head	1.3;
access;
symbols
	RELENG_9:1.3.0.2;
locks; strict;
comment	@# @;


1.3
date	2012.09.01.08.14.21;	author rpaulo;	state Exp;
branches
	1.3.2.1;
next	1.2;

1.2
date	2012.05.14.21.59.47;	author gnn;	state Exp;
branches;
next	1.1;

1.1
date	2012.05.12.21.25.48;	author gnn;	state Exp;
branches;
next	;

1.3.2.1
date	2012.09.01.08.14.21;	author svnexp;	state dead;
branches;
next	1.3.2.2;

1.3.2.2
date	2013.06.13.19.01.54;	author svnexp;	state Exp;
branches;
next	;


desc
@@


1.3
log
@SVN rev 239972 on 2012-09-01 08:14:21Z by rpaulo

Finish porting execsnoop to FreeBSD. This includes replacing the zonename
with a jail ID and removing the project ID from the list of options.
@
text
@#!/bin/sh
#
# execsnoop - snoop process execution as it occurs.
#             Written using DTrace (Solaris 10 3/05).
#
# $Id: execsnoop 3 2007-08-01 10:50:08Z brendan $
#
# USAGE:	execsnoop [-a|-A|-ehsvJ] [-c command]
#
#		execsnoop	# default output
#
#		-a		# print all data
#		-A		# dump all data, space delimited
#		-e		# safe output - parseable
#		-s		# print start time, us
#		-v		# print start time, string
#		-J		# print jail ID
#		-c command	# command name to snoop
#	eg,
#		execsnoop -v		# human readable timestamps
#		execsnoop -J		# print jail ID
#		execsnoop -c ls		# snoop ls commands only
#
# The parseable output ensures that the ARGS field doesn't contain
# any "\n"s, which normally sometimes can - and would wreck postprocessing.
#
# FIELDS:
#		UID		User ID
#		PID		Process ID
#		PPID		Parent Process ID
#		COMM		command name for the process
#		ARGS		argument listing for the process
#		JAIL ID		Jail ID	
#		TIME		timestamp for the command, us
#		STRTIME		timestamp for the command, string
#
# SEE ALSO: BSM auditing.
#
# COPYRIGHT: Copyright (c) 2005 Brendan Gregg.
#
# CDDL HEADER START
#
#  The contents of this file are subject to the terms of the
#  Common Development and Distribution License, Version 1.0 only
#  (the "License").  You may not use this file except in compliance
#  with the License.
#
#  You can obtain a copy of the license at Docs/cddl1.txt
#  or http://www.opensolaris.org/os/licensing.
#  See the License for the specific language governing permissions
#  and limitations under the License.
#
# CDDL HEADER END
#
# Author: Brendan Gregg  [Sydney, Australia]
#
# 27-Mar-2004	Brendan Gregg	Created this.
# 21-Jan-2005	   "	  "	Wrapped in sh to provide options.
# 08-May-2005 	   "      "	Rewritten for performance.
# 14-May-2005 	   "      "	Added zonename.
# 02-Jul-2005 	   "      "	Added projid, safe printing.
# 11-Sep-2005	   "      "	Increased switchrate.
# 11-Sep-2005	   "      "	Last update.
# 


##############################
# --- Process Arguments ---
#

### default variables
opt_dump=0; opt_cmd=0; opt_time=0; opt_timestr=0; filter=0; command=.
opt_jailid=0; opt_safe=0

### process options
while getopts aAc:ehsvJ name
do
	case $name in
	a)	opt_time=1; opt_timestr=1; opt_jailid=1 ;;
	A)	opt_dump=1 ;;
	c)	opt_cmd=1; command=$OPTARG ;;
	e)	opt_safe=1 ;;
	s)	opt_time=1 ;;
	v)	opt_timestr=1 ;;
	J)	opt_jailid=1 ;;
	h|?)	cat <<-END >&2
		USAGE: execsnoop [-a|-A|-ehjsvJ] [-c command]
		       execsnoop                # default output
		                -a              # print all data
		                -A              # dump all data, space delimited
		                -e              # safe output, parseable
		                -s              # print start time, us
		                -v              # print start time, string
		                -J              # print jail ID 
		                -c command      # command name to snoop
		  eg,
		        execsnoop -v            # human readable timestamps
		        execsnoop -J		# print jail ID 
		        execsnoop -c ls         # snoop ls commands only
		END
		exit 1
	esac
done

### option logic
if [ $opt_dump -eq 1 ]; then
	opt_time=0; opt_timestr=0; opt_jailid=0
fi
if [ $opt_cmd -eq 1 ]; then
	filter=1
fi


#################################
# --- Main Program, DTrace ---
#
/usr/sbin/dtrace -n '
 /*
  * Command line arguments
  */
 inline int OPT_dump 	= '$opt_dump';
 inline int OPT_cmd 	= '$opt_cmd';
 inline int OPT_time 	= '$opt_time';
 inline int OPT_timestr	= '$opt_timestr';
 inline int OPT_jailid  = '$opt_jailid';
 inline int OPT_safe 	= '$opt_safe';
 inline int FILTER 	= '$filter';
 inline string COMMAND 	= "'$command'";
 
 #pragma D option quiet
 #pragma D option switchrate=10hz
 
 /*
  * Print header
  */
 dtrace:::BEGIN 
 {
	/* print optional headers */
 	OPT_time    ? printf("%-14s ", "TIME") : 1;
 	OPT_timestr ? printf("%-20s ", "STRTIME") : 1;
 	OPT_jailid    ? printf("%-10s ", "JAIL ID") : 1;

	/* print main headers */
	OPT_dump    ? printf("%s %s %s %s %s %s %s\n",
	    "TIME", "JAIL ID", "UID", "PID", "PPID", "COMM", "ARGS") :
	    printf("%5s %6s %6s %s\n", "UID", "PID", "PPID", "ARGS");
 }

 /*
  * Print exec event
  */
 syscall::execve:return
 /(FILTER == 0) || (OPT_cmd == 1 && COMMAND == execname)/ 
 {
	/* print optional fields */
 	OPT_time ? printf("%-14d ", timestamp/1000) : 1;
	OPT_timestr ? printf("%-20Y ", walltimestamp) : 1;
	OPT_jailid ? printf("%-10d ", curpsinfo->pr_jailid) : 1;

	/* print main data */
	OPT_dump ? printf("%d %d %d %d %d %s ", timestamp/1000,
	    curpsinfo->pr_jailid, uid, pid, ppid, execname) :
	    printf("%5d %6d %6d ", uid, pid, ppid);
	OPT_safe ? printf("%S\n", curpsinfo->pr_psargs) :
	    printf("%s\n", curpsinfo->pr_psargs);
 }
'
@


1.3.2.1
log
@file execsnoop was added on branch RELENG_9 on 2013-06-13 19:01:54 +0000
@
text
@d1 167
@


1.3.2.2
log
@## SVN ## Exported commit - http://svnweb.freebsd.org/changeset/base/251697
## SVN ## CVS IS DEPRECATED: http://wiki.freebsd.org/CvsIsDeprecated
@
text
@a0 167
#!/bin/sh
#
# execsnoop - snoop process execution as it occurs.
#             Written using DTrace (Solaris 10 3/05).
#
# $Id: execsnoop 3 2007-08-01 10:50:08Z brendan $
#
# USAGE:	execsnoop [-a|-A|-ehsvJ] [-c command]
#
#		execsnoop	# default output
#
#		-a		# print all data
#		-A		# dump all data, space delimited
#		-e		# safe output - parseable
#		-s		# print start time, us
#		-v		# print start time, string
#		-J		# print jail ID
#		-c command	# command name to snoop
#	eg,
#		execsnoop -v		# human readable timestamps
#		execsnoop -J		# print jail ID
#		execsnoop -c ls		# snoop ls commands only
#
# The parseable output ensures that the ARGS field doesn't contain
# any "\n"s, which normally sometimes can - and would wreck postprocessing.
#
# FIELDS:
#		UID		User ID
#		PID		Process ID
#		PPID		Parent Process ID
#		COMM		command name for the process
#		ARGS		argument listing for the process
#		JAIL ID		Jail ID	
#		TIME		timestamp for the command, us
#		STRTIME		timestamp for the command, string
#
# SEE ALSO: BSM auditing.
#
# COPYRIGHT: Copyright (c) 2005 Brendan Gregg.
#
# CDDL HEADER START
#
#  The contents of this file are subject to the terms of the
#  Common Development and Distribution License, Version 1.0 only
#  (the "License").  You may not use this file except in compliance
#  with the License.
#
#  You can obtain a copy of the license at Docs/cddl1.txt
#  or http://www.opensolaris.org/os/licensing.
#  See the License for the specific language governing permissions
#  and limitations under the License.
#
# CDDL HEADER END
#
# Author: Brendan Gregg  [Sydney, Australia]
#
# 27-Mar-2004	Brendan Gregg	Created this.
# 21-Jan-2005	   "	  "	Wrapped in sh to provide options.
# 08-May-2005 	   "      "	Rewritten for performance.
# 14-May-2005 	   "      "	Added zonename.
# 02-Jul-2005 	   "      "	Added projid, safe printing.
# 11-Sep-2005	   "      "	Increased switchrate.
# 11-Sep-2005	   "      "	Last update.
# 


##############################
# --- Process Arguments ---
#

### default variables
opt_dump=0; opt_cmd=0; opt_time=0; opt_timestr=0; filter=0; command=.
opt_jailid=0; opt_safe=0

### process options
while getopts aAc:ehsvJ name
do
	case $name in
	a)	opt_time=1; opt_timestr=1; opt_jailid=1 ;;
	A)	opt_dump=1 ;;
	c)	opt_cmd=1; command=$OPTARG ;;
	e)	opt_safe=1 ;;
	s)	opt_time=1 ;;
	v)	opt_timestr=1 ;;
	J)	opt_jailid=1 ;;
	h|?)	cat <<-END >&2
		USAGE: execsnoop [-a|-A|-ehjsvJ] [-c command]
		       execsnoop                # default output
		                -a              # print all data
		                -A              # dump all data, space delimited
		                -e              # safe output, parseable
		                -s              # print start time, us
		                -v              # print start time, string
		                -J              # print jail ID 
		                -c command      # command name to snoop
		  eg,
		        execsnoop -v            # human readable timestamps
		        execsnoop -J		# print jail ID 
		        execsnoop -c ls         # snoop ls commands only
		END
		exit 1
	esac
done

### option logic
if [ $opt_dump -eq 1 ]; then
	opt_time=0; opt_timestr=0; opt_jailid=0
fi
if [ $opt_cmd -eq 1 ]; then
	filter=1
fi


#################################
# --- Main Program, DTrace ---
#
/usr/sbin/dtrace -n '
 /*
  * Command line arguments
  */
 inline int OPT_dump 	= '$opt_dump';
 inline int OPT_cmd 	= '$opt_cmd';
 inline int OPT_time 	= '$opt_time';
 inline int OPT_timestr	= '$opt_timestr';
 inline int OPT_jailid  = '$opt_jailid';
 inline int OPT_safe 	= '$opt_safe';
 inline int FILTER 	= '$filter';
 inline string COMMAND 	= "'$command'";
 
 #pragma D option quiet
 #pragma D option switchrate=10hz
 
 /*
  * Print header
  */
 dtrace:::BEGIN 
 {
	/* print optional headers */
 	OPT_time    ? printf("%-14s ", "TIME") : 1;
 	OPT_timestr ? printf("%-20s ", "STRTIME") : 1;
 	OPT_jailid    ? printf("%-10s ", "JAIL ID") : 1;

	/* print main headers */
	OPT_dump    ? printf("%s %s %s %s %s %s %s\n",
	    "TIME", "JAIL ID", "UID", "PID", "PPID", "COMM", "ARGS") :
	    printf("%5s %6s %6s %s\n", "UID", "PID", "PPID", "ARGS");
 }

 /*
  * Print exec event
  */
 syscall::execve:return
 /(FILTER == 0) || (OPT_cmd == 1 && COMMAND == execname)/ 
 {
	/* print optional fields */
 	OPT_time ? printf("%-14d ", timestamp/1000) : 1;
	OPT_timestr ? printf("%-20Y ", walltimestamp) : 1;
	OPT_jailid ? printf("%-10d ", curpsinfo->pr_jailid) : 1;

	/* print main data */
	OPT_dump ? printf("%d %d %d %d %d %s ", timestamp/1000,
	    curpsinfo->pr_jailid, uid, pid, ppid, execname) :
	    printf("%5d %6d %6d ", uid, pid, ppid);
	OPT_safe ? printf("%S\n", curpsinfo->pr_psargs) :
	    printf("%s\n", curpsinfo->pr_psargs);
 }
'
@


1.2
log
@SVN rev 235455 on 2012-05-14 21:59:47Z by gnn

Fix execsnoop by changing exece and exec to be FreeBSD's execve.

Reference sh in the correct location (/bin/sh)
@
text
@d8 1
a8 1
# USAGE:	execsnoop [-a|-A|-ehjsvZ] [-c command]
a14 1
#		-j		# print project ID
d17 1
a17 1
#		-Z		# print zonename
d21 1
a21 1
#		execsnoop -Z		# print zonename
d33 1
a33 2
#		ZONE		zonename
#		PROJ		project ID
d73 1
a73 1
opt_zone=0; opt_safe=0; opt_proj=0
d76 1
a76 1
while getopts aAc:ehjsvZ name
d79 1
a79 1
	a)	opt_time=1; opt_timestr=1; opt_zone=1; opt_proj=1 ;;
a82 1
	j)	opt_proj=1 ;;
d85 1
a85 1
	Z)	opt_zone=1 ;;
d87 1
a87 1
		USAGE: execsnoop [-a|-A|-ehjsvZ] [-c command]
a91 1
		                -j              # print project ID
d94 1
a94 1
		                -Z              # print zonename
d98 1
a98 1
		        execsnoop -Z		# print zonename
d107 1
a107 1
	opt_time=0; opt_timestr=0; opt_zone=0; opt_proj=0
d125 1
a125 1
 inline int OPT_zone 	= '$opt_zone';
a126 1
 inline int OPT_proj 	= '$opt_proj';
d141 1
a141 2
 	OPT_zone    ? printf("%-10s ", "ZONE") : 1;
 	OPT_proj    ? printf("%5s ", "PROJ") : 1;
d144 2
a145 2
	OPT_dump    ? printf("%s %s %s %s %s %s %s %s\n",
	    "TIME", "ZONE", "PROJ", "UID", "PID", "PPID", "COMM", "ARGS") :
d158 1
a158 2
 	OPT_zone ? printf("%-10s ", zonename) : 1;
 	OPT_proj ? printf("%5d ", curpsinfo->pr_projid) : 1;
d161 2
a162 2
	OPT_dump ? printf("%d %s %d %d %d %d %s ", timestamp/1000,
	    zonename, curpsinfo->pr_projid, uid, pid, ppid, execname) :
@


1.1
log
@SVN rev 235380 on 2012-05-12 21:25:48Z by gnn

Import dtracetoolkit into cddl/contrib
@
text
@d1 1
a1 1
#!/usr/bin/sh
d158 1
a158 1
 syscall::exec:return, syscall::exece:return
@

