDX+BPF_W+BPF_MSH: + case BPF_LDX+BPF_H+BPF_IMM: + case BPF_LDX+BPF_H+BPF_ABS: + case BPF_LDX+BPF_H+BPF_IND: + case BPF_LDX+BPF_H+BPF_MEM: + case BPF_LDX+BPF_H+BPF_LEN: + case BPF_LDX+BPF_H+BPF_MSH: + case BPF_LDX+BPF_B+BPF_IMM: + case BPF_LDX+BPF_B+BPF_ABS: + case BPF_LDX+BPF_B+BPF_IND: + case BPF_LDX+BPF_B+BPF_MEM: + case BPF_LDX+BPF_B+BPF_LEN: + case BPF_LDX+BPF_B+BPF_MSH: + printf(_OP_FMT, "ldx"); + break; + case BPF_ST: + printf(_OP_FMT, "st"); + break; + case BPF_STX: + printf(_OP_FMT, "stx"); + break; + case BPF_ALU+BPF_ADD+BPF_K: + case BPF_ALU+BPF_ADD+BPF_X: + printf(_OP_FMT, "add"); + break; + case BPF_ALU+BPF_SUB+BPF_K: + case BPF_ALU+BPF_SUB+BPF_X: + printf(_OP_FMT, "sub"); + break; + case BPF_ALU+BPF_MUL+BPF_K: + case BPF_ALU+BPF_MUL+BPF_X: + printf(_OP_FMT, "mul"); + break; + case BPF_ALU+BPF_DIV+BPF_K: + case BPF_ALU+BPF_DIV+BPF_X: + printf(_OP_FMT, "div"); + break; + case BPF_ALU+BPF_OR+BPF_K: + case BPF_ALU+BPF_OR+BPF_X: + printf(_OP_FMT, "or"); + break; + case BPF_ALU+BPF_AND+BPF_K: + case BPF_ALU+BPF_AND+BPF_X: + printf(_OP_FMT, "and"); + break; + case BPF_ALU+BPF_LSH+BPF_K: + case BPF_ALU+BPF_LSH+BPF_X: + printf(_OP_FMT, "lsh"); + break; + case BPF_ALU+BPF_RSH+BPF_K: + case BPF_ALU+BPF_RSH+BPF_X: + printf(_OP_FMT, "rsh"); + break; + case BPF_ALU+BPF_NEG+BPF_K: + case BPF_ALU+BPF_NEG+BPF_X: + printf(_OP_FMT, "neg"); + break; + case BPF_JMP+BPF_JA+BPF_K: + case BPF_JMP+BPF_JA+BPF_X: + printf(_OP_FMT, "jmp"); + break; + case BPF_JMP+BPF_JEQ+BPF_K: + case BPF_JMP+BPF_JEQ+BPF_X: + printf(_OP_FMT, "jeq"); + break; + case BPF_JMP+BPF_JGT+BPF_K: + case BPF_JMP+BPF_JGT+BPF_X: + printf(_OP_FMT, "jgt"); + break; + case BPF_JMP+BPF_JGE+BPF_K: + case BPF_JMP+BPF_JGE+BPF_X: + printf(_OP_FMT, "jge"); + break; + case BPF_JMP+BPF_JSET+BPF_K: + case BPF_JMP+BPF_JSET+BPF_X: + printf(_OP_FMT, "jset"); + break; + case BPF_RET+BPF_K: + case BPF_RET+BPF_X: + case BPF_RET+BPF_A: + printf(_OP_FMT, "ret"); + break; + case BPF_MISC+BPF_TAX: + printf(_OP_FMT, "tax"); + break; + case BPF_MISC+BPF_TXA: + printf(_OP_FMT, "txa"); + break; + default: + printf(_OP_FMT, "???"); + } +} + +/** + * Decode the BPF arguments (JT, JF, and K) + * @param bpf the BPF instruction + * @param line the current line number + * + * Decode the BPF arguments (JT, JF, and K) and print the relevant information + * to stdout based on the operand. + * + */ +static void bpf_decode_args(const bpf_instr_raw *bpf, unsigned int line) +{ + switch (BPF_CLASS(bpf->code)) { + case BPF_LD: + case BPF_LDX: + switch (BPF_MODE(bpf->code)) { + case BPF_ABS: + printf("$data[%u]", bpf->k); + break; + case BPF_MEM: + printf("$temp[%u]", bpf->k); + break; + } + break; + case BPF_ST: + case BPF_STX: + printf("$temp[%u]", bpf->k); + break; + case BPF_ALU: + if (BPF_SRC(bpf->code) == BPF_K) { + switch (BPF_OP(bpf->code)) { + case BPF_OR: + case BPF_AND: + printf("0x%.8x", bpf->k); + break; + default: + printf("%u", bpf->k); + } + } else + printf("%u", bpf->k); + break; + case BPF_JMP: + if (BPF_OP(bpf->code) == BPF_JA) { + printf("%.4u", (line + 1) + bpf->k); + } else { + printf("%-4u true:%.4u false:%.4u", + bpf->k, + (line + 1) + bpf->jt, + (line + 1) + bpf->jf); + } + break; + case BPF_RET: + if (BPF_RVAL(bpf->code) == BPF_A) { + /* XXX - accumulator? */ + printf("$acc"); + } else if (BPF_SRC(bpf->code) == BPF_K) { + uint32_t act = bpf->k & SECCOMP_RET_ACTION; + uint32_t data = bpf->k & SECCOMP_RET_DATA; + + switch (act) { + case SECCOMP_RET_KILL: + printf("KILL"); + break; + case SECCOMP_RET_TRAP: + printf("TRAP"); + break; + case SECCOMP_RET_ERRNO: + printf("ERRNO(%u)", data); + break; + case SECCOMP_RET_TRACE: + printf("TRACE(%u)", data); + break; + case SECCOMP_RET_ALLOW: + printf("ALLOW"); + break; + default: + printf("0x%.8x", bpf->k); + } + } else if (BPF_SRC(bpf->code) == BPF_X) { + /* XXX - any idea? */ + printf("???"); + } + break; + case BPF_MISC: + break; + default: + printf("???"); + } +} + +/** + * Perform a simple decoding of the BPF program + * @param file the BPF program + * + * Read the BPF program and display the instructions. Returns zero on success, + * negative values on failure. + * + */ +static int bpf_decode(FILE *file) +{ + unsigned int line = 0; + size_t len; + bpf_instr_raw bpf; + + /* header */ + printf(" line OP JT JF K\n"); + printf("=================================\n"); + + while ((len = fread(&bpf, sizeof(bpf), 1, file))) { + printf(" %.4u: 0x%.2x 0x%.2x 0x%.2x 0x%.8x", + line, bpf.code, bpf.jt, bpf.jf, bpf.k); + + printf(" "); + bpf_decode_op(&bpf); + printf(" "); + bpf_decode_args(&bpf, line); + printf("\n"); + + line++; + } + + if (ferror(file)) + return errno; + return 0; +} + +/** + * main + */ +int main(int argc, char *argv[]) +{ + int rc; + FILE *file; + + if (argc > 2) { + fprintf(stderr, "usage: %s []\n", argv[0]); + return EINVAL; + } + + if (argc == 2) { + file = fopen(argv[1], "r"); + if (file == NULL) { + fprintf(stderr, "error: unable to open \"%s\" (%s)\n", + argv[1], strerror(errno)); + return errno; + } + } else + file = stdin; + + rc = bpf_decode(file); + fclose(file); + + return rc; +} + diff --git a/tools/scmp_bpf_sim.c b/tools/scmp_bpf_sim.c new file mode 100644 index 0000000..94c6648 --- /dev/null +++ b/tools/scmp_bpf_sim.c @@ -0,0 +1,309 @@ +/** + * BPF Simulator + * + * Copyright (c) 2012 Red Hat + * Author: Paul Moore + */ + +/* + * This library is free software; you can redistribute it and/or modify it + * under the terms of version 2.1 of the GNU Lesser General Public License as + * published by the Free Software Foundation. + * + * This library is distributed in the hope that it will be useful, but WITHOUT + * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or + * FITNESS FOR A PARTICULAR PURPOSE. See the GNU Lesser General Public License + * for more details. + * + * You should have received a copy of the GNU Lesser General Public License + * along with this library; if not, see . + */ + +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include + +#include "bpf.h" + +#define BPF_PRG_MAX_LEN 4096 + +/** + * BPF simulator machine state + */ +struct sim_state { + uint32_t acc; + uint32_t temp[BPF_SCRATCH_SIZE]; +}; + +struct bpf_program { + size_t i_cnt; + bpf_instr_raw *i; +}; + +static unsigned int opt_verbose = 0; + +/** + * Print the usage information to stderr and exit + * @param program the name of the current program being invoked + * + * Print the usage information and exit with EINVAL. + * + */ +static void exit_usage(const char *program) +{ + fprintf(stderr, "usage: %s -f [-v]" + " -a -s [-0 ] ... [-5 ]\n", + program); + exit(EINVAL); +} + +/** + * Handle a simulator fault + * @param rc the error or return code + * + * Print a "FAULT" to stderr to indicate a simulator fault, and an errno value + * if the simulator is running in verbose mode, then exit with EFAULT. + * + */ +static void exit_fault(unsigned int rc) +{ + if (opt_verbose) + fprintf(stderr, "FAULT: errno = %d\n", rc); + else + fprintf(stderr, "FAULT\n"); + exit(EFAULT); +} + +/** + * Handle a BPF program error + * @param rc the error or return code + * @param line the line number + * + * Print an "ERROR" to stderr to indicate a program error, and an errno value + * if the simulator is running in verbose mode, then exit with ENOEXEC. + * + */ +static void exit_error(unsigned int rc, unsigned int line) +{ + if (opt_verbose) + fprintf(stderr, "ERROR: errno = %d, line = %d\n", rc, line); + else + fprintf(stderr, "ERROR\n"); + exit(ENOEXEC); +} + +/** + * Handle a simulator return/action + * @param action the return value + * @param line the line number + * + * Display the action to stdout and exit with 0. + * + */ +static void end_action(uint32_t action, unsigned int line) +{ + uint32_t act = action & SECCOMP_RET_ACTION; + uint32_t data = action & SECCOMP_RET_DATA; + + switch (act) { + case SECCOMP_RET_KILL: + fprintf(stdout, "KILL\n"); + break; + case SECCOMP_RET_TRAP: + fprintf(stdout, "TRAP\n"); + break; + case SECCOMP_RET_ERRNO: + fprintf(stdout, "ERRNO(%u)\n", data); + break; + case SECCOMP_RET_TRACE: + fprintf(stdout, "TRACE(%u)\n", data); + break; + case SECCOMP_RET_ALLOW: + fprintf(stdout, "ALLOW\n"); + break; + default: + exit_error(EDOM, line); + } + + exit(0); +} + +/** + * Execute a BPF program + * @param prg the loaded BPF program + * @param sys_data the syscall record being tested + * + * Simulate the BPF program with the given syscall record. + * + */ +static void bpf_execute(const struct bpf_program *prg, + const struct seccomp_data *sys_data) +{ + unsigned int ip, ip_c; + struct sim_state state; + bpf_instr_raw *bpf; + unsigned char *sys_data_b = (unsigned char *)sys_data; + + /* initialize the machine state */ + ip_c = 0; + ip = 0; + memset(&state, 0, sizeof(state)); + + while (ip < prg->i_cnt) { + /* get the instruction and bump the ip */ + ip_c = ip; + bpf = &prg->i[ip++]; + + switch (bpf->code) { + case BPF_LD+BPF_W+BPF_ABS: + if (bpf->k < BPF_SYSCALL_MAX) + state.acc = *((uint32_t *)&sys_data_b[bpf->k]); + else + exit_error(ERANGE, ip_c); + break; + case BPF_ALU+BPF_OR+BPF_K: + state.acc |= bpf->k; + break; + case BPF_ALU+BPF_AND+BPF_K: + state.acc &= bpf->k; + break; + case BPF_JMP+BPF_JA: + ip += bpf->k; + break; + case BPF_JMP+BPF_JEQ+BPF_K: + if (state.acc == bpf->k) + ip += bpf->jt; + else + ip += bpf->jf; + break; + case BPF_JMP+BPF_JGT+BPF_K: + if (state.acc > bpf->k) + ip += bpf->jt; + else + ip += bpf->jf; + break; + case BPF_JMP+BPF_JGE+BPF_K: + if (state.acc >= bpf->k) + ip += bpf->jt; + else + ip += bpf->jf; + break; + case BPF_RET+BPF_K: + end_action(bpf->k, ip_c); + break; + default: + /* since we don't support the full bpf language just + * yet, this could be either a fault or an error, we'll + * treat it as a fault until we provide full support */ + exit_fault(EOPNOTSUPP); + } + } + + /* if we've reached here there is a problem with the program */ + exit_error(ERANGE, ip_c); +} + +/** + * main + */ +int main(int argc, char *argv[]) +{ + int opt; + char *opt_file = NULL; + FILE *file; + size_t file_read_len; + struct seccomp_data sys_data; + struct bpf_program bpf_prg; + + /* clear the syscall record */ + memset(&sys_data, 0, sizeof(sys_data)); + + /* parse the command line */ + while ((opt = getopt(argc, argv, "a:f:h:s:v0:1:2:3:4:5:")) > 0) { + switch (opt) { + case 'a': + if (strcmp(optarg, "x86") == 0) + sys_data.arch = AUDIT_ARCH_I386; + else if (strcmp(optarg, "x86_64") == 0) + sys_data.arch = AUDIT_ARCH_X86_64; + else if (strcmp(optarg, "x32") == 0) + sys_data.arch = AUDIT_ARCH_X86_64; + else if (strcmp(optarg, "arm") == 0) + sys_data.arch = AUDIT_ARCH_ARM; + else + exit_fault(EINVAL); + break; + case 'f': + opt_file = strdup(optarg); + if (opt_file == NULL) + exit_fault(ENOMEM); + break; + case 's': + sys_data.nr = strtol(optarg, NULL, 0); + break; + case 'v': + opt_verbose = 1; + break; + case '0': + sys_data.args[0] = strtoull(optarg, NULL, 0); + break; + case '1': + sys_data.args[1] = strtoull(optarg, NULL, 0); + break; + case '2': + sys_data.args[2] = strtoull(optarg, NULL, 0); + break; + case '3': + sys_data.args[3] = strtoull(optarg, NULL, 0); + break; + case '4': + sys_data.args[4] = strtoull(optarg, NULL, 0); + break; + case '5': + sys_data.args[5] = strtoull(optarg, NULL, 0); + break; + case 'h': + default: + /* usage information */ + exit_usage(argv[0]); + } + } + + /* allocate space for the bpf program */ + /* XXX - we should make this dynamic */ + bpf_prg.i_cnt = 0; + bpf_prg.i = calloc(BPF_PRG_MAX_LEN, sizeof(*bpf_prg.i)); + if (bpf_prg.i == NULL) + exit_fault(ENOMEM); + + /* load the bpf program */ + file = fopen(opt_file, "r"); + if (file == NULL) + exit_fault(errno); + do { + file_read_len = fread(&(bpf_prg.i[bpf_prg.i_cnt]), + sizeof(*bpf_prg.i), 1, file); + if (file_read_len == 1) + bpf_prg.i_cnt++; + + /* check the size */ + if (bpf_prg.i_cnt == BPF_PRG_MAX_LEN) + exit_fault(E2BIG); + } while (file_read_len > 0); + fclose(file); + + /* execute the bpf program */ + bpf_execute(&bpf_prg, &sys_data); + + /* we should never reach here */ + exit_fault(EFAULT); + return 0; +} diff --git a/tools/scmp_sys_resolver.c b/tools/scmp_sys_resolver.c new file mode 100644 index 0000000..5bc593e --- /dev/null +++ b/tools/scmp_sys_resolver.c @@ -0,0 +1,95 @@ +/** + * Syscall resolver + * + * Copyright (c) 2012 Red Hat + * Author: Paul Moore + */ + +/* + * This library is free software; you can redistribute it and/or modify it + * under the terms of version 2.1 of the GNU Lesser General Public License as + * published by the Free Software Foundation. + * + * This library is distributed in the hope that it will be useful, but WITHOUT + * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or + * FITNESS FOR A PARTICULAR PURPOSE. See the GNU Lesser General Public License + * for more details. + * + * You should have received a copy of the GNU Lesser General Public License + * along with this library; if not, see . + */ + +#include +#include +#include +#include +#include + +#include "../src/arch.h" +#include "../src/arch-x86.h" +#include "../src/arch-x86_64.h" +#include "../src/arch-x32.h" +#include "../src/arch-arm.h" + +/** + * Print the usage information to stderr and exit + * @param program the name of the current program being invoked + * + * Print the usage information and exit with EINVAL. + * + */ +static void exit_usage(const char *program) +{ + fprintf(stderr, + "usage: %s [-h] [-a ] [-t] \n", + program); + exit(EINVAL); +} + +/** + * main + */ +int main(int argc, char *argv[]) +{ + int opt; + int translate = 0; + const struct arch_def *arch = arch_def_native; + int sys_num; + + /* parse the command line */ + while ((opt = getopt(argc, argv, "a:ht"))> 0) { + switch (opt) { + case 'a': + if (strcmp(optarg, "x86") == 0) + arch = &arch_def_x86; + else if (strcmp(optarg, "x86_64") == 0) + arch = &arch_def_x86_64; + else if (strcmp(optarg, "x32") == 0) + arch = &arch_def_x32; + else if (strcmp(optarg, "arm") == 0) + arch = &arch_def_arm; + else + exit_usage(argv[0]); + break; + case 't': + translate = 1; + break; + case 'h': + default: + /* usage information */ + exit_usage(argv[0]); + } + } + + /* sanity checks */ + if (optind >= argc) + exit_usage(argv[0]); + + sys_num = arch_syscall_resolve_name(arch, argv[optind]); + if (translate != 0) + /* we ignore errors and just output the resolved number */ + arch_syscall_rewrite(arch, 0, &sys_num); + printf("%d\n", sys_num); + + return 0; +} diff --git a/tools/sys_inspector b/tools/sys_inspector deleted file mode 100755 index 37f880b..0000000 --- a/tools/sys_inspector +++ /dev/null @@ -1,103 +0,0 @@ -#!/bin/bash - -# -# Runtime syscall inspector -# -# Copyright (c) 2012 Red Hat -# Author: Paul Moore -# - -# -# This library is free software; you can redistribute it and/or modify it -# under the terms of version 2.1 of the GNU Lesser General Public License as -# published by the Free Software Foundation. -# -# This library is distributed in the hope that it will be useful, but WITHOUT -# ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or -# FITNESS FOR A PARTICULAR PURPOSE. See the GNU Lesser General Public License -# for more details. -# -# You should have received a copy of the GNU Lesser General Public License -# along with this library; if not, see . -# - -#### -# functions - -function verify_deps() { - [[ -z "$1" ]] && return - if ! which "$1" >& /dev/null; then - echo "error: install \"$1\" and include it in your \$PATH" - exit 1 - fi -} - -#### -# main - -# verify script dependencies -verify_deps strace -verify_deps sed -verify_deps sort -verify_deps uniq - -# get the command line arguments -opt_freq=0 -opt_args=0 -opt_out="/proc/self/fd/1" -while getopts "afo:h" opt; do - case $opt in - a) - opt_args=1 - ;; - f) - opt_freq=1 - ;; - o) - opt_out="$OPTARG" - ;; - h|*) - echo "usage $0 [-f] [-a] [-o ] []" - exit 1 - esac -done -shift $(expr $OPTIND - 1) - -# generate a temporary output file -raw=$(mktemp -t strace-raw_XXXXXX) -out="$raw-out" - -# capture the strace output -strace -o $raw -- $* - -# filter the raw strace -if [[ $opt_args -eq 0 ]]; then - if [[ $opt_freq -eq 0 ]]; then - cat $raw | sed -e 's/(.*//' | sort -u > $out - else - cat $raw | sed -e 's/(.*//' | sort | uniq -c | sort -nr > $out - fi -else - if [[ $opt_freq -eq 0 ]]; then - cat $raw | sed -e 's/)[ \t]*=.*$/)/' \ - | sed -e 's/".*,/"...",/g;s/\/\*.*\*\//.../g' \ - | sed -e 's/0x[a-f0-9]\+/.../g' \ - | sort -u > $out - else - cat $raw | sed -e 's/)[ \t]*=.*$/)/' \ - | sed -e 's/".*,/"...",/g;s/\/\*.*\*\//.../g' \ - | sed -e 's/0x[a-f0-9]\+/.../g' \ - | sort | uniq -c | sort -nr > $out - fi -fi - -# display the output -echo "============================================================" > $opt_out -echo "Syscall Report (\"$*\")" >> $opt_out -[[ $opt_freq -eq 1 ]] && echo " freq syscall" >> $opt_out -echo "============================================================" >> $opt_out -cat $out >> $opt_out - -# cleanup and exit -rm -f $raw $out -exit 0 diff --git a/tools/sys_resolver.c b/tools/sys_resolver.c deleted file mode 100644 index 5bc593e..0000000 --- a/tools/sys_resolver.c +++ /dev/null @@ -1,95 +0,0 @@ -/** - * Syscall resolver - * - * Copyright (c) 2012 Red Hat - * Author: Paul Moore - */ - -/* - * This library is free software; you can redistribute it and/or modify it - * under the terms of version 2.1 of the GNU Lesser General Public License as - * published by the Free Software Foundation. - * - * This library is distributed in the hope that it will be useful, but WITHOUT - * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or - * FITNESS FOR A PARTICULAR PURPOSE. See the GNU Lesser General Public License - * for more details. - * - * You should have received a copy of the GNU Lesser General Public License - * along with this library; if not, see . - */ - -#include -#include -#include -#include -#include - -#include "../src/arch.h" -#include "../src/arch-x86.h" -#include "../src/arch-x86_64.h" -#include "../src/arch-x32.h" -#include "../src/arch-arm.h" - -/** - * Print the usage information to stderr and exit - * @param program the name of the current program being invoked - * - * Print the usage information and exit with EINVAL. - * - */ -static void exit_usage(const char *program) -{ - fprintf(stderr, - "usage: %s [-h] [-a ] [-t] \n", - program); - exit(EINVAL); -} - -/** - * main - */ -int main(int argc, char *argv[]) -{ - int opt; - int translate = 0; - const struct arch_def *arch = arch_def_native; - int sys_num; - - /* parse the command line */ - while ((opt = getopt(argc, argv, "a:ht"))> 0) { - switch (opt) { - case 'a': - if (strcmp(optarg, "x86") == 0) - arch = &arch_def_x86; - else if (strcmp(optarg, "x86_64") == 0) - arch = &arch_def_x86_64; - else if (strcmp(optarg, "x32") == 0) - arch = &arch_def_x32; - else if (strcmp(optarg, "arm") == 0) - arch = &arch_def_arm; - else - exit_usage(argv[0]); - break; - case 't': - translate = 1; - break; - case 'h': - default: - /* usage information */ - exit_usage(argv[0]); - } - } - - /* sanity checks */ - if (optind >= argc) - exit_usage(argv[0]); - - sys_num = arch_syscall_resolve_name(arch, argv[optind]); - if (translate != 0) - /* we ignore errors and just output the resolved number */ - arch_syscall_rewrite(arch, 0, &sys_num); - printf("%d\n", sys_num); - - return 0; -} -- cgit v1.2.1