/*

* lsfd(1) - list file descriptors

*

* Copyright (C) 2021 Red Hat, Inc. All rights reserved.

* Written by Masatake YAMATO <yamato@redhat.com>

* Karel Zak <kzak@redhat.com>

*

* Very generally based on lsof(8) by Victor A. Abell <abe@purdue.edu>

* It supports multiple OSes. lsfd specializes to Linux.

*

* This program is free software; you can redistribute it and/or modify

* it under the terms of the GNU General Public License as published by

* the Free Software Foundation; either version 2 of the License, or

* (at your option) any later version.

*

* This program is distributed in the hope that it would be useful,

* but WITHOUT ANY WARRANTY; without even the implied warranty of

* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the

* GNU General Public License for more details.

*

* You should have received a copy of the GNU General Public License

* along with this program; if not, write to the Free Software Foundation,

* Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA

*/

#include <stdio.h>

#include <sys/types.h>

#include <inttypes.h>

#include <sys/stat.h>

#include <unistd.h>

#include <getopt.h>

#include <ctype.h>

#include <search.h>

#include <linux/sched.h>

#include <sys/syscall.h>

#include <linux/kcmp.h>

static int kcmp(pid_t pid1, pid_t pid2, int type,

unsigned long idx1, unsigned long idx2)

{

return syscall(SYS_kcmp, pid1, pid2, type, idx1, idx2);

}

/* See proc(5).

* Defined in linux/include/linux/sched.h private header file. */

#define PF_KTHREAD 0x00200000 /* I am a kernel thread */

#include "c.h"

#include "list.h"

#include "closestream.h"

#include "strutils.h"

#include "procfs.h"

#include "fileutils.h"

#include "idcache.h"

#include "pathnames.h"

#include "lsfd.h"

#include "lsfd-filter.h"

#include "lsfd-counter.h"

/*

* /proc/$pid/mountinfo entries

*/

struct nodev {

struct list_head nodevs;

unsigned long minor;

char *filesystem;

};

struct nodev_table {

#define NODEV_TABLE_SIZE 97

struct list_head tables[NODEV_TABLE_SIZE];

};

static struct nodev_table nodev_table;

struct name_manager {

struct idcache *cache;

unsigned long next_id;

};

/*

* /proc/devices entries

*/

struct devdrv {

struct list_head devdrvs;

unsigned long major;

char *name;

};

static struct list_head chrdrvs;

static struct list_head blkdrvs;

/*

* IPC table

*/

#define IPC_TABLE_SIZE 997

struct ipc_table {

struct list_head tables[IPC_TABLE_SIZE];

};

static struct ipc_table ipc_table;

/*

* Column related stuffs

*/

/* column names */

struct colinfo {

const char *name;

double whint;

int flags;

int json_type;

const char *help;

};

/* columns descriptions */

static const struct colinfo infos[] = {

[COL_AINODECLASS] = { "AINODECLASS",

0, SCOLS_FL_RIGHT, SCOLS_JSON_STRING,

N_("class of anonymous inode") },

[COL_ASSOC] = { "ASSOC",

0, SCOLS_FL_RIGHT, SCOLS_JSON_STRING,

N_("association between file and process") },

[COL_BLKDRV] = { "BLKDRV",

0, SCOLS_FL_RIGHT, SCOLS_JSON_STRING,

N_("block device driver name resolved by /proc/devices") },

[COL_BPF_PROG_ID] = { "BPF-PROG.ID",

0, SCOLS_FL_RIGHT, SCOLS_JSON_NUMBER,

N_("bpf program id associated with the fd") },

[COL_BPF_PROG_TYPE] = { "BPF-PROG.TYPE",

0, SCOLS_FL_RIGHT, SCOLS_JSON_STRING,

N_("bpf program type (decoded)") },

[COL_BPF_PROG_TYPE_RAW]= { "BPF-PROG.TYPE.RAW",

0, SCOLS_FL_RIGHT, SCOLS_JSON_NUMBER,

N_("bpf program type (raw)") },

[COL_CHRDRV] = { "CHRDRV",

0, SCOLS_FL_RIGHT, SCOLS_JSON_STRING,

N_("character device driver name resolved by /proc/devices") },

[COL_COMMAND] = { "COMMAND",

0.3, SCOLS_FL_TRUNC, SCOLS_JSON_STRING,

N_("command of the process opening the file") },

[COL_DELETED] = { "DELETED",

0, SCOLS_FL_RIGHT, SCOLS_JSON_BOOLEAN,

N_("reachability from the file system") },

[COL_DEV] = { "DEV",

0, SCOLS_FL_RIGHT, SCOLS_JSON_STRING,

N_("ID of device containing file") },

[COL_DEVTYPE] = { "DEVTYPE",

0, SCOLS_FL_RIGHT, SCOLS_JSON_STRING,

N_("device type (blk, char, or nodev)") },

[COL_ENDPOINTS] = { "ENDPOINTS",

0, SCOLS_FL_WRAP, SCOLS_JSON_ARRAY_STRING,

N_("IPC endpoints information communicated with the fd") },

[COL_EVENTFD_ID] = {"EVENTFD.ID",

0, SCOLS_FL_RIGHT, SCOLS_JSON_NUMBER,

N_("eventfd ID") },

[COL_EVENTPOLL_TFDS] = {"EVENTPOLL.TFDS",

0, SCOLS_FL_WRAP, SCOLS_JSON_ARRAY_NUMBER,

N_("file descriptors targeted by the eventpoll file") },

[COL_FD] = { "FD",

0, SCOLS_FL_RIGHT, SCOLS_JSON_NUMBER,

N_("file descriptor for the file") },

[COL_FLAGS] = { "FLAGS",

0, SCOLS_FL_RIGHT, SCOLS_JSON_STRING,

N_("flags specified when opening the file") },

[COL_FUID] = { "FUID",

0, SCOLS_FL_RIGHT, SCOLS_JSON_NUMBER,

N_("user ID number of the file's owner") },

[COL_INET_LADDR] = { "INET.LADDR",

0, SCOLS_FL_RIGHT, SCOLS_JSON_STRING,

N_("local IP address") },

[COL_INET_RADDR] = { "INET.RADDR",

0, SCOLS_FL_RIGHT, SCOLS_JSON_STRING,

N_("remote IP address") },

[COL_INET6_LADDR] = { "INET6.LADDR",

0, SCOLS_FL_RIGHT, SCOLS_JSON_STRING,

N_("local IPv6 address") },

[COL_INET6_RADDR] = { "INET6.RADDR",

0, SCOLS_FL_RIGHT, SCOLS_JSON_STRING,

N_("remote IPv6 address") },

[COL_INODE] = { "INODE",

0, SCOLS_FL_RIGHT, SCOLS_JSON_NUMBER,

N_("inode number") },

[COL_INOTIFY_INODES] = { "INOTIFY.INODES",

0, SCOLS_FL_WRAP, SCOLS_JSON_ARRAY_STRING,

N_("list of monitoring inodes (cooked)") },

[COL_INOTIFY_INODES_RAW]={ "INOTIFY.INODES.RAW",

0, SCOLS_FL_WRAP, SCOLS_JSON_ARRAY_STRING,

N_("list of monitoring inodes (raw, don't decode devices)") },

[COL_KNAME] = { "KNAME",

0.4, SCOLS_FL_TRUNC, SCOLS_JSON_STRING,

N_("name of the file (raw)") },

[COL_KTHREAD] = { "KTHREAD",

0, SCOLS_FL_RIGHT, SCOLS_JSON_BOOLEAN,

N_("opened by a kernel thread") },

[COL_MAJMIN] = { "MAJ:MIN",

0, SCOLS_FL_RIGHT, SCOLS_JSON_STRING,

N_("device ID for special, or ID of device containing file") },

[COL_MAPLEN] = { "MAPLEN",

0, SCOLS_FL_RIGHT, SCOLS_JSON_NUMBER,

N_("length of file mapping (in page)") },

[COL_MISCDEV] = { "MISCDEV",

0, SCOLS_FL_RIGHT, SCOLS_JSON_STRING,

N_("misc character device name resolved by /proc/misc") },

[COL_MNT_ID] = { "MNTID",

0, SCOLS_FL_RIGHT, SCOLS_JSON_NUMBER,

N_("mount id") },

[COL_MODE] = { "MODE",

0, SCOLS_FL_RIGHT, SCOLS_JSON_STRING,

N_("access mode (rwx)") },

[COL_NAME] = { "NAME",

0.4, SCOLS_FL_TRUNC, SCOLS_JSON_STRING,

N_("name of the file (cooked)") },

[COL_NETLINK_GROUPS] = { "NETLINK.GROUPS",

0, SCOLS_FL_RIGHT, SCOLS_JSON_NUMBER,

N_("netlink multicast groups") },

[COL_NETLINK_LPORT] = { "NETLINK.LPORT",

0, SCOLS_FL_RIGHT, SCOLS_JSON_NUMBER,

N_("netlink local port id") },

[COL_NETLINK_PROTOCOL] = { "NETLINK.PROTOCOL",

0, SCOLS_FL_RIGHT, SCOLS_JSON_STRING,

N_("netlink protocol") },

[COL_NLINK] = { "NLINK",

0, SCOLS_FL_RIGHT, SCOLS_JSON_NUMBER,

N_("link count") },

[COL_NS_NAME] = { "NS.NAME",

0, SCOLS_FL_RIGHT, SCOLS_JSON_STRING,

N_("name of the namespace (NS.TYPE:[INODE])") },

[COL_NS_TYPE] = { "NS.TYPE",

0, SCOLS_FL_RIGHT, SCOLS_JSON_STRING,

N_("type of the namespace") },

[COL_OWNER] = { "OWNER",

0, SCOLS_FL_RIGHT, SCOLS_JSON_STRING,

N_("owner of the file") },

[COL_PACKET_IFACE] = { "PACKET.IFACE",

0, SCOLS_FL_RIGHT,SCOLS_JSON_STRING,

N_("net interface associated with the packet socket") },

[COL_PACKET_PROTOCOL] = { "PACKET.PROTOCOL",

0, SCOLS_FL_RIGHT,SCOLS_JSON_STRING,

N_("L3 protocol associated with the packet socket") },

[COL_PARTITION] = { "PARTITION",

0, SCOLS_FL_RIGHT, SCOLS_JSON_STRING,

N_("block device name resolved by /proc/partition") },

[COL_PID] = { "PID",

5, SCOLS_FL_RIGHT, SCOLS_JSON_NUMBER,

N_("PID of the process opening the file") },

[COL_PIDFD_COMM] = { "PIDFD.COMM",

0.2, SCOLS_FL_TRUNC, SCOLS_JSON_STRING,

N_("command of the process targeted by the pidfd") },

[COL_PIDFD_NSPID] = { "PIDFD.NSPID",

0.2, SCOLS_FL_TRUNC, SCOLS_JSON_STRING,

N_("NSpid field in fdinfo of the pidfd") },

[COL_PIDFD_PID] = { "PIDFD.PID",

5, SCOLS_FL_RIGHT, SCOLS_JSON_NUMBER,

N_("PID of the process targeted by the pidfd") },

[COL_PING_ID] = { "PING.ID",

0, SCOLS_FL_RIGHT, SCOLS_JSON_NUMBER,

N_("ICMP echo request ID") },

[COL_POS] = { "POS",

5, SCOLS_FL_RIGHT, SCOLS_JSON_NUMBER,

N_("file position") },

[COL_RAW_PROTOCOL] = { "RAW.PROTOCOL",

0, SCOLS_FL_RIGHT, SCOLS_JSON_NUMBER,

N_("protocol number of the raw socket") },

[COL_RDEV] = { "RDEV",

0, SCOLS_FL_RIGHT, SCOLS_JSON_STRING,

N_("device ID (if special file)") },

[COL_SIGNALFD_MASK] = { "SIGNALFD.MASK",

0, SCOLS_FL_RIGHT, SCOLS_JSON_STRING,

N_("masked signals") },

[COL_SIZE] = { "SIZE",

4, SCOLS_FL_RIGHT, SCOLS_JSON_NUMBER,

N_("file size"), },

[COL_SOCK_LISTENING] = { "SOCK.LISTENING",

0, SCOLS_FL_RIGHT, SCOLS_JSON_BOOLEAN,

N_("listening socket") },

[COL_SOCK_NETNS] = { "SOCK.NETNS",

0, SCOLS_FL_RIGHT, SCOLS_JSON_NUMBER,

N_("inode identifying network namespace where the socket belongs to") },

[COL_SOCK_PROTONAME] = { "SOCK.PROTONAME",

0, SCOLS_FL_RIGHT, SCOLS_JSON_STRING,

N_("protocol name") },

[COL_SOCK_STATE] = { "SOCK.STATE",

0, SCOLS_FL_RIGHT, SCOLS_JSON_STRING,

N_("State of socket") },

[COL_SOCK_TYPE] = { "SOCK.TYPE",

0, SCOLS_FL_RIGHT, SCOLS_JSON_STRING,

N_("Type of socket") },

[COL_SOURCE] = { "SOURCE",

0, SCOLS_FL_RIGHT, SCOLS_JSON_STRING,

N_("file system, partition, or device containing file") },

[COL_STTYPE] = { "STTYPE",

0, SCOLS_FL_RIGHT, SCOLS_JSON_STRING,

N_("file type (raw)") },

[COL_TCP_LADDR] = { "TCP.LADDR",

0, SCOLS_FL_RIGHT, SCOLS_JSON_STRING,

N_("local TCP address (INET address:TCP port)") },

[COL_TCP_RADDR] = { "TCP.RADDR",

0, SCOLS_FL_RIGHT, SCOLS_JSON_STRING,

N_("remote TCP address (INET address:TCP port)") },

[COL_TCP_LPORT] = { "TCP.LPORT",

0, SCOLS_FL_RIGHT, SCOLS_JSON_NUMBER,

N_("local TCP port") },

[COL_TCP_RPORT] = { "TCP.RPORT",

0, SCOLS_FL_RIGHT, SCOLS_JSON_NUMBER,

N_("remote TCP port") },

[COL_TID] = { "TID",

5, SCOLS_FL_RIGHT, SCOLS_JSON_NUMBER,

N_("thread ID of the process opening the file") },

[COL_TIMERFD_CLOCKID] = { "TIMERFD.CLOCKID",

0, SCOLS_FL_RIGHT, SCOLS_JSON_STRING,

N_("clockid") },

[COL_TIMERFD_INTERVAL] = { "TIMERFD.INTERVAL",

0, SCOLS_FL_RIGHT, SCOLS_JSON_NUMBER,

N_("interval") },

[COL_TIMERFD_REMAINING]= { "TIMERFD.REMAINING",

0, SCOLS_FL_RIGHT, SCOLS_JSON_NUMBER,

N_("remaining time") },

[COL_TUN_IFACE] = { "TUN.IFACE",

0, SCOLS_FL_RIGHT, SCOLS_JSON_STRING,

N_("network interface behind the tun device") },

[COL_TYPE] = { "TYPE",

0, SCOLS_FL_RIGHT, SCOLS_JSON_STRING,

N_("file type (cooked)") },

[COL_UDP_LADDR] = { "UDP.LADDR",

0, SCOLS_FL_RIGHT, SCOLS_JSON_STRING,

N_("local UDP address (INET address:UDP port)") },

[COL_UDP_RADDR] = { "UDP.RADDR",

0, SCOLS_FL_RIGHT, SCOLS_JSON_STRING,

N_("remote UDP address (INET address:UDP port)") },

[COL_UDP_LPORT] = { "UDP.LPORT",

0, SCOLS_FL_RIGHT, SCOLS_JSON_NUMBER,

N_("local UDP port") },

[COL_UDP_RPORT] = { "UDP.RPORT",

0, SCOLS_FL_RIGHT, SCOLS_JSON_NUMBER,

N_("remote UDP port") },

[COL_UDPLITE_LADDR] = { "UDPLITE.LADDR",

0, SCOLS_FL_RIGHT, SCOLS_JSON_STRING,

N_("local UDPLite address (INET address:UDPLite port)") },

[COL_UDPLITE_RADDR] = { "UDPLITE.RADDR",

0, SCOLS_FL_RIGHT, SCOLS_JSON_STRING,

N_("remote UDPLite address (INET address:UDPLite port)") },

[COL_UDPLITE_LPORT] = { "UDPLITE.LPORT",

0, SCOLS_FL_RIGHT, SCOLS_JSON_NUMBER,

N_("local UDPLite port") },

[COL_UDPLITE_RPORT] = { "UDPLITE.RPORT",

0, SCOLS_FL_RIGHT, SCOLS_JSON_NUMBER,

N_("remote UDPLite port") },

[COL_UID] = { "UID",

0, SCOLS_FL_RIGHT, SCOLS_JSON_NUMBER,

N_("user ID number of the process") },

[COL_UNIX_PATH] = { "UNIX.PATH",

0.4, SCOLS_FL_TRUNC, SCOLS_JSON_STRING,

N_("filesystem pathname for UNIX domain socket") },

[COL_USER] = { "USER",

0, SCOLS_FL_RIGHT, SCOLS_JSON_STRING,

N_("user of the process") },

[COL_XMODE] = { "XMODE",

0, SCOLS_FL_RIGHT, SCOLS_JSON_STRING,

N_("extended version of MDOE (rwxD[Ll]m)") },

};

static const int default_columns[] = {

COL_COMMAND,

COL_PID,

COL_USER,

COL_ASSOC,

COL_XMODE,

COL_TYPE,

COL_SOURCE,

COL_MNT_ID,

COL_INODE,

COL_NAME,

};

static const int default_threads_columns[] = {

COL_COMMAND,

COL_PID,

COL_TID,

COL_USER,

COL_ASSOC,

COL_XMODE,

COL_TYPE,

COL_SOURCE,

COL_MNT_ID,

COL_INODE,

COL_NAME,

};

static int columns[ARRAY_SIZE(infos) * 2] = {-1};

static size_t ncolumns;

static ino_t *mnt_namespaces;

static size_t nspaces;

struct counter_spec {

struct list_head specs;

const char *name;

const char *expr;

};

static const struct counter_spec default_counter_specs[] = {

{

.name = N_("processes"),

.expr = "ASSOC == 'cwd'",

},

{

.name = N_("root owned processes"),

.expr = "(ASSOC == 'cwd') && (UID == 0)",

},

{

.name = N_("kernel threads"),

.expr = "(ASSOC == 'cwd') && KTHREAD",

},

{

.name = N_("open files"),

.expr = "FD >= 0",

},

{

.name = N_("RO open files"),

.expr = "(FD >= 0) and (MODE == 'r--')",

},

{

.name = N_("WO open files"),

.expr = "(FD >= 0) and (MODE == '-w-')",

},

{

.name = N_("shared mappings"),

.expr = "ASSOC == 'shm'",

},

{

.name = N_("RO shared mappings"),

.expr = "(ASSOC == 'shm') and (MODE == 'r--')",

},

{

.name = N_("WO shared mappings"),

.expr = "(ASSOC == 'shm') and (MODE == '-w-')",

},

{

.name = N_("regular files"),

.expr = "(FD >= 0) && (STTYPE == 'REG')",

},

{

.name = N_("directories"),

.expr = "(FD >= 0) && (STTYPE == 'DIR')",

},

{

.name = N_("sockets"),

.expr = "(FD >= 0) && (STTYPE == 'SOCK')",

},

{

.name = N_("fifos/pipes"),

.expr = "(FD >= 0) && (STTYPE == 'FIFO')",

},

{

.name = N_("character devices"),

.expr = "(FD >= 0) && (STTYPE == 'CHR')",

},

{

.name = N_("block devices"),

.expr = "(FD >= 0) && (STTYPE == 'BLK')",

},

{

.name = N_("unknown types"),

.expr = "(FD >= 0) && (STTYPE == 'UNKN')",

}

};

struct lsfd_control {

struct libscols_table *tb; /* output */

struct list_head procs; /* list of all processes */

unsigned int noheadings : 1,

raw : 1,

json : 1,

notrunc : 1,

threads : 1,

show_main : 1, /* print main table */

show_summary : 1, /* print summary/counters */

sockets_only : 1; /* display only SOCKETS */

struct lsfd_filter *filter;

struct lsfd_counter **counters; /* NULL terminated array. */

};

static void *proc_tree; /* for tsearch/tfind */

static int proc_tree_compare(const void *a, const void *b)

{

return ((struct proc *)a)->pid - ((struct proc *)b)->pid;

}

struct proc *get_proc(pid_t pid)

{

struct proc **node = tfind(&pid, &proc_tree, proc_tree_compare);

if (node)

return *node;

return NULL;

}

static int column_name_to_id(const char *name, size_t namesz)

{

size_t i;

for (i = 0; i < ARRAY_SIZE(infos); i++) {

const char *cn = infos[i].name;

if (!strncasecmp(name, cn, namesz) && !*(cn + namesz))

return i;

}

warnx(_("unknown column: %s"), name);

return LSFD_FILTER_UNKNOWN_COL_ID;

}

static int column_name_to_id_cb(const char *name, void *data __attribute__((__unused__)))

{

return column_name_to_id(name, strlen(name));

}

static int get_column_id(int num)

{

assert(num >= 0);

assert((size_t) num < ncolumns);

assert(columns[num] < (int) ARRAY_SIZE(infos));

return columns[num];

}

static const struct colinfo *get_column_info(int num)

{

return &infos[ get_column_id(num) ];

}

static struct libscols_column *add_column(struct libscols_table *tb, const struct colinfo *col)

{

struct libscols_column *cl;

int flags = col->flags;

cl = scols_table_new_column(tb, col->name, col->whint, flags);

if (cl) {

scols_column_set_json_type(cl, col->json_type);

if (col->flags & SCOLS_FL_WRAP) {

scols_column_set_wrapfunc(cl,

scols_wrapnl_chunksize,

scols_wrapnl_nextchunk,

NULL);

scols_column_set_safechars(cl, "\n");

}

}

return cl;

}

static struct libscols_column *add_column_by_id_cb(struct libscols_table *tb, int colid, void *data)

{

struct libscols_column *cl;

if (ncolumns >= ARRAY_SIZE(columns))

errx(EXIT_FAILURE, _("too many columns are added via filter expression"));

assert(colid < LSFD_N_COLS);

cl = add_column(tb, infos + colid);

if (!cl)

err(EXIT_FAILURE, _("failed to allocate output column"));

columns[ncolumns++] = colid;

if (colid == COL_TID) {

struct lsfd_control *ctl = data;

ctl->threads = 1;

}

return cl;

}

static int has_mnt_ns(ino_t id)

{

size_t i;

for (i = 0; i < nspaces; i++) {

if (mnt_namespaces[i] == id)

return 1;

}

return 0;

}

static void add_mnt_ns(ino_t id)

{

size_t nmax = 0;

if (nspaces)

nmax = (nspaces + 16) / 16 * 16;

if (nmax <= nspaces + 1) {

nmax += 16;

mnt_namespaces = xrealloc(mnt_namespaces,

sizeof(ino_t) * nmax);

}

mnt_namespaces[nspaces++] = id;

}

static const struct file_class *stat2class(struct stat *sb)

{

dev_t dev;

assert(sb);

switch (sb->st_mode & S_IFMT) {

case S_IFCHR:

return &cdev_class;

case S_IFBLK:

return &bdev_class;

case S_IFSOCK:

return &sock_class;

case S_IFIFO:

return &fifo_class;

case S_IFLNK:

case S_IFDIR:

return &file_class;

case S_IFREG:

dev = sb->st_dev;

if (major(dev) != 0)

return &file_class;

if (is_nsfs_dev(dev))

return &nsfs_file_class;

if (is_mqueue_dev(dev))

return &mqueue_file_class;

return &file_class;

default:

break;

}

return &unkn_class;

}

static struct file *new_file(struct proc *proc, const struct file_class *class)

{

struct file *file;

assert(class);

file = xcalloc(1, class->size);

file->class = class;

file->proc = proc;

INIT_LIST_HEAD(&file->files);

list_add_tail(&file->files, &proc->files);

return file;

}

static struct file *copy_file(struct file *old)

{

struct file *file = xcalloc(1, old->class->size);

INIT_LIST_HEAD(&file->files);

file->proc = old->proc;

list_add_tail(&file->files, &old->proc->files);

file->class = old->class;

file->association = old->association;

file->name = xstrdup(old->name);

file->stat = old->stat;

return file;

}

static void file_set_path(struct file *file, struct stat *sb, const char *name, int association)

{

file->association = association;

file->name = xstrdup(name);

file->stat = *sb;

}

static void file_init_content(struct file *file)

{

if (file->class && file->class->initialize_content)

file->class->initialize_content(file);

}

static void free_file(struct file *file)

{

const struct file_class *class = file->class;

while (class) {

if (class->free_content)

class->free_content(file);

class = class->super;

}

free(file);

}

static struct proc *new_process(pid_t pid, struct proc *leader)

{

struct proc *proc = xcalloc(1, sizeof(*proc));

proc->pid = pid;

proc->leader = leader? leader: proc;

proc->command = NULL;

INIT_LIST_HEAD(&proc->files);

INIT_LIST_HEAD(&proc->procs);

INIT_LIST_HEAD(&proc->eventpolls);

proc->kthread = 0;

return proc;

}

static void free_proc(struct proc *proc)

{

list_free(&proc->files, struct file, files, free_file);

free(proc->command);

free(proc);

}

static void read_fdinfo(struct file *file, FILE *fdinfo)

{

char buf[1024];

while (fgets(buf, sizeof(buf), fdinfo)) {

const struct file_class *class;

char *val = strchr(buf, ':');

if (!val)

continue;

*val++ = '\0'; /* terminate key */

val = (char *) skip_space(val);

rtrim_whitespace((unsigned char *) val);

class = file->class;

while (class) {

if (class->handle_fdinfo

&& class->handle_fdinfo(file, buf, val))

break;

class = class->super;

}

}

}

static struct file *collect_file_symlink(struct path_cxt *pc,

struct proc *proc,

const char *name,

int assoc,

bool sockets_only)

{

char sym[PATH_MAX] = { '\0' };

struct stat sb;

struct file *f, *prev;

if (ul_path_readlink(pc, sym, sizeof(sym), name) < 0)

return NULL;

/* The /proc/#/{fd,ns} often contains the same file (e.g. /dev/tty)

* more than once. Let's try to reuse the previous file if the real

* path is the same to save stat() call.

*/

prev = list_last_entry(&proc->files, struct file, files);

if (prev && prev->name && strcmp(prev->name, sym) == 0) {

f = copy_file(prev);

f->association = assoc;

} else {

const struct file_class *class;

if (ul_path_stat(pc, &sb, 0, name) < 0)

return NULL;

class = stat2class(&sb);

if (sockets_only

/* A nsfs file is not a socket but the nsfs file can

* be used as a entry point to collect information from

* other network namespaces. Besed on the information,

* various columns of sockets can be filled.

*/

&& (class != &sock_class) && (class != &nsfs_file_class))

return NULL;

f = new_file(proc, class);

file_set_path(f, &sb, sym, assoc);

}

file_init_content(f);

if (is_association(f, NS_MNT))

proc->ns_mnt = f->stat.st_ino;

else if (is_association(f, NS_NET))

load_sock_xinfo(pc, name, f->stat.st_ino);

else if (assoc >= 0) {

/* file-descriptor based association */

FILE *fdinfo;

if (ul_path_stat(pc, &sb, AT_SYMLINK_NOFOLLOW, name) == 0)

f->mode = sb.st_mode;

if (is_nsfs_dev(f->stat.st_dev))

load_sock_xinfo(pc, name, f->stat.st_ino);

fdinfo = ul_path_fopenf(pc, "r", "fdinfo/%d", assoc);

if (fdinfo) {

read_fdinfo(f, fdinfo);

fclose(fdinfo);

}

}

return f;

}

/* read symlinks from /proc/#/fd

*/

static void collect_fd_files(struct path_cxt *pc, struct proc *proc,

bool sockets_only)

{

DIR *sub = NULL;

struct dirent *d = NULL;

char path[sizeof("fd/") + sizeof(stringify_value(UINT64_MAX))];

while (ul_path_next_dirent(pc, &sub, "fd", &d) == 0) {

uint64_t num;

if (ul_strtou64(d->d_name, &num, 10) != 0) /* only numbers */

continue;

snprintf(path, sizeof(path), "fd/%ju", (uintmax_t) num);

collect_file_symlink(pc, proc, path, num, sockets_only);

}

}

static void parse_maps_line(struct path_cxt *pc, char *buf, struct proc *proc)

{

uint64_t start, end, offset, ino;

unsigned long major, minor;

enum association assoc = ASSOC_MEM;

struct stat sb;

struct file *f, *prev;

char *path, modestr[5];

dev_t devno;

/* read rest of the map */

if (sscanf(buf, "%"SCNx64 /* start */

"-%"SCNx64 /* end */

" %4[^ ]" /* mode */

" %"SCNx64 /* offset */

" %lx:%lx" /* maj:min */

" %"SCNu64, /* inode */

&start, &end, modestr, &offset,

&major, &minor, &ino) != 7)

return;

/* Skip private anonymous mappings. */

if (major == 0 && minor == 0 && ino == 0)

return;

devno = makedev(major, minor);

if (modestr[3] == 's')

assoc = ASSOC_SHM;

/* The map usually contains the same file more than once, try to reuse

* the previous file (if devno and ino are the same) to save stat() call.

*/

prev = list_last_entry(&proc->files, struct file, files);

if (prev && prev->stat.st_dev == devno && prev->stat.st_ino == ino) {

f = copy_file(prev);

f->association = -assoc;

} else if ((path = strchr(buf, '/'))) {

rtrim_whitespace((unsigned char *) path);

if (stat(path, &sb) < 0)

/* If a file is mapped but deleted from the file system,

* "stat by the file name" may not work. In that case,

*/

goto try_map_files;

f = new_file(proc, stat2class(&sb));

file_set_path(f, &sb, path, -assoc);

} else {

/* As used in tcpdump, AF_PACKET socket can be mmap'ed. */

char map_file[sizeof("map_files/0000000000000000-ffffffffffffffff")];

char sym[PATH_MAX] = { '\0' };

try_map_files:

snprintf(map_file, sizeof(map_file), "map_files/%"PRIx64"-%"PRIx64, start, end);

if (ul_path_stat(pc, &sb, 0, map_file) < 0)

return;

if (ul_path_readlink(pc, sym, sizeof(sym), map_file) < 0)

return;

f = new_file(proc, stat2class(&sb));

file_set_path(f, &sb, sym, -assoc);

}

if (modestr[0] == 'r')

f->mode |= S_IRUSR;

if (modestr[1] == 'w')

f->mode |= S_IWUSR;

if (modestr[2] == 'x')

f->mode |= S_IXUSR;

f->map_start = start;

f->map_end = end;

f->pos = offset;

file_init_content(f);

}

static void collect_mem_files(struct path_cxt *pc, struct proc *proc)

{

FILE *fp;

char buf[BUFSIZ];

fp = ul_path_fopen(pc, "r", "maps");

if (!fp)

return;

while (fgets(buf, sizeof(buf), fp))

parse_maps_line(pc, buf, proc);

fclose(fp);

}

static void collect_outofbox_files(struct path_cxt *pc,

struct proc *proc,

enum association assocs[],

const char *names[],

size_t count,

bool sockets_only)

{

size_t i;

for (i = 0; i < count; i++)

collect_file_symlink(pc, proc, names[assocs[i]], assocs[i] * -1,

sockets_only);

}

static void collect_execve_file(struct path_cxt *pc, struct proc *proc,

bool sockets_only)

{

enum association assocs[] = { ASSOC_EXE };

const char *names[] = {

[ASSOC_EXE] = "exe",

};

collect_outofbox_files(pc, proc, assocs, names, ARRAY_SIZE(assocs),

sockets_only);

}

static void collect_fs_files(struct path_cxt *pc, struct proc *proc,

bool sockets_only)

{

enum association assocs[] = { ASSOC_EXE, ASSOC_CWD, ASSOC_ROOT };

const char *names[] = {

[ASSOC_CWD] = "cwd",

[ASSOC_ROOT] = "root",

};

collect_outofbox_files(pc, proc, assocs, names, ARRAY_SIZE(assocs),

sockets_only);

}

static void collect_namespace_files(struct path_cxt *pc, struct proc *proc)

{

enum association assocs[] = {

ASSOC_NS_CGROUP,

ASSOC_NS_IPC,

ASSOC_NS_MNT,

ASSOC_NS_NET,

ASSOC_NS_PID,

ASSOC_NS_PID4C,

ASSOC_NS_TIME,

ASSOC_NS_TIME4C,

ASSOC_NS_USER,

ASSOC_NS_UTS,

};

const char *names[] = {

[ASSOC_NS_CGROUP] = "ns/cgroup",

[ASSOC_NS_IPC] = "ns/ipc",

[ASSOC_NS_MNT] = "ns/mnt",

[ASSOC_NS_NET] = "ns/net",

[ASSOC_NS_PID] = "ns/pid",

[ASSOC_NS_PID4C] = "ns/pid_for_children",

[ASSOC_NS_TIME] = "ns/time",

[ASSOC_NS_TIME4C] = "ns/time_for_children",

[ASSOC_NS_USER] = "ns/user",

[ASSOC_NS_UTS] = "ns/uts",

};

collect_outofbox_files(pc, proc, assocs, names, ARRAY_SIZE(assocs),

/* Namespace information is alwasys needed. */

false);

}

static struct nodev *new_nodev(unsigned long minor, const char *filesystem)

{

struct nodev *nodev = xcalloc(1, sizeof(*nodev));

INIT_LIST_HEAD(&nodev->nodevs);

nodev->minor = minor;

nodev->filesystem = xstrdup(filesystem);