1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
| #include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <unistd.h>
#include <signal.h>
#include <errno.h>
#include <sys/types.h>
#include <sys/socket.h>
#include <linux/netlink.h>
#include <linux/connector.h>
#include <linux/cn_proc.h>
#define CN_PROC_MSG_SIZE NLMSG_LENGTH(sizeof(struct cn_msg) + sizeof(struct proc_event))
volatile int stop_flag = 0;
void signal_handler(int sig) {
stop_flag = 1;
}
const char *proc_event_type(enum what w) {
switch (w) {
case PROC_EVENT_NONE:
return "NONE";
case PROC_EVENT_FORK:
return "FORK";
case PROC_EVENT_EXEC:
return "EXEC";
case PROC_EVENT_UID:
return "UID";
case PROC_EVENT_GID:
return "GID";
case PROC_EVENT_SID:
return "SID";
case PROC_EVENT_PTRACE:
return "PTRACE";
case PROC_EVENT_COMM:
return "COMM";
case PROC_EVENT_COREDUMP:
return "COREDUMP";
case PROC_EVENT_EXIT:
return "EXIT";
default:
return "UNKNOWN";
}
}
void parse_msg(struct cn_msg *msg) {
struct proc_event *ev;
printf("==================================\n");
printf("msg->id %u:%u\n", msg->id.idx, msg->id.val);
printf("msg->len %u\n", msg->len);
printf("msg->seq %u\n", msg->seq);
printf("msg->ack %u\n", msg->ack);
if (msg->id.idx != CN_IDX_PROC || msg->id.val != CN_VAL_PROC) {
printf("unknown id\n");
return;
}
if (msg->len != sizeof(struct proc_event)) {
printf("unknown msg len\n");
return;
}
ev = (struct proc_event *)&msg->data;
printf("\n");
printf("ev->what %s\n", proc_event_type(ev->what));
printf("ev->cpu %u\n", ev->cpu);
if (ev->what == PROC_EVENT_NONE) {
printf("ev->err %u\n", ev->event_data.ack.err);
} else {
printf("ev->pid %d\n", ev->event_data.fork.parent_pid);
printf("ev->tgid %d\n", ev->event_data.fork.parent_tgid);
}
}
int main() {
int conn_fd;
int n;
char buffer[CN_PROC_MSG_SIZE];
struct sigaction sa;
struct sockaddr_nl sa_nl;
struct nlmsghdr *nl_hdr;
struct cn_msg *msg;
printf("CN_PROC_MSG_SIZE %lu\n", CN_PROC_MSG_SIZE);
sa.sa_handler = signal_handler;
sigemptyset(&sa.sa_mask);
sa.sa_flags = 0;
if (sigaction(SIGINT, &sa, NULL) == -1) {
perror("sigaction failed");
return 1;
}
if (sigaction(SIGTERM, &sa, NULL) == -1) {
perror("sigaction failed");
return 1;
}
conn_fd = socket(PF_NETLINK, SOCK_DGRAM, NETLINK_CONNECTOR);
if (conn_fd == -1) {
perror("socket failed");
return 1;
}
sa_nl.nl_family = AF_NETLINK;
sa_nl.nl_groups = 1 << (CN_IDX_PROC - 1);
sa_nl.nl_pid = getpid();
if (bind(conn_fd, (struct sockaddr*)&sa_nl, sizeof(sa_nl)) == -1) {
perror("bind failed");
close(conn_fd);
return 1;
}
memset(buffer, 0, sizeof(buffer));
nl_hdr = (struct nlmsghdr *)buffer;
msg = NLMSG_DATA(buffer);
nl_hdr->nlmsg_len = NLMSG_LENGTH(sizeof(struct cn_msg) + sizeof(enum proc_cn_mcast_op));
nl_hdr->nlmsg_pid = getpid();
nl_hdr->nlmsg_type = NLMSG_DONE;
nl_hdr->nlmsg_seq = 22;
msg->id.idx = CN_IDX_PROC;
msg->id.val = CN_VAL_PROC;
msg->ack = 666;
msg->len = sizeof(enum proc_cn_mcast_op);
*(enum proc_cn_mcast_op *)msg->data = PROC_CN_MCAST_LISTEN;
if (send(conn_fd, buffer, nl_hdr->nlmsg_len, 0) == -1) {
perror("send PROC_CN_MCAST_LISTEN failed");
close(conn_fd);
return 1;
}
printf("PROC_CN_MCAST_LISTEN send success\n");
while (stop_flag == 0) {
memset(buffer, 0, sizeof(buffer));
n = recv(conn_fd, buffer, sizeof(buffer), 0);
if (n == -1) {
if (errno == ENOBUFS) {
printf("recv return ENOBUFS, event loss\n");
} else {
perror("recv failed");
break;
}
} else if (n == 0) {
perror("recv return 0?");
break;
} else {
printf("recv return %d\n", n);
msg = NLMSG_DATA(buffer);
if (n < NLMSG_LENGTH(sizeof(struct cn_msg))) {
fprintf(stderr, "invalid recv len %d\n", n);
} else if (n < NLMSG_LENGTH(msg->len)) {
fprintf(stderr, "invalid recv len %d, cn_msg len %u\n", n, msg->len);
} else {
parse_msg(msg);
}
}
}
memset(buffer, 0, sizeof(buffer));
nl_hdr->nlmsg_len = NLMSG_LENGTH(sizeof(struct cn_msg) + sizeof(enum proc_cn_mcast_op));
nl_hdr->nlmsg_pid = getpid();
nl_hdr->nlmsg_type = NLMSG_DONE;
nl_hdr->nlmsg_seq = 22;
msg->id.idx = CN_IDX_PROC;
msg->id.val = CN_VAL_PROC;
msg->len = sizeof(enum proc_cn_mcast_op);
*(enum proc_cn_mcast_op *)msg->data = PROC_CN_MCAST_IGNORE;
if (send(conn_fd, buffer, nl_hdr->nlmsg_len, 0) == -1) {
perror("send PROC_CN_MCAST_IGNORE failed");
close(conn_fd);
return 1;
}
printf("PROC_CN_MCAST_IGNORE send success\n");
close(conn_fd);
return 0;
}
|