Golang syscall.ProcAttr类代码示例

// setup and fork/exec myself. Make sure to keep open important FD's that won't get re-created by the child
// specifically, std* and your listen socket
func forker(srv *falcore.Server) (pid int, err int) {
	fmt.Printf("Forking now with socket: %v\n", srv.SocketFd())
	mypath := os.Args[0]
	args := []string{mypath, "-socket", fmt.Sprintf("%v", srv.SocketFd())}
	attr := new(syscall.ProcAttr)
	attr.Files = append([]int(nil), 0, 1, 2, srv.SocketFd())
	pid, err = syscall.ForkExec(mypath, args, attr)
	return
}

func pwinput(prompt string) (pw string, err error) {
	fmt.Print(prompt)
	cmd := "/bin/stty"
	args := []string{"stty", "-echo"}
	fd := []uintptr{uintptr(syscall.Stdin), uintptr(syscall.Stdout), uintptr(syscall.Stderr)}
	proc := new(syscall.ProcAttr)
	proc.Files = fd
	_, err = syscall.ForkExec(cmd, args, proc)
	if err != nil {
		return pw, errors.New("failed forkexec")
	}
	bytes := make([]byte, 1000)
	os.Stdin.Read(bytes)
	pw = strings.TrimRight(string(bytes), string([]byte{0}))
	pw = strings.TrimRight(pw, "\n")
	return
}

// setup and fork/exec myself. Make sure to keep open important FD's that won't get re-created by the child
// specifically, std* and your listen socket
func forker(srv *falcore.Server) (pid int, err error) {
	var socket string
	// At version 1.0.3 the socket FD behavior changed and the fork socket is always 3
	// 0 = stdin, 1 = stdout, 2 = stderr, 3 = acceptor socket
	// This is because the ForkExec dups all the saved FDs down to
	// start at 0.  This is also why you MUST include 0,1,2 in the
	// attr.Files
	if goVersion103OrAbove() {
		socket = "3"
	} else {
		socket = fmt.Sprintf("%v", srv.SocketFd())
	}
	fmt.Printf("Forking now with socket: %v\n", socket)
	mypath := os.Args[0]
	args := []string{mypath, "-socket", socket}
	attr := new(syscall.ProcAttr)
	attr.Files = append([]uintptr(nil), 0, 1, 2, uintptr(srv.SocketFd()))
	pid, err = syscall.ForkExec(mypath, args, attr)
	return
}

func main() {
	start := time.Now()

	args := os.Args

	if len(args) == 1 {
		var attr syscall.ProcAttr
		var sattr syscall.SysProcAttr
		attr.Files = []uintptr{uintptr(syscall.Stdin), uintptr(syscall.Stdout), uintptr(syscall.Stderr)}
		attr.Sys = &sattr

		now := time.Now()
		_, err := syscall.ForkExec("Exec", []string{"Exec", "dont"}, &attr)
		if err != nil {
			fmt.Printf("Err: %v\n", err)
		}
		fmt.Printf("Parent: %v\n", now)
	} else {
		fmt.Printf("Child: %v\n", start)
	}
}

func Spawn(tokens []string) (int, error) {
	cmd, lookError := exec.LookPath(tokens[0])
	if lookError != nil {
		log.Printf("[ERROR] [process] Spawn.exec.LookPath(%s) >>> %s\n", tokens[0], lookError)
		return 0, lookError
	}

	var sys_attr syscall.SysProcAttr
	var proc_attr syscall.ProcAttr
	proc_attr.Sys = &sys_attr
	proc_attr.Env = os.Environ()
	proc_attr.Files = []uintptr{uintptr(syscall.Stdin),
		uintptr(syscall.Stdout),
		uintptr(syscall.Stderr)}

	pid, forkError := syscall.ForkExec(cmd, tokens, &proc_attr)
	if forkError != nil {
		log.Printf("[ERROR] [process] Spwan.syscall.ForkExec(%s) >>> %s\n", cmd, forkError)
		return 0, forkError
	}
	return pid, nil
}

func Tracer() {

	p := new(oz.Profile)
	if err := json.NewDecoder(os.Stdin).Decode(&p); err != nil {
		log.Error("unable to decode profile data: %v", err)
		os.Exit(1)
	}

	var proc_attr syscall.ProcAttr
	var sys_attr syscall.SysProcAttr

	sys_attr.Ptrace = true
	done := false
	proc_attr.Sys = &sys_attr

	cmd := os.Args[1]
	cmdArgs := os.Args[2:]
	log.Info("Tracer running command (%v) arguments (%v)\n", cmd, cmdArgs)
	c := exec.Command(cmd)
	c.SysProcAttr = &syscall.SysProcAttr{Ptrace: true}
	c.Env = os.Environ()
	c.Args = append(c.Args, cmdArgs...)

	pi, err := c.StdinPipe()
	if err != nil {
		fmt.Errorf("error creating stdin pipe for tracer process: %v", err)
		os.Exit(1)
	}
	jdata, err := json.Marshal(p)
	if err != nil {
		fmt.Errorf("Unable to marshal seccomp state: %+v", err)
		os.Exit(1)
	}
	io.Copy(pi, bytes.NewBuffer(jdata))
	log.Info(string(jdata))
	pi.Close()

	children := make(map[int]bool)

	if err := c.Start(); err == nil {
		children[c.Process.Pid] = true
		var s syscall.WaitStatus
		pid, err := syscall.Wait4(-1, &s, syscall.WALL, nil)
		children[pid] = true
		if err != nil {
			log.Error("Error (wait4): %v", err)
		}
		log.Info("Tracing child pid: %v\n", pid)
		for done == false {
			syscall.PtraceSetOptions(pid, unix.PTRACE_O_TRACESECCOMP|unix.PTRACE_O_TRACEFORK|unix.PTRACE_O_TRACEVFORK|unix.PTRACE_O_TRACECLONE|unix.PTRACE_O_TRACEEXIT)
			syscall.PtraceCont(pid, 0)
			pid, err = syscall.Wait4(-1, &s, syscall.WALL, nil)
			if err != nil {
				log.Error("Error (wait4): %v\n", err)
				if len(children) == 0 {
					done = true
				}
				continue
			}
			children[pid] = true
			if s.Exited() == true {
				delete(children, pid)
				log.Info("Child pid %v finished.\n", pid)
				if len(children) == 0 {
					done = true
				}
				continue
			}
			if uint32(s)>>8 == (uint32(unix.SIGTRAP) | (unix.PTRACE_EVENT_SECCOMP << 8)) {
				if err != nil {
					log.Error("Error (ptrace): %v", err)
					continue
				}
				var regs syscall.PtraceRegs
				err = syscall.PtraceGetRegs(pid, &regs)
				if err != nil {
					log.Error("Error (ptrace): %v", err)
				}
				systemcall, err := syscallByNum(int(regs.Orig_rax))
				if err != nil {
					log.Error("Error: %v", err)
					continue
				}
				var callrep string = fmt.Sprintf("%s(", systemcall.name)
				var reg uint64 = 0

				for arg := range systemcall.args {

					if systemcall.args[arg] == 0 {
						break
					}

					if arg > 0 {
						callrep += fmt.Sprintf(",")
					}

					switch arg {
					case 0:
						reg = regs.Rdi
					case 1:
//.........这里部分代码省略.........

func Tracer() {

	p := new(oz.Profile)
	if err := json.NewDecoder(os.Stdin).Decode(&p); err != nil {
		log.Error("unable to decode profile data: %v", err)
		os.Exit(1)
	}

	var proc_attr syscall.ProcAttr
	var sys_attr syscall.SysProcAttr

	sys_attr.Ptrace = true
	done := false
	proc_attr.Sys = &sys_attr

	cmd := os.Args[1]
	cmdArgs := os.Args[2:]
	log.Info("Tracer running command (%v) arguments (%v)\n", cmd, cmdArgs)
	c := exec.Command(cmd)
	c.SysProcAttr = &syscall.SysProcAttr{Ptrace: true}
	c.Env = os.Environ()
	c.Args = append(c.Args, cmdArgs...)

	pi, err := c.StdinPipe()
	if err != nil {
		fmt.Errorf("error creating stdin pipe for tracer process: %v", err)
		os.Exit(1)
	}
	jdata, err := json.Marshal(p)
	if err != nil {
		fmt.Errorf("Unable to marshal seccomp state: %+v", err)
		os.Exit(1)
	}
	io.Copy(pi, bytes.NewBuffer(jdata))
	log.Info(string(jdata))
	pi.Close()

	children := make(map[int]bool)
	renderFunctions := getRenderingFunctions()

	if err := c.Start(); err == nil {
		children[c.Process.Pid] = true
		var s syscall.WaitStatus
		pid, err := syscall.Wait4(-1, &s, syscall.WALL, nil)
		children[pid] = true
		if err != nil {
			log.Error("Error (wait4) here first: %v %i", err, pid)
		}
		log.Info("Tracing child pid: %v\n", pid)
		for done == false {
			syscall.PtraceSetOptions(pid, unix.PTRACE_O_TRACESECCOMP|unix.PTRACE_O_TRACEFORK|unix.PTRACE_O_TRACEVFORK|unix.PTRACE_O_TRACECLONE)
			syscall.PtraceCont(pid, 0)
			pid, err = syscall.Wait4(-1, &s, syscall.WALL, nil)
			if err != nil {
				log.Error("Error (wait4) here: %v %i %v\n", err, pid, children)
				if len(children) == 0 {
					done = true
				}
				continue
			}
			children[pid] = true
			if s.Exited() == true {
				delete(children, pid)
				log.Info("Child pid %v finished.\n", pid)
				if len(children) == 0 {
					done = true
				}
				continue
			}
			if s.Signaled() == true {
				log.Error("Other pid signalled %v %v", pid, s)
				delete(children, pid)
				continue
			}
			switch uint32(s) >> 8 {

			case uint32(unix.SIGTRAP) | (unix.PTRACE_EVENT_SECCOMP << 8):
				if err != nil {
					log.Error("Error (ptrace): %v", err)
					continue
				}
				var regs syscall.PtraceRegs
				err = syscall.PtraceGetRegs(pid, &regs)

				if err != nil {
					log.Error("Error (ptrace): %v", err)
				}

				systemcall, err := syscallByNum(getSyscallNumber(regs))
				if err != nil {
					log.Error("Error: %v", err)
					continue
				}

				/* Render the system call invocation */

				r := getSyscallRegisterArgs(regs)
				call := ""

				if f, ok := renderFunctions[getSyscallNumber(regs)]; ok {
//.........这里部分代码省略.........