~ubuntu-branches/ubuntu/precise/das-watchdog/precise-security

#define OPTARGS_BEGIN(das_usage) {int lokke;const char *usage=das_usage;for(lokke=1;lokke<argc;lokke++){char *a=argv[lokke];if(!strcmp("--help",a)||!strcmp("-h",a)){printf(usage);return 0;

#define OPTARG(name,name2) }}else if(!strcmp(name,a)||!strcmp(name2,a)){{

#define OPTARG_GETINT() atoi(argv[++lokke])

#define OPTARG_GETFLOAT() atof(argv[++lokke])

#define OPTARG_GETSTRING() argv[++lokke]

#define OPTARG_LAST() }}else if(lokke==argc-1){lokke--;{

#define OPTARGS_ELSE() }else if(1){

#define OPTARGS_END }else{fprintf(stderr,usage);return(-1);}}}

static int increasetime=1; // Seconds between each time the SCHED_OTHER thread is increasing the counter.

static int checktime=4; // Seconds between each time the SCHED_FIFO thread checks that the counter is increased.

static int waittime=8; // Seconds the SCHED_FIFO thread waits before setting the processes back to SCHED_FIFO.

struct das_proclist{

pid_t pid;

int policy; //SCHED_OTHER, SCHED_FIFO, SHED_RR

int priority;

ui64 start_time; // Creation time of the process.

};

struct proclistlist{

struct das_proclist *proclist;

int length;

};

static int verbose=0;

int counter=0; // Make non-static in case the c compiler does a whole-program optimization. :-)

#if TIMERCHECKS

static int checkirq=0;

#endif

static int xmessage_found=1;

static void print_error(FILE *where,char *fmt, ...) {

char temp[10000];

va_list ap;

va_start(ap, fmt);{

vsnprintf (temp, 9998, fmt, ap);

}va_end(ap);

syslog(LOG_INFO,temp);

fprintf(where,"Das_Watchdog: %s\n",temp);

}

100

static ui64 get_pid_start_time(pid_t pid){

101

glibtop_proc_time buf={0};

102

glibtop_get_proc_time(&buf,pid);

103

return buf.start_time;

104

}

105

106

107

static int get_pid_priority(pid_t pid){

108

struct sched_param par;

109

sched_getparam(pid,&par);

110

return par.sched_priority;

111

}

112

113

static int set_pid_priority(pid_t pid,int policy,int priority,char *message,char *name){

114

struct sched_param par={0};

115

par.sched_priority=priority;

116

if((sched_setscheduler(pid,policy,&par)!=0)){

117

print_error(stderr,message,pid,name,strerror(errno));

118

return 0;

119

}

120

return 1;

121

}

122

123

124

struct das_proclist *get_proclist(int *num_procs){

125

int lokke=0;

126

127

glibtop_proclist proclist_def={0};

128

pid_t *proclist=glibtop_get_proclist(&proclist_def,GLIBTOP_KERN_PROC_ALL,0); //|GLIBTOP_EXCLUDE_SYSTEM,0);

129

struct das_proclist *ret=calloc(sizeof(struct das_proclist),proclist_def.number);

130

131

*num_procs=proclist_def.number;

132

133

for(lokke=0;lokke<proclist_def.number;lokke++){

134

pid_t pid=proclist[lokke];

135

ret[lokke].pid=pid;

136

ret[lokke].policy=sched_getscheduler(pid);

137

ret[lokke].priority=get_pid_priority(pid);

138

ret[lokke].start_time=get_pid_start_time(pid);

139

}

140

141

#if LIBGTOP_MAJOR_VERSION<2

142

glibtop_free(proclist);

143

#else

144

g_free(proclist);

145

#endif

146

147

return ret;

148

}

149

150

struct proclistlist *pll_create(void){

151

struct proclistlist *pll=calloc(1,sizeof(struct proclistlist));

152

pll->proclist=get_proclist(&pll->length);

153

return pll;

154

}

155

156

static void pll_delete(struct proclistlist *pll){

157

free(pll->proclist);

158

free(pll);

159

}

160

161

162

163

static pid_t name2pid(char *name){

164

pid_t pid=-1;

165

int lokke;

166

int num_procs=0;

167

struct das_proclist *proclist=get_proclist(&num_procs);

168

169

for(lokke=0;lokke<num_procs;lokke++){

170

glibtop_proc_state state;

171

glibtop_get_proc_state(&state,proclist[lokke].pid);

172

if(!strcmp(state.cmd,name)){

173

pid=proclist[lokke].pid;

174

break;

175

}

176

}

177

free(proclist);

178

return pid;

179

}

180

181

182

183

static int is_a_member(int val,int *vals,int num_vals){

184

int lokke;

185

for(lokke=0;lokke<num_vals;lokke++)

186

if(val==vals[lokke])

187

return 1;

188

return 0;

189

}

190

191

192

193

// Returns a list of users that might be the one owning the proper .Xauthority file.

194

static int *get_userlist(struct proclistlist *pll, int *num_users){

195

int *ret=calloc(sizeof(int),pll->length);

196

int lokke;

197

198

*num_users=0;

199

200

for(lokke=0;lokke<pll->length;lokke++){

201

glibtop_proc_uid uid;

202

glibtop_get_proc_uid(&uid,pll->proclist[lokke].pid);

203

if( ! is_a_member(uid.uid,ret,*num_users)){ // ???

204

ret[*num_users]=uid.uid;

205

(*num_users)++;

206

}

207

}

208

return ret;

209

}

210

211

212

213

static int gettimerpid(char *name,int cpu){

214

pid_t pid;

215

char temp[500];

216

217

if(name==NULL)

218

name=&temp[0];

219

220

sprintf(name,"softirq-timer/%d",cpu);

221

222

pid=name2pid(name);

223

224

if(pid==-1){

225

sprintf(name,"ksoftirqd/%d",cpu);

226

pid=name2pid(name);

227

}

228

229

return pid;

230

}

231

232

233

234

#if TIMERCHECKS

235

static int checksoftirq2(int force,int cpu){

236

char name[500];

237

pid_t pid=gettimerpid(&name[0],cpu);

238

239

if(pid==-1) return 0;

240

241

242

{

243

int policy=sched_getscheduler(pid);

244

int priority=get_pid_priority(pid);

245

246

if(priority<sched_get_priority_max(SCHED_FIFO)

247

|| policy==SCHED_OTHER

248

)

249

{

250

251

if(force){

252

print_error(stdout,"Forcing %s to SCHED_FIFO priority %d",name,sched_get_priority_max(SCHED_FIFO));

253

set_pid_priority(pid,SCHED_FIFO,sched_get_priority_max(SCHED_FIFO),"Could not set %d (\"%s\") to SCHED_FIFO (%s).\n\n",name);

254

return checksoftirq2(0,cpu);

255

}

256

257

258

if(priority<sched_get_priority_max(SCHED_FIFO))

259

print_error(stderr,

260

"\n\nWarning. The priority of the \"%s\" process is only %d, and not %d. Unless you are using the High Res Timer,\n"

261

"the watchdog will probably not work. If you are using the High Res Timer, please continue doing so and ignore this message.\n",

262

name,

263

priority,

264

sched_get_priority_max(SCHED_FIFO)

265

);

266

if(policy==SCHED_OTHER)

267

print_error(stderr,

268

"\n\nWarning The \"%s\" process is running SCHED_OTHER. Unless you are using the High Res Timer,\n"

269

"the watchdog will probably not work, and the timing on your machine is probably horrible.\n",

270

name

271

);

272

273

if(checkirq){

274

print_error(stdout,"\n\nUnless you are using the High Res Timer, you need to add the \"--force\" flag to run das_watchdog reliably.\n");

275

print_error(stdout,"(Things might change though, so it could work despite all warnings above. To test the watchdog, run the \"test_rt\" program.)\n\n");

276

}

277

return -1;

278

}

279

//printf("name: -%s-\n",state.cmd);

280

281

return 1;

282

}

283

}

284

285

286

static int checksoftirq(int force){

287

int cpu=0;

288

289

for(;;){

290

switch(checksoftirq2(force,cpu)){

291

case -1:

292

return -1;

293

case 1:

294

cpu++;

295

break;

296

case 0:

297

default:

298

return 0;

299

}

300

}

301

return 0;

302

}

303

#endif

304

305

306

307

static char *get_pid_environ_val(pid_t pid,char *val){

308

char temp[500];

309

int i=0;

310

int foundit=0;

311

FILE *fp;

312

313

sprintf(temp,"/proc/%d/environ",pid);

314

315

fp=fopen(temp,"r");

316

if(fp==NULL)

317

return NULL;

318

319

320

for(;;){

321

temp[i]=fgetc(fp);

322

323

if(foundit==1 && (temp[i]==0 || temp[i]=='\0' || temp[i]==EOF)){

324

char *ret;

325

temp[i]=0;

326

ret=malloc(strlen(temp)+10);

327

sprintf(ret,"%s",temp);

328

fclose(fp);

329

return ret;

330

}

331

332

switch(temp[i]){

333

case EOF:

334

fclose(fp);

335

return NULL;

336

case '=':

337

temp[i]=0;

338

if(!strcmp(temp,val)){

339

foundit=1;

340

}

341

i=0;

342

break;

343

case '\0':

344

i=0;

345

break;

346

default:

347

i++;

348

}

349

}

350

}

351

352

// Returns 1 in case a message was sent.

353

static int send_xmessage(char *xa_filename,char *message){

354

if(access(xa_filename,R_OK)==0){

355

setenv("XAUTHORITY",xa_filename,1);

356

if(verbose)

357

print_error(stdout,"Trying xauth file \"%s\"",xa_filename);

358

if(system(message)==0)

359

return 1;

360

}

361

return 0;

362

}

363

364

// Returns 1 in case a message was sent.

365

static int send_xmessage_using_XAUTHORITY(struct proclistlist *pll,int lokke,char *message){

366

367

if(lokke==pll->length)

368

return 0;

369

370

{

371

char *xa_filename=get_pid_environ_val(pll->proclist[lokke].pid,"XAUTHORITY");

372

if(xa_filename!=NULL){

373

if(send_xmessage(xa_filename,message)==1){

374

free(xa_filename);

375

return 1;

376

}

377

}

378

free(xa_filename);

379

}

380

381

return send_xmessage_using_XAUTHORITY(pll,lokke+1,message);

382

}

383

384

int send_xmessage_using_uids(struct proclistlist *pll, char *message){

385

int num_users;

386

int lokke;

387

int *uids=get_userlist(pll,&num_users);

388

for(lokke=0;lokke<num_users;lokke++){

389

char xauthpath[5000];

390

struct passwd *pass=getpwuid(uids[lokke]);

391

sprintf(xauthpath,"%s/.Xauthority",pass->pw_dir);

392

if(send_xmessage(xauthpath,message)==1){

393

free(uids);

394

return 1;

395

}

396

}

397

398

free(uids);

399

return 0;

400

}

401

402

403

404

405

static void xmessage_fork(struct proclistlist *pll){

406

char message[5000];

407

408

set_pid_priority(0,SCHED_FIFO,sched_get_priority_min(SCHED_FIFO),"Unable to set SCHED_FIFO for %d (\"%s\"). (%s)", "the xmessage fork");

409

410

setenv("DISPLAY",":0.0",1);

411

412

if( ! xmessage_found)

413

sprintf(message,"xmessage \"WARNING! das_watchdog pauses realtime operations for %d seconds.\"",waittime);

414

else

415

sprintf(message,"%s \"WARNING! das_watchdog pauses realtime operations for %d seconds.\"",WHICH_XMESSAGE,waittime);

416

417

if(send_xmessage_using_uids(pll,message)==0){

418

set_pid_priority(0,SCHED_OTHER,0,"Unable to set SCHED_OTHER for %d (\"%s\"). (%s)", "the xmessage fork"); // send_xmessage_using_XAUTHRITY is too heavy to run in realtime.

419

send_xmessage_using_XAUTHORITY(pll,0,message);

420

}

421

422

pll_delete(pll);

423

}

424

425

426

427

// The SCHED_OTHER thread.

428

static void *counter_func(void *arg){

429

430

{

431

set_pid_priority(0,SCHED_FIFO,sched_get_priority_min(SCHED_FIFO),"Unable to set SCHED_FIFO for %d (\"%s\"). (%s)", "the counter_func");

432

}

433

434

for(;;){

435

counter++;

436

if(verbose)

437

print_error(stderr,"counter set to %d",counter);

438

sleep(increasetime);

439

}

440

return NULL;

441

}

442

443

444

445

446

447

int main(int argc,char **argv){

448

pid_t mypid=getpid();

449

pthread_t counter_thread={0};

450

int num_cpus=0;

451

int *timerpids;

452

#if TIMERCHECKS

453

int force=0;

454

#endif

455

int testing=0;

456

457

// Get timer pids

458

{

459

// Find number of timer processes.

460

while(gettimerpid(NULL,num_cpus)!=-1)

461

num_cpus++;

462

timerpids=malloc(sizeof(int)*num_cpus);

463

464

{

465

int cpu=0;

466

for(cpu=0;cpu<num_cpus;cpu++)

467

timerpids[cpu]=gettimerpid(NULL,cpu);

468

}

469

}

470

471

472

// Options.

473

OPTARGS_BEGIN("Usage: das_watchdog [--force] [--verbose] [--checkirq] [--increasetime n] [--checktime n] [--waittime n]\n"

474

" [ -f] [ -v] [ -c] [ -it n] [ -ct n] [ -wt n]\n"

475

"\n"

476

"Additional arguments:\n"

477

"[--version] or [-ve] -> Prints out version.\n"

478

"[--test] or [-te] -> Run a test to see if xmessage is working.\n")

479

480

{

481

OPTARG("--verbose","-v") verbose=1;

482

#if TIMERCHECKS

483

OPTARG("--force","-f") force=1;

484

OPTARG("--checkirq","-c") checkirq=1; return(checksoftirq(0));

485

#endif

486

OPTARG("--increasetime","-it") increasetime=OPTARG_GETINT();

487

OPTARG("--checktime","-ct") checktime=OPTARG_GETINT();

488

OPTARG("--waittime","-wt") waittime=OPTARG_GETINT();

489

OPTARG("--test","-te") testing=1; verbose=1;

490

OPTARG("--version","-ve") printf("Das Version die Uhr Hund %s nach sein bist.\n",VERSION);exit(0);

491

}OPTARGS_END;

492

493

494

// Logging to /var/log/messages

495

{

496

openlog("das_watchdog", 0, LOG_DAEMON);

497

syslog(LOG_INFO, "started");

498

}

499

500

// Check various.

501

{

502

#if TIMERCHECKS

503

if(force && checksoftirq(force)<0)

504

return -2;

505

506

checksoftirq(force);

507

#endif

508

509

if(getuid()!=0){

510

print_error(stdout,"Warning, you are not running as root. das_watchdog should be run as an init-script at startup, and not as a normal user.\n");

511

}

512

513

514

if(access(WHICH_XMESSAGE,X_OK)!=0){

515

print_error(stderr,"Warning, \"xmessage\" is not found or is not an executable. I will try to use the $PATH instead. Hopefully that'll work,");

516

print_error(stderr,"but you might not receive messages to the screen in case das_watchdog has to take action.");

517

xmessage_found=0;

518

}

519

}

520

521

522

// Set priority

523

if(1) {

524

if( ! set_pid_priority(0,SCHED_FIFO,sched_get_priority_max(SCHED_FIFO),

525

"Unable to set SCHED_FIFO realtime priority for %d (\"%s\"). (%s). Exiting.",

526

"Der Gewinde nach die Uhr Hund"))

527

return 0;

528

if(mlockall(MCL_CURRENT|MCL_FUTURE)==-1)

529

print_error(stderr,"Could not call mlockalll(MCL_CURRENT|MCL_FUTURE) (%s)",strerror(errno));

530

}

531

532

533

// Start child thread.

534

{

535

pthread_create(&counter_thread,NULL,counter_func,NULL);

536

}

537

538

539

// Main loop. (We are never supposed to exit from this one.)

540

for(;;){

541

int lastcounter=counter;

542

543

sleep(checktime);

544

if(verbose)

545

print_error(stderr," counter read to be %d (lastcounter=%d)",counter,lastcounter);

546

547

if(lastcounter==counter || testing==1){

548

int changedsched=0;

549

struct proclistlist *pll=pll_create();

550

int lokke;

551

552

if(verbose)

553

print_error(stdout,"Die Uhr Hund stossen sein!");

554

555

for(lokke=0;lokke<pll->length;lokke++){

556

if(pll->proclist[lokke].policy!=SCHED_OTHER

557

&& pll->proclist[lokke].pid!=mypid

558

&& (!is_a_member(pll->proclist[lokke].pid,timerpids,num_cpus))

559

)

560

{

561

struct sched_param par={0};

562

par.sched_priority=0;

563

if(verbose)

564

print_error(stdout,"Setting pid %d temporarily to SCHED_OTHER.",pll->proclist[lokke].pid);

565

if(set_pid_priority(pll->proclist[lokke].pid,SCHED_OTHER,0,"Could not set pid %d (\"%s\") to SCHED_OTHER (%s).\n","no name"))

566

changedsched++;

567

}

568

}

569

570

if(changedsched>0 || testing==1){

571

572

{

573

char message[5000];

574

sprintf(message,"realtime operations paused for %d seconds.",waittime);

575

syslog(LOG_INFO,message);

576

}

577

578

if(fork()==0){

579

xmessage_fork(pll);

580

return 0;

581

}

582

583

sleep(waittime);

584

585

for(lokke=0;lokke<pll->length;lokke++){

586

if(pll->proclist[lokke].policy != SCHED_OTHER

587

&& pll->proclist[lokke].pid != mypid

588

&& (!is_a_member(pll->proclist[lokke].pid,timerpids,num_cpus))

589

&& pll->proclist[lokke].start_time == get_pid_start_time(pll->proclist[lokke].pid)

590

)

591

{

592

if(get_pid_priority(pll->proclist[lokke].pid) != 0

593

|| sched_getscheduler(pll->proclist[lokke].pid) != SCHED_OTHER){

594

print_error(stderr,

595

"Seems like someone else has changed priority and/or scheduling policy for %d in the mean time. I'm not going to do anything.",

596

pll->proclist[lokke].pid);

597

}else{

598

struct sched_param par={0};

599

par.sched_priority=pll->proclist[lokke].priority;

600

if(verbose)

601

print_error(stdout,"Setting pid %d back to realtime priority.",pll->proclist[lokke].pid);

602

set_pid_priority(pll->proclist[lokke].pid,pll->proclist[lokke].policy,pll->proclist[lokke].priority,"Could not set pid %d (\"%s\") to SCHED_FIFO/SCHED_RR (%s).\n\n", "no name");

603

}

604

}

605

}

606

}

607

pll_delete(pll);

608

}

609

if(testing==1) break;

610

}

611

612

return 0;

613

}

614

615

Older »