ProcEventMonitor.cpp

Go to the documentation of this file.

#include "bsc/netlink/ProcEventMonitor.hpp"
#include "bsc/logging/Logger.hpp"
 
#include <array>
#include <cerrno>
#include <cstring>
#include <memory>
#include <thread>
 
#if defined(__linux__)
#include <linux/cn_proc.h>
#include <linux/connector.h>
#include <linux/netlink.h>
#include <sys/socket.h>
#include <unistd.h>
#endif
 
namespace bsc::netlink {
 
#if defined(__linux__)
namespace {
 
ProcEvent::Type from_what(std::uint32_t what) {
    switch (what) {
        case PROC_EVENT_FORK: return ProcEvent::Type::Fork;
        case PROC_EVENT_EXEC: return ProcEvent::Type::Exec;
        case PROC_EVENT_EXIT: return ProcEvent::Type::Exit;
        case PROC_EVENT_UID: return ProcEvent::Type::Uid;
        case PROC_EVENT_GID: return ProcEvent::Type::Gid;
        case PROC_EVENT_SID: return ProcEvent::Type::Sid;
#ifdef PROC_EVENT_COMM
        case PROC_EVENT_COMM: return ProcEvent::Type::Comm;
#endif
#ifdef PROC_EVENT_PTRACE
        case PROC_EVENT_PTRACE: return ProcEvent::Type::Ptrace;
#endif
#ifdef PROC_EVENT_COREDUMP
        case PROC_EVENT_COREDUMP: return ProcEvent::Type::CoreDump;
#endif
        default: return ProcEvent::Type::Unknown;
    }
}
 
} // namespace
 
 
class ProcEventMonitor::Impl {
  public:
    int fd{-1};
    std::thread thread;
    Handler handler;
 
    bool subscribe(bool enable) {
        std::array<char, NLMSG_SPACE(sizeof(cn_msg) + sizeof(enum proc_cn_mcast_op))> buf{};
        auto* nlh = reinterpret_cast<nlmsghdr*>(buf.data());
        auto* cn = reinterpret_cast<cn_msg*>(NLMSG_DATA(nlh));
        auto* op = reinterpret_cast<enum proc_cn_mcast_op*>(cn->data);
 
        nlh->nlmsg_len = NLMSG_LENGTH(sizeof(cn_msg) + sizeof(enum proc_cn_mcast_op));
        nlh->nlmsg_type = NLMSG_DONE;
        nlh->nlmsg_flags = 0;
        nlh->nlmsg_seq = 0;
        nlh->nlmsg_pid = static_cast<std::uint32_t>(::getpid());
 
        cn->id.idx = CN_IDX_PROC;
        cn->id.val = CN_VAL_PROC;
        cn->seq = 0;
        cn->ack = 0;
        cn->len = sizeof(enum proc_cn_mcast_op);
        cn->flags = 0;
 
        *op = enable ? PROC_CN_MCAST_LISTEN : PROC_CN_MCAST_IGNORE;
        return ::send(fd, nlh, nlh->nlmsg_len, 0) == static_cast<ssize_t>(nlh->nlmsg_len);
    }
};
 
ProcEventMonitor::ProcEventMonitor() : impl_(std::make_unique<Impl>()) {}
ProcEventMonitor::~ProcEventMonitor() { stop(); }
 
bool ProcEventMonitor::start(Handler handler) {
    stop();
    impl_ = std::make_unique<Impl>();
    impl_->handler = std::move(handler);
 
    impl_->fd = ::socket(PF_NETLINK, SOCK_DGRAM, NETLINK_CONNECTOR);
    if (impl_->fd < 0) {
        bsc::logging::Logger::instance().warning(std::string("proc netlink socket failed: ") + std::strerror(errno));
        return false;
    }
 
    sockaddr_nl addr{};
    addr.nl_family = AF_NETLINK;
    addr.nl_groups = CN_IDX_PROC;
    addr.nl_pid = static_cast<std::uint32_t>(::getpid());
 
    if (::bind(impl_->fd, reinterpret_cast<sockaddr*>(&addr), sizeof(addr)) < 0) {
        bsc::logging::Logger::instance().warning(std::string("proc netlink bind failed: ") + std::strerror(errno));
        ::close(impl_->fd);
        impl_->fd = -1;
        return false;
    }
 
    if (!impl_->subscribe(true)) {
        bsc::logging::Logger::instance().warning(std::string("proc netlink subscribe failed: ") + std::strerror(errno));
        ::close(impl_->fd);
        impl_->fd = -1;
        return false;
    }
 
    running_ = true;
    impl_->thread = std::thread([this]() {
        std::array<char, 4096> buf{};
        while (running_) {
            const auto recv_len = ::recv(impl_->fd, buf.data(), buf.size(), 0);
            if (recv_len <= 0) {
                if (errno == EINTR) continue;
                if (running_) bsc::logging::Logger::instance().warning(std::string("proc netlink recv failed: ") + std::strerror(errno));
                break;
            }
 
            int remaining = static_cast<int>(recv_len);
            for (nlmsghdr* nlh = reinterpret_cast<nlmsghdr*>(buf.data()); NLMSG_OK(nlh, remaining); nlh = NLMSG_NEXT(nlh, remaining)) {
                if (nlh->nlmsg_type == NLMSG_ERROR || nlh->nlmsg_type == NLMSG_NOOP) continue;
                auto* cn = reinterpret_cast<cn_msg*>(NLMSG_DATA(nlh));
                if (!cn || cn->id.idx != CN_IDX_PROC || cn->id.val != CN_VAL_PROC) continue;
                auto* ev = reinterpret_cast<proc_event*>(cn->data);
                if (!ev) continue;
 
                ProcEvent out;
                out.type = from_what(ev->what);
                switch (ev->what) {
                    case PROC_EVENT_FORK:
                        out.pid = ev->event_data.fork.child_pid;
                        out.tgid = ev->event_data.fork.child_tgid;
                        out.parent_pid = ev->event_data.fork.parent_pid;
                        out.parent_tgid = ev->event_data.fork.parent_tgid;
                        break;
                    case PROC_EVENT_EXEC:
                        out.pid = ev->event_data.exec.process_pid;
                        out.tgid = ev->event_data.exec.process_tgid;
                        break;
                    case PROC_EVENT_EXIT:
                        out.pid = ev->event_data.exit.process_pid;
                        out.tgid = ev->event_data.exit.process_tgid;
                        out.exit_code = static_cast<std::int32_t>(ev->event_data.exit.exit_code);
                        out.exit_signal = ev->event_data.exit.exit_signal;
                        break;
                    case PROC_EVENT_UID:
                        out.pid = ev->event_data.id.process_pid;
                        out.tgid = ev->event_data.id.process_tgid;
                        out.uid = ev->event_data.id.r.ruid;
                        break;
                    case PROC_EVENT_GID:
                        out.pid = ev->event_data.id.process_pid;
                        out.tgid = ev->event_data.id.process_tgid;
                        out.gid = ev->event_data.id.r.rgid;
                        break;
#ifdef PROC_EVENT_COMM
                    case PROC_EVENT_COMM:
                        out.pid = ev->event_data.comm.process_pid;
                        out.tgid = ev->event_data.comm.process_tgid;
                        out.comm = ev->event_data.comm.comm;
                        break;
#endif
                    default:
                        break;
                }
                if (impl_->handler) impl_->handler(out);
            }
        }
    });
    return true;
}
 
void ProcEventMonitor::stop() {
    running_ = false;
    if (!impl_) return;
    if (impl_->fd >= 0) {
        impl_->subscribe(false);
        ::shutdown(impl_->fd, SHUT_RDWR);
        ::close(impl_->fd);
        impl_->fd = -1;
    }
    if (impl_->thread.joinable()) impl_->thread.join();
}
 
bool ProcEventMonitor::available() { return true; }
 
#else
 
class ProcEventMonitor::Impl {};
ProcEventMonitor::ProcEventMonitor() : impl_(std::make_unique<Impl>()) {}
ProcEventMonitor::~ProcEventMonitor() = default;
bool ProcEventMonitor::start(Handler) { return false; }
void ProcEventMonitor::stop() {}
bool ProcEventMonitor::available() { return false; }
 
#endif
 
} // namespace bsc::netlink