~ubuntu-branches/ubuntu/precise/das-watchdog/precise-security

#define OPTARGS_BEGIN(das_usage) {int lokke;const char *usage=das_usage;for(lokke=1;lokke<argc;lokke++){char *a=argv[lokke];if(!strcmp("--help",a)||!strcmp("-h",a)){printf(usage);return 0;

#define OPTARG(name,name2) }}else if(!strcmp(name,a)||!strcmp(name2,a)){{

#define OPTARG_GETINT() atoi(argv[++lokke])

#define OPTARG_GETFLOAT() atof(argv[++lokke])

#define OPTARG_GETSTRING() argv[++lokke]

#define OPTARG_LAST() }}else if(lokke==argc-1){lokke--;{

#define OPTARGS_ELSE() }else if(1){

#define OPTARGS_END }else{fprintf(stderr,usage);return(-1);}}}

static int increasetime=1; // Seconds between each time the SCHED_OTHER thread is increasing the counter.

static int checktime=4; // Seconds between each time the SCHED_FIFO thread checks that the counter is increased.

static int waittime=8; // Seconds the SCHED_FIFO thread waits before setting the processes back to SCHED_FIFO.

struct das_proclist{

pid_t pid;

int policy; //SCHED_OTHER, SCHED_FIFO, SHED_RR

int priority;

ui64 start_time; // Creation time of the process.

};

struct proclistlist{

struct das_proclist *proclist;

int length;

};

static int verbose=0;

int counter=0; // Make non-static in case the c compiler does a whole-program optimization. :-)

#if TIMERCHECKS

static int checkirq=0;

#endif

static int xmessage_found=1;

static void print_error(FILE *where,char *fmt, ...) {

char temp[10000];

va_list ap;

va_start(ap, fmt);{

vsnprintf (temp, 9998, fmt, ap);

}va_end(ap);

syslog(LOG_INFO,temp);

fprintf(where,"Das_Watchdog: %s\n",temp);

}

100

static ui64 get_pid_start_time(pid_t pid){

101

glibtop_proc_time buf={0};

102

glibtop_get_proc_time(&buf,pid);

103

return buf.start_time;

104

}

105

106

107

static int get_pid_priority(pid_t pid){

108

struct sched_param par;

109

sched_getparam(pid,&par);

110

return par.sched_priority;

111

}

112

113

static int set_pid_priority(pid_t pid,int policy,int priority,char *message,char *name){

114

struct sched_param par={0};

115

par.sched_priority=priority;

116

if((sched_setscheduler(pid,policy,&par)!=0)){

117

print_error(stderr,message,pid,name,strerror(errno));

118

return 0;

119

}

120

return 1;

121

}

122

123

124

struct das_proclist *get_proclist(int *num_procs){

125

int lokke=0;

126

127

glibtop_proclist proclist_def={0};

128

pid_t *proclist=glibtop_get_proclist(&proclist_def,GLIBTOP_KERN_PROC_ALL,0); //|GLIBTOP_EXCLUDE_SYSTEM,0);

129

struct das_proclist *ret=calloc(sizeof(struct das_proclist),proclist_def.number);

130

131

*num_procs=proclist_def.number;

132

133

for(lokke=0;lokke<proclist_def.number;lokke++){

134

pid_t pid=proclist[lokke];

135

ret[lokke].pid=pid;

136

ret[lokke].policy=sched_getscheduler(pid);

137

ret[lokke].priority=get_pid_priority(pid);

138

ret[lokke].start_time=get_pid_start_time(pid);

139

}

140

141

#if LIBGTOP_MAJOR_VERSION<2

142

glibtop_free(proclist);

143

#else

144

g_free(proclist);

145

#endif

146

147

return ret;

148

}

149

150

struct proclistlist *pll_create(void){

151

struct proclistlist *pll=calloc(1,sizeof(struct proclistlist));

152

pll->proclist=get_proclist(&pll->length);

153

return pll;

154

}

155

156

static void pll_delete(struct proclistlist *pll){

157

free(pll->proclist);

158

free(pll);

159

}

160

161

162

163

static pid_t name2pid(char *name){

164

pid_t pid=-1;

165

int lokke;

166

int num_procs=0;

167

struct das_proclist *proclist=get_proclist(&num_procs);

168

169

for(lokke=0;lokke<num_procs;lokke++){

170

glibtop_proc_state state;

171

glibtop_get_proc_state(&state,proclist[lokke].pid);

172

if(!strcmp(state.cmd,name)){

173

pid=proclist[lokke].pid;

174

break;

175

}

176

}

177

free(proclist);

178

return pid;

179

}

180

181

182

183

static int is_a_member(int val,int *vals,int num_vals){

184

int lokke;

185

for(lokke=0;lokke<num_vals;lokke++)

186

if(val==vals[lokke])

187

return 1;

188

return 0;

189

}

190

191

192

193

// Returns a list of users that might be the one owning the proper .Xauthority file.

194

static int *get_userlist(struct proclistlist *pll, int *num_users){

195

int *ret=calloc(sizeof(int),pll->length);

196

int lokke;

197

198

*num_users=0;

199

200

for(lokke=0;lokke<pll->length;lokke++){

201

glibtop_proc_uid uid;

202

glibtop_get_proc_uid(&uid,pll->proclist[lokke].pid);

203

if( ! is_a_member(uid.uid,ret,*num_users)){ // ???

204

ret[*num_users]=uid.uid;

205

(*num_users)++;

206

}

207

}

208

return ret;

209

}

210

211

212

213

static int gettimerpid(char *name,int cpu){

214

pid_t pid;

215

char temp[500];

216

217

if(name==NULL)

218

name=&temp[0];

219

220

sprintf(name,"softirq-timer/%d",cpu);

221

222

pid=name2pid(name);

223

224

if(pid==-1){

225

sprintf(name,"ksoftirqd/%d",cpu);

226

pid=name2pid(name);

227

}

228

229

return pid;

230

}

231

232

233

234

#if TIMERCHECKS

235

static int checksoftirq2(int force,int cpu){

236

char name[500];

237

pid_t pid=gettimerpid(&name[0],cpu);

238

239

if(pid==-1) return 0;

240

241

242

{

243

int policy=sched_getscheduler(pid);

244

int priority=get_pid_priority(pid);

245

246

if(priority<sched_get_priority_max(SCHED_FIFO)

247

|| policy==SCHED_OTHER

248

)

249

{

250

251

if(force){

252

print_error(stdout,"Forcing %s to SCHED_FIFO priority %d",name,sched_get_priority_max(SCHED_FIFO));

253

set_pid_priority(pid,SCHED_FIFO,sched_get_priority_max(SCHED_FIFO),"Could not set %d (\"%s\") to SCHED_FIFO (%s).\n\n",name);

254

return checksoftirq2(0,cpu);

255

}

256

257

258

if(priority<sched_get_priority_max(SCHED_FIFO))

259

print_error(stderr,

260

"\n\nWarning. The priority of the \"%s\" process is only %d, and not %d. Unless you are using the High Res Timer,\n"

261

"the watchdog will probably not work. If you are using the High Res Timer, please continue doing so and ignore this message.\n",

262

name,

263

priority,

264

sched_get_priority_max(SCHED_FIFO)

265

);

266

if(policy==SCHED_OTHER)

267

print_error(stderr,

268

"\n\nWarning The \"%s\" process is running SCHED_OTHER. Unless you are using the High Res Timer,\n"

269

"the watchdog will probably not work, and the timing on your machine is probably horrible.\n",

270

name

271

);

272

273

if(checkirq){

274

print_error(stdout,"\n\nUnless you are using the High Res Timer, you need to add the \"--force\" flag to run das_watchdog reliably.\n");

275

print_error(stdout,"(Things might change though, so it could work despite all warnings above. To test the watchdog, run the \"test_rt\" program.)\n\n");

276

}

277

return -1;

278

}

279

//printf("name: -%s-\n",state.cmd);

280

281

return 1;

282

}

283

}

284

285

286

static int checksoftirq(int force){

287

int cpu=0;

288

289

for(;;){

290

switch(checksoftirq2(force,cpu)){

291

case -1:

292

return -1;

293

case 1:

294

cpu++;

295

break;

296

case 0:

297

default:

298

return 0;

299

}

300

}

301

return 0;

302

}

303

#endif

304

305

306

307

static char *get_pid_environ_val(pid_t pid,char *val){

308

int temp_size = 500;

309

char *temp = malloc(temp_size);

310

311

int i=0;

312

int foundit=0;

313

FILE *fp;

314

315

sprintf(temp,"/proc/%d/environ",pid);

316

317

fp=fopen(temp,"r");

318

if(fp==NULL){

319

free(temp);

320

return NULL;

321

}

322

323

for(;;){

324

325

if (i >= temp_size) {

326

temp_size *= 2;

327

temp = realloc(temp, temp_size);

328

}

329

330

temp[i]=fgetc(fp);

331

332

if(foundit==1 && (temp[i]=='\0' || temp[i]==EOF)){

333

fclose(fp);

334

temp[i]=0;

335

return temp;

336

}

337

338

switch(temp[i]){

339

case EOF:

340

fclose(fp);

341

free(temp);

342

return NULL;

343

case '=':

344

temp[i]=0;

345

if(!strcmp(temp,val)){

346

foundit=1;

347

}

348

i=0;

349

break;

350

case '\0':

351

i=0;

352

break;

353

default:

354

i++;

355

}

356

}

357

}

358

359

// Returns 1 in case a message was sent.

360

static int send_xmessage(char *xa_filename,char *message){

361

if(access(xa_filename,R_OK)==0){

362

setenv("XAUTHORITY",xa_filename,1);

363

if(verbose)

364

print_error(stdout,"Trying xauth file \"%s\"",xa_filename);

365

if(system(message)==0)

366

return 1;

367

}

368

return 0;

369

}

370

371

// Returns 1 in case a message was sent.

372

static int send_xmessage_using_XAUTHORITY(struct proclistlist *pll,int lokke,char *message){

373

374

if(lokke==pll->length)

375

return 0;

376

377

{

378

char *xa_filename=get_pid_environ_val(pll->proclist[lokke].pid,"XAUTHORITY");

379

if(xa_filename!=NULL){

380

if(send_xmessage(xa_filename,message)==1){

381

free(xa_filename);

382

return 1;

383

}

384

}

385

free(xa_filename);

386

}

387

388

return send_xmessage_using_XAUTHORITY(pll,lokke+1,message);

389

}

390

391

int send_xmessage_using_uids(struct proclistlist *pll, char *message){

392

int num_users;

393

int lokke;

394

int *uids=get_userlist(pll,&num_users);

395

for(lokke=0;lokke<num_users;lokke++){

396

char xauthpath[5000];

397

struct passwd *pass=getpwuid(uids[lokke]);

398

sprintf(xauthpath,"%s/.Xauthority",pass->pw_dir);

399

if(send_xmessage(xauthpath,message)==1){

400

free(uids);

401

return 1;

402

}

403

}

404

405

free(uids);

406

return 0;

407

}

408

409

410

411

412

static void xmessage_fork(struct proclistlist *pll){

413

char message[5000];

414

415

set_pid_priority(0,SCHED_FIFO,sched_get_priority_min(SCHED_FIFO),"Unable to set SCHED_FIFO for %d (\"%s\"). (%s)", "the xmessage fork");

416

417

setenv("DISPLAY",":0.0",1);

418

419

if( ! xmessage_found)

420

sprintf(message,"xmessage \"WARNING! das_watchdog pauses realtime operations for %d seconds.\"",waittime);

421

else

422

sprintf(message,"%s \"WARNING! das_watchdog pauses realtime operations for %d seconds.\"",WHICH_XMESSAGE,waittime);

423

424

if(send_xmessage_using_uids(pll,message)==0){

425

set_pid_priority(0,SCHED_OTHER,0,"Unable to set SCHED_OTHER for %d (\"%s\"). (%s)", "the xmessage fork"); // send_xmessage_using_XAUTHRITY is too heavy to run in realtime.

426

send_xmessage_using_XAUTHORITY(pll,0,message);

427

}

428

429

pll_delete(pll);

430

}

431

432

433

434

// The SCHED_OTHER thread.

435

static void *counter_func(void *arg){

436

437

{

438

set_pid_priority(0,SCHED_FIFO,sched_get_priority_min(SCHED_FIFO),"Unable to set SCHED_FIFO for %d (\"%s\"). (%s)", "the counter_func");

439

}

440

441

for(;;){

442

counter++;

443

if(verbose)

444

print_error(stderr,"counter set to %d",counter);

445

sleep(increasetime);

446

}

447

return NULL;

448

}

449

450

451

452

453

454

int main(int argc,char **argv){

455

pid_t mypid=getpid();

456

pthread_t counter_thread={0};

457

int num_cpus=0;

458

int *timerpids;

459

#if TIMERCHECKS

460

int force=0;

461

#endif

462

int testing=0;

463

464

// Get timer pids

465

{

466

// Find number of timer processes.

467

while(gettimerpid(NULL,num_cpus)!=-1)

468

num_cpus++;

469

timerpids=malloc(sizeof(int)*num_cpus);

470

471

{

472

int cpu=0;

473

for(cpu=0;cpu<num_cpus;cpu++)

474

timerpids[cpu]=gettimerpid(NULL,cpu);

475

}

476

}

477

478

479

// Options.

480

OPTARGS_BEGIN("Usage: das_watchdog [--force] [--verbose] [--checkirq] [--increasetime n] [--checktime n] [--waittime n]\n"

481

" [ -f] [ -v] [ -c] [ -it n] [ -ct n] [ -wt n]\n"

482

"\n"

483

"Additional arguments:\n"

484

"[--version] or [-ve] -> Prints out version.\n"

485

"[--test] or [-te] -> Run a test to see if xmessage is working.\n")

486

487

{

488

OPTARG("--verbose","-v") verbose=1;

489

#if TIMERCHECKS

490

OPTARG("--force","-f") force=1;

491

OPTARG("--checkirq","-c") checkirq=1; return(checksoftirq(0));

492

#endif

493

OPTARG("--increasetime","-it") increasetime=OPTARG_GETINT();

494

OPTARG("--checktime","-ct") checktime=OPTARG_GETINT();

495

OPTARG("--waittime","-wt") waittime=OPTARG_GETINT();

496

OPTARG("--test","-te") testing=1; verbose=1;

497

OPTARG("--version","-ve") printf("Das Version die Uhr Hund %s nach sein bist.\n",VERSION);exit(0);

498

}OPTARGS_END;

499

500

501

// Logging to /var/log/messages

502

{

503

openlog("das_watchdog", 0, LOG_DAEMON);

504

syslog(LOG_INFO, "started");

505

}

506

507

// Check various.

508

{

509

#if TIMERCHECKS

510

if(force && checksoftirq(force)<0)

511

return -2;

512

513

checksoftirq(force);

514

#endif

515

516

if(getuid()!=0){

517

print_error(stdout,"Warning, you are not running as root. das_watchdog should be run as an init-script at startup, and not as a normal user.\n");

518

}

519

520

521

if(access(WHICH_XMESSAGE,X_OK)!=0){

522

print_error(stderr,"Warning, \"xmessage\" is not found or is not an executable. I will try to use the $PATH instead. Hopefully that'll work,");

523

print_error(stderr,"but you might not receive messages to the screen in case das_watchdog has to take action.");

524

xmessage_found=0;

525

}

526

}

527

528

529

// Set priority

530

if(1) {

531

if( ! set_pid_priority(0,SCHED_FIFO,sched_get_priority_max(SCHED_FIFO),

532

"Unable to set SCHED_FIFO realtime priority for %d (\"%s\"). (%s). Exiting.",

533

"Der Gewinde nach die Uhr Hund"))

534

return 0;

535

if(mlockall(MCL_CURRENT|MCL_FUTURE)==-1)

536

print_error(stderr,"Could not call mlockalll(MCL_CURRENT|MCL_FUTURE) (%s)",strerror(errno));

537

}

538

539

540

// Start child thread.

541

{

542

pthread_create(&counter_thread,NULL,counter_func,NULL);

543

}

544

545

546

// Main loop. (We are never supposed to exit from this one.)

547

for(;;){

548

int lastcounter=counter;

549

550

sleep(checktime);

551

if(verbose)

552

print_error(stderr," counter read to be %d (lastcounter=%d)",counter,lastcounter);

553

554

if(lastcounter==counter || testing==1){

555

int changedsched=0;

556

struct proclistlist *pll=pll_create();

557

int lokke;

558

559

if(verbose)

560

print_error(stdout,"Die Uhr Hund stossen sein!");

561

562

for(lokke=0;lokke<pll->length;lokke++){

563

if(pll->proclist[lokke].policy!=SCHED_OTHER

564

&& pll->proclist[lokke].pid!=mypid

565

&& (!is_a_member(pll->proclist[lokke].pid,timerpids,num_cpus))

566

)

567

{

568

struct sched_param par={0};

569

par.sched_priority=0;

570

if(verbose)

571

print_error(stdout,"Setting pid %d temporarily to SCHED_OTHER.",pll->proclist[lokke].pid);

572

if(set_pid_priority(pll->proclist[lokke].pid,SCHED_OTHER,0,"Could not set pid %d (\"%s\") to SCHED_OTHER (%s).\n","no name"))

573

changedsched++;

574

}

575

}

576

577

if(changedsched>0 || testing==1){

578

579

{

580

char message[5000];

581

sprintf(message,"realtime operations paused for %d seconds.",waittime);

582

syslog(LOG_INFO,message);

583

}

584

585

if(fork()==0){

586

xmessage_fork(pll);

587

return 0;

588

}

589

590

sleep(waittime);

591

592

for(lokke=0;lokke<pll->length;lokke++){

593

if(pll->proclist[lokke].policy != SCHED_OTHER

594

&& pll->proclist[lokke].pid != mypid

595

&& (!is_a_member(pll->proclist[lokke].pid,timerpids,num_cpus))

596

&& pll->proclist[lokke].start_time == get_pid_start_time(pll->proclist[lokke].pid)

597

)

598

{

599

if(get_pid_priority(pll->proclist[lokke].pid) != 0

600

|| sched_getscheduler(pll->proclist[lokke].pid) != SCHED_OTHER){

601

print_error(stderr,

602

"Seems like someone else has changed priority and/or scheduling policy for %d in the mean time. I'm not going to do anything.",

603

pll->proclist[lokke].pid);

604

}else{

605

struct sched_param par={0};

606

par.sched_priority=pll->proclist[lokke].priority;

607

if(verbose)

608

print_error(stdout,"Setting pid %d back to realtime priority.",pll->proclist[lokke].pid);

609

set_pid_priority(pll->proclist[lokke].pid,pll->proclist[lokke].policy,pll->proclist[lokke].priority,"Could not set pid %d (\"%s\") to SCHED_FIFO/SCHED_RR (%s).\n\n", "no name");

610

}

611

}

612

}

613

}

614

pll_delete(pll);

615

}

616

if(testing==1) break;

617

}

618

619

return 0;

620

}

621

622

Older »