| 5ae59b95 |
/* |
| c442ca9c |
* Copyright (C) 2015-2019 Cisco Systems, Inc. and/or its affiliates. All rights reserved. |
| 5ae59b95 |
*
* Authors: Mickey Sola
*
* This program is free software; you can redistribute it and/or modify
* it under the terms of the GNU General Public License version 2 as
* published by the Free Software Foundation.
*
* This program is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU General Public License for more details.
*
* You should have received a copy of the GNU General Public License
* along with this program; if not, write to the Free Software
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston,
* MA 02110-1301, USA.
*/
#if HAVE_CONFIG_H
#include "clamav-config.h"
#endif
|
| f87f08cb |
#if defined(FANOTIFY)
|
| 5ae59b95 |
#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>
#include <sys/types.h>
#include <sys/stat.h>
#include <fcntl.h>
#include <signal.h>
#include <pthread.h>
#include <string.h>
#include <errno.h>
#include <stdbool.h>
#include <sys/fanotify.h>
#include <sys/inotify.h>
#include "onaccess_fan.h"
#include "onaccess_hash.h"
#include "onaccess_ddd.h" |
| 7ee85372 |
#include "onaccess_scth.h" |
| 5ae59b95 |
#include "libclamav/clamav.h"
#include "libclamav/scanners.h"
#include "shared/optparser.h"
#include "shared/output.h"
#include "server.h"
#include "others.h"
#include "scanner.h"
|
| d98d6fdb |
static int onas_ddd_init_ht(uint32_t ht_size);
static int onas_ddd_init_wdlt(uint64_t nwatches);
static int onas_ddd_grow_wdlt();
static int onas_ddd_watch(const char *pathname, int fan_fd, uint64_t fan_mask, int in_fd, uint64_t in_mask);
static int onas_ddd_watch_hierarchy(const char* pathname, size_t len, int fd, uint64_t mask, uint32_t type);
static int onas_ddd_unwatch(const char *pathname, int fan_fd, int in_fd);
static int onas_ddd_unwatch_hierarchy(const char* pathname, size_t len, int fd, uint32_t type);
static void onas_ddd_handle_in_moved_to(struct ddd_thrarg *tharg, const char *path, const char *child_path, const struct inotify_event *event, int wd, uint64_t in_mask);
static void onas_ddd_handle_in_create(struct ddd_thrarg *tharg, const char *path, const char *child_path, const struct inotify_event *event, int wd, uint64_t in_mask);
static void onas_ddd_handle_in_moved_from(struct ddd_thrarg *tharg, const char *path, const char *child_path, const struct inotify_event *event, int wd);
static void onas_ddd_handle_in_delete(struct ddd_thrarg *tharg, const char *path, const char *child_path, const struct inotify_event *event, int wd); |
| d7979d4f |
static void onas_ddd_handle_extra_scanning(struct ddd_thrarg *tharg, const char *pathname, int extra_options); |
| d98d6fdb |
static void onas_ddd_exit(int sig);
|
| 5ae59b95 |
/* TODO: Unglobalize these. */
static struct onas_ht *ddd_ht;
static char **wdlt;
static uint32_t wdlt_len; |
| abbe4c4b |
static int onas_in_fd; |
| 5ae59b95 |
static int onas_ddd_init_ht(uint32_t ht_size) {
if (ht_size <= 0)
ht_size = ONAS_DEFAULT_HT_SIZE;
return onas_ht_init(&ddd_ht, ht_size);
}
|
| c316a8c9 |
static int onas_ddd_init_wdlt(uint64_t nwatches) {
if (nwatches <= 0) return CL_EARG; |
| 5ae59b95 |
wdlt = (char **) cli_calloc(nwatches << 1, sizeof(char*));
if (!wdlt) return CL_EMEM;
wdlt_len = nwatches << 1;
return CL_SUCCESS;
}
static int onas_ddd_grow_wdlt() {
char **ptr = NULL;
ptr = (char **) cli_realloc(wdlt, wdlt_len << 1); |
| 7d5ae889 |
if (ptr) {
wdlt = ptr; |
| 5ae59b95 |
memset(&ptr[wdlt_len], 0, sizeof(char *) * (wdlt_len - 1)); |
| 7d5ae889 |
} else { |
| 5ae59b95 |
return CL_EMEM; |
| 7d5ae889 |
} |
| 5ae59b95 |
wdlt_len <<= 1;
return CL_SUCCESS;
}
/* TODO: Support configuration for changing/setting number of inotify watches. */ |
| c316a8c9 |
int onas_ddd_init(uint64_t nwatches, size_t ht_size) { |
| 5ae59b95 |
const char* nwatch_file = "/proc/sys/fs/inotify/max_user_watches";
int nwfd = 0;
int ret = 0;
char nwatch_str[MAX_WATCH_LEN];
char *p = NULL;
nwatches = 0;
nwfd = open(nwatch_file, O_RDONLY);
if (nwfd < 0) return CL_EOPEN;
ret = read(nwfd, nwatch_str, MAX_WATCH_LEN);
close(nwfd);
if (ret < 0) return CL_EREAD;
nwatches = strtol(nwatch_str, &p, 10);
ret = onas_ddd_init_wdlt(nwatches);
if (ret) return ret;
ret = onas_ddd_init_ht(ht_size);
if (ret) return ret;
return CL_SUCCESS;
}
static int onas_ddd_watch(const char *pathname, int fan_fd, uint64_t fan_mask, int in_fd, uint64_t in_mask) {
if (!pathname || fan_fd <= 0 || in_fd <= 0) return CL_ENULLARG;
int ret = CL_SUCCESS;
size_t len = strlen(pathname);
ret = onas_ddd_watch_hierarchy(pathname, len, in_fd, in_mask, ONAS_IN);
if (ret) return ret;
ret = onas_ddd_watch_hierarchy(pathname, len, fan_fd, fan_mask, ONAS_FAN);
if (ret) return ret;
return CL_SUCCESS;
}
static int onas_ddd_watch_hierarchy(const char* pathname, size_t len, int fd, uint64_t mask, uint32_t type) {
if (!pathname || fd <= 0 || !type) return CL_ENULLARG;
if (type == (ONAS_IN | ONAS_FAN)) return CL_EARG;
struct onas_hnode *hnode = NULL;
struct onas_element *elem = NULL;
int wd = 0;
if(onas_ht_get(ddd_ht, pathname, len, &elem) != CL_SUCCESS) return CL_EARG;
hnode = elem->data;
if (type & ONAS_IN) {
wd = inotify_add_watch(fd, pathname, (uint32_t) mask);
if (wd < 0) return CL_EARG;
|
| d98d6fdb |
if ((uint32_t) wd >= wdlt_len) { |
| 5ae59b95 |
onas_ddd_grow_wdlt();
}
/* Link the hash node to the watch descriptor lookup table */
hnode->wd = wd;
wdlt[wd] = hnode->pathname;
hnode->watched |= ONAS_INWATCH;
} else if (type & ONAS_FAN) {
if(fanotify_mark(fd, FAN_MARK_ADD, mask, AT_FDCWD, hnode->pathname) < 0) return CL_EARG;
hnode->watched |= ONAS_FANWATCH;
} else {
return CL_EARG;
}
struct onas_lnode *curr = hnode->childhead;
while (curr->next != hnode->childtail) {
curr = curr->next;
size_t size = len + strlen(curr->dirname) + 2;
char *child_path = (char *) cli_malloc(size); |
| 637d2461 |
if (child_path == NULL)
return CL_EMEM; |
| 5ae59b95 |
if (hnode->pathname[len-1] == '/')
snprintf(child_path, --size, "%s%s", hnode->pathname, curr->dirname);
else
snprintf(child_path, size, "%s/%s", hnode->pathname, curr->dirname);
|
| eb16d133 |
if(onas_ddd_watch_hierarchy(child_path, strlen(child_path), fd, mask, type)) {
return CL_EARG;
} |
| 5ae59b95 |
free(child_path);
}
return CL_SUCCESS;
}
static int onas_ddd_unwatch(const char *pathname, int fan_fd, int in_fd) {
if (!pathname || fan_fd <= 0 || in_fd <= 0) return CL_ENULLARG;
int ret = CL_SUCCESS;
size_t len = strlen(pathname);
ret = onas_ddd_unwatch_hierarchy(pathname, len, in_fd, ONAS_IN);
if (ret) return ret;
ret = onas_ddd_unwatch_hierarchy(pathname, len,fan_fd, ONAS_FAN);
if (ret) return ret;
return CL_SUCCESS;
}
static int onas_ddd_unwatch_hierarchy(const char* pathname, size_t len, int fd, uint32_t type) {
if (!pathname || fd <= 0 || !type) return CL_ENULLARG;
if (type == (ONAS_IN | ONAS_FAN)) return CL_EARG;
struct onas_hnode *hnode = NULL;
struct onas_element *elem = NULL;
int wd = 0;
if(onas_ht_get(ddd_ht, pathname, len, &elem)) return CL_EARG;
hnode = elem->data;
if (type & ONAS_IN) {
wd = hnode->wd;
if(!inotify_rm_watch(fd, wd)) return CL_EARG;
/* Unlink the hash node from the watch descriptor lookup table */
hnode->wd = 0;
wdlt[wd] = NULL;
hnode->watched = ONAS_STOPWATCH;
} else if (type & ONAS_FAN) {
if(fanotify_mark(fd, FAN_MARK_REMOVE, 0, AT_FDCWD, hnode->pathname) < 0) return CL_EARG;
hnode->watched = ONAS_STOPWATCH;
} else {
return CL_EARG;
}
struct onas_lnode *curr = hnode->childhead;
while (curr->next != hnode->childtail) {
curr = curr->next;
size_t size = len + strlen(curr->dirname) + 2;
char *child_path = (char *) cli_malloc(size); |
| 637d2461 |
if (child_path == NULL)
return CL_EMEM; |
| 5ae59b95 |
if (hnode->pathname[len-1] == '/')
snprintf(child_path, --size, "%s%s", hnode->pathname, curr->dirname);
else
snprintf(child_path, size, "%s/%s", hnode->pathname, curr->dirname);
onas_ddd_unwatch_hierarchy(child_path, strlen(child_path), fd, type);
free(child_path);
}
return CL_SUCCESS;
}
void *onas_ddd_th(void *arg) {
struct ddd_thrarg *tharg = (struct ddd_thrarg *) arg;
sigset_t sigset;
struct sigaction act;
const struct optstruct *pt;
uint64_t in_mask = IN_ONLYDIR | IN_MOVE | IN_DELETE | IN_CREATE;
fd_set rfds;
char buf[4096];
ssize_t bread;
const struct inotify_event *event;
int ret, len;
/* ignore all signals except SIGUSR1 */
sigfillset(&sigset);
sigdelset(&sigset, SIGUSR1); |
| 7ee85372 |
/* The behavior of a process is undefined after it ignores a |
| 5ae59b95 |
* SIGFPE, SIGILL, SIGSEGV, or SIGBUS signal */
sigdelset(&sigset, SIGFPE);
sigdelset(&sigset, SIGILL);
sigdelset(&sigset, SIGSEGV); |
| 7ee85372 |
#ifdef SIGBUS |
| 5ae59b95 |
sigdelset(&sigset, SIGBUS);
#endif
pthread_sigmask(SIG_SETMASK, &sigset, NULL);
memset(&act, 0, sizeof(struct sigaction));
act.sa_handler = onas_ddd_exit;
sigfillset(&(act.sa_mask));
sigaction(SIGUSR1, &act, NULL);
sigaction(SIGSEGV, &act, NULL);
|
| abbe4c4b |
onas_in_fd = inotify_init1(IN_NONBLOCK);
if (onas_in_fd == -1) { |
| 5ae59b95 |
logg("!ScanOnAccess: Could not init inotify.");
return NULL;
}
ret = onas_ddd_init(0, ONAS_DEFAULT_HT_SIZE);
if (ret) {
logg("!ScanOnAccess: Failed to initialize 3D. \n");
return NULL;
}
/* Add provided paths recursively. */
if((pt = optget(tharg->opts, "OnAccessIncludePath"))->enabled) {
while(pt) { |
| 09edcd71 |
if (!strcmp(pt->strarg, "/")) { |
| 2576678c |
logg("!ScanOnAccess: Not including path '%s' while DDD is enabled\n", pt->strarg);
logg("!ScanOnAccess: Please use the OnAccessMountPath option to watch '%s'\n", pt->strarg); |
| 09edcd71 |
pt = (struct optstruct *) pt->nextarg;
continue;
} |
| 5ae59b95 |
if(onas_ht_get(ddd_ht, pt->strarg, strlen(pt->strarg), NULL) != CL_SUCCESS) {
if(onas_ht_add_hierarchy(ddd_ht, pt->strarg)) {
logg("!ScanOnAccess: Can't include path '%s'\n", pt->strarg);
return NULL; |
| 4a1bd5c8 |
} else
logg("ScanOnAccess: Protecting directory '%s' (and all sub-directories)\n", pt->strarg); |
| 5ae59b95 |
}
pt = (struct optstruct *) pt->nextarg;
}
} else {
logg("!ScanOnAccess: Please specify at least one path with OnAccessIncludePath\n");
return NULL;
}
/* Remove provided paths recursively. */
if((pt = optget(tharg->opts, "OnAccessExcludePath"))->enabled) {
while(pt) {
size_t ptlen = strlen(pt->strarg);
if(onas_ht_get(ddd_ht, pt->strarg, ptlen, NULL) == CL_SUCCESS) {
if(onas_ht_rm_hierarchy(ddd_ht, pt->strarg, ptlen, 0)) {
logg("!ScanOnAccess: Can't exclude path '%s'\n", pt->strarg);
return NULL; |
| 4a1bd5c8 |
} else
logg("ScanOnAccess: Excluding directory '%s' (and all sub-directories)\n", pt->strarg); |
| 5ae59b95 |
}
pt = (struct optstruct *) pt->nextarg;
}
}
/* Watch provided paths recursively */
if((pt = optget(tharg->opts, "OnAccessIncludePath"))->enabled) {
while(pt) {
size_t ptlen = strlen(pt->strarg);
if(onas_ht_get(ddd_ht, pt->strarg, ptlen, NULL) == CL_SUCCESS) { |
| abbe4c4b |
if(onas_ddd_watch(pt->strarg, tharg->fan_fd, tharg->fan_mask, onas_in_fd, in_mask)) { |
| 5ae59b95 |
logg("!ScanOnAccess: Could not watch path '%s', %s\n", pt->strarg, strerror(errno)); |
| 248b3b70 |
if(errno == EINVAL && optget(tharg->opts, "OnAccessPrevention")->enabled) {
logg("!ScanOnAccess: When using the OnAccessPrevention option, please ensure your kernel\n\t\t\twas compiled with CONFIG_FANOTIFY_ACCESS_PERMISSIONS set to Y\n");
kill(getpid(), SIGTERM);
} |
| 5ae59b95 |
return NULL;
}
}
pt = (struct optstruct *) pt->nextarg;
}
}
|
| 3d9620db |
/* TODO: Re-enable OnAccessExtraScanning once the thread resource consumption issue is resolved. */
#if 0 |
| 7ee85372 |
if(optget(tharg->opts, "OnAccessExtraScanning")->enabled) {
logg("ScanOnAccess: Extra scanning and notifications enabled.\n"); |
| 3d9620db |
}
#endif |
| 7ee85372 |
|
| 5ae59b95 |
FD_ZERO(&rfds); |
| abbe4c4b |
FD_SET(onas_in_fd, &rfds); |
| 5ae59b95 |
while (1) {
do { |
| abbe4c4b |
ret = select(onas_in_fd + 1, &rfds, NULL, NULL, NULL); |
| 5ae59b95 |
} while(ret == -1 && errno == EINTR);
|
| abbe4c4b |
while((bread = read(onas_in_fd, buf, sizeof(buf))) > 0) { |
| 5ae59b95 |
/* Handle events. */
int wd;
char *p = buf;
const char *path = NULL;
const char *child = NULL; |
| d98d6fdb |
for(; p < buf + bread; p += sizeof(struct inotify_event) + event->len) { |
| 5ae59b95 |
event = (const struct inotify_event *) p;
wd = event->wd;
path = wdlt[wd];
child = event->name;
len = strlen(path);
size_t size = strlen(child) + len + 2;
char *child_path = (char *) cli_malloc(size); |
| 637d2461 |
if (child_path == NULL) |
| 7ee85372 |
return NULL;
|
| 5ae59b95 |
if (path[len-1] == '/')
snprintf(child_path, --size, "%s%s", path, child);
else
snprintf(child_path, size, "%s/%s", path, child);
if (event->mask & IN_DELETE) { |
| 7ee85372 |
onas_ddd_handle_in_delete(tharg, path, child_path, event, wd); |
| 5ae59b95 |
} else if (event->mask & IN_MOVED_FROM) { |
| 7ee85372 |
onas_ddd_handle_in_moved_from(tharg, path, child_path, event, wd); |
| 5ae59b95 |
} else if (event->mask & IN_CREATE) { |
| 7ee85372 |
onas_ddd_handle_in_create(tharg, path, child_path, event, wd, in_mask); |
| 5ae59b95 |
} else if (event->mask & IN_MOVED_TO) { |
| 7ee85372 |
onas_ddd_handle_in_moved_to(tharg, path, child_path, event, wd, in_mask); |
| 5ae59b95 |
}
}
}
}
return NULL;
}
|
| 7ee85372 |
static void onas_ddd_handle_in_delete(struct ddd_thrarg *tharg,
const char *path, const char *child_path, const struct inotify_event *event, int wd) {
struct stat s;
if(stat(child_path, &s) == 0 && S_ISREG(s.st_mode)) return;
if(!(event->mask & IN_ISDIR)) return;
logg("*ddd: DELETE - Removing %s from %s with wd:%d\n", child_path, path, wd);
onas_ddd_unwatch(child_path, tharg->fan_fd, onas_in_fd);
onas_ht_rm_hierarchy(ddd_ht, child_path, strlen(child_path), 0);
return;
}
static void onas_ddd_handle_in_moved_from(struct ddd_thrarg *tharg,
const char *path, const char *child_path, const struct inotify_event *event, int wd) {
struct stat s;
if(stat(child_path, &s) == 0 && S_ISREG(s.st_mode)) return;
if(!(event->mask & IN_ISDIR)) return;
logg("*ddd: MOVED_FROM - Removing %s from %s with wd:%d\n", child_path, path, wd);
onas_ddd_unwatch(child_path, tharg->fan_fd, onas_in_fd);
onas_ht_rm_hierarchy(ddd_ht, child_path, strlen(child_path), 0);
return;
}
static void onas_ddd_handle_in_create(struct ddd_thrarg *tharg,
const char *path, const char *child_path, const struct inotify_event *event, int wd, uint64_t in_mask) {
struct stat s; |
| 3d9620db |
/* TODO: Re-enable OnAccessExtraScanning once the thread resource consumption issue is resolved. */
#if 0 |
| 7ee85372 |
if (optget(tharg->opts, "OnAccessExtraScanning")->enabled) {
if(stat(child_path, &s) == 0 && S_ISREG(s.st_mode)) {
onas_ddd_handle_extra_scanning(tharg, child_path, ONAS_SCTH_ISFILE);
} else if(stat(child_path, &s) == 0 && S_ISDIR(s.st_mode)) {
logg("*ddd: CREATE - Adding %s to %s with wd:%d\n", child_path, path, wd);
onas_ht_add_hierarchy(ddd_ht, child_path);
onas_ddd_watch(child_path, tharg->fan_fd, tharg->fan_mask, onas_in_fd, in_mask);
onas_ddd_handle_extra_scanning(tharg, child_path, ONAS_SCTH_ISDIR);
} |
| 3d9620db |
}
else
#endif
{ |
| 7ee85372 |
if(stat(child_path, &s) == 0 && S_ISREG(s.st_mode)) return;
if(!(event->mask & IN_ISDIR)) return;
logg("*ddd: MOVED_TO - Adding %s to %s with wd:%d\n", child_path, path, wd);
onas_ht_add_hierarchy(ddd_ht, child_path);
onas_ddd_watch(child_path, tharg->fan_fd, tharg->fan_mask, onas_in_fd, in_mask);
}
return;
}
static void onas_ddd_handle_in_moved_to(struct ddd_thrarg *tharg,
const char *path, const char *child_path, const struct inotify_event *event, int wd, uint64_t in_mask) {
struct stat s; |
| 3d9620db |
/* TODO: Re-enable OnAccessExtraScanning once the thread resource consumption issue is resolved. */
#if 0 |
| 7ee85372 |
if (optget(tharg->opts, "OnAccessExtraScanning")->enabled) {
if(stat(child_path, &s) == 0 && S_ISREG(s.st_mode)) {
onas_ddd_handle_extra_scanning(tharg, child_path, ONAS_SCTH_ISFILE);
} else if(stat(child_path, &s) == 0 && S_ISDIR(s.st_mode)) {
logg("*ddd: MOVED_TO - Adding %s to %s with wd:%d\n", child_path, path, wd);
onas_ht_add_hierarchy(ddd_ht, child_path);
onas_ddd_watch(child_path, tharg->fan_fd, tharg->fan_mask, onas_in_fd, in_mask);
onas_ddd_handle_extra_scanning(tharg, child_path, ONAS_SCTH_ISDIR);
} |
| 3d9620db |
}
else
#endif
{ |
| 7ee85372 |
if(stat(child_path, &s) == 0 && S_ISREG(s.st_mode)) return;
if(!(event->mask & IN_ISDIR)) return;
logg("*ddd: MOVED_TO - Adding %s to %s with wd:%d\n", child_path, path, wd);
onas_ht_add_hierarchy(ddd_ht, child_path);
onas_ddd_watch(child_path, tharg->fan_fd, tharg->fan_mask, onas_in_fd, in_mask);
}
return;
}
|
| d7979d4f |
static void onas_ddd_handle_extra_scanning(struct ddd_thrarg *tharg, const char *pathname, int extra_options) { |
| 7ee85372 |
|
| d7979d4f |
int thread_started = 1; |
| 7ee85372 |
struct scth_thrarg *scth_tharg = NULL;
pthread_attr_t scth_attr;
pthread_t scth_pid = 0;
do {
if (pthread_attr_init(&scth_attr)) break;
pthread_attr_setdetachstate(&scth_attr, PTHREAD_CREATE_JOINABLE);
|
| d7979d4f |
/* Allocate memory for arguments. Thread is responsible for freeing it. */
if (!(scth_tharg = (struct scth_thrarg *) calloc(sizeof(struct scth_thrarg), 1))) break;
if (!(scth_tharg->options = (struct cl_scan_options *) calloc(sizeof(struct cl_scan_options), 1))) break; |
| 7ee85372 |
|
| d7979d4f |
(void) memcpy(scth_tharg->options, tharg->options, sizeof(struct cl_scan_options));
scth_tharg->extra_options = extra_options; |
| 7ee85372 |
scth_tharg->opts = tharg->opts;
scth_tharg->pathname = strdup(pathname); |
| 674a4aa5 |
scth_tharg->engine = tharg->engine; |
| 7ee85372 |
|
| d7979d4f |
thread_started = pthread_create(&scth_pid, &scth_attr, onas_scan_th, scth_tharg); |
| 7ee85372 |
} while(0);
|
| d7979d4f |
if (0 != thread_started) {
/* Failed to create thread. Free anything we may have allocated. */
logg("!ScanOnAccess: Unable to kick off extra scanning.\n");
if (NULL != scth_tharg) {
if (NULL != scth_tharg->pathname){
free(scth_tharg->pathname);
scth_tharg->pathname = NULL;
}
if (NULL != scth_tharg->options) {
free(scth_tharg->options);
scth_tharg->options = NULL;
}
free(scth_tharg);
scth_tharg = NULL;
}
}
|
| 7ee85372 |
return;
}
|
| 5ae59b95 |
static void onas_ddd_exit(int sig) {
logg("*ScanOnAccess: onas_ddd_exit(), signal %d\n", sig); |
| abbe4c4b |
close(onas_in_fd);
|
| 1704071a |
onas_free_ht(ddd_ht);
free(wdlt); |
| 7ee85372 |
|
| 5ae59b95 |
pthread_exit(NULL);
logg("ScanOnAccess: stopped\n");
} |
| f87f08cb |
#endif |