コード例 #1
0
ファイル: onaccess_ddd.c プロジェクト: Distrotech/clamav
static void onas_ddd_handle_in_moved_from(struct ddd_thrarg *tharg,
		const char *path, const char *child_path, const struct inotify_event *event, int wd) {

	struct stat s;
	if(stat(child_path, &s) == 0 && S_ISREG(s.st_mode)) return;
	if(!(event->mask & IN_ISDIR)) return;

	logg("*ddd: MOVED_FROM - Removing %s from %s with wd:%d\n", child_path, path, wd);
	onas_ddd_unwatch(child_path, tharg->fan_fd, onas_in_fd);
	onas_ht_rm_hierarchy(ddd_ht, child_path, strlen(child_path), 0);

	return;
}
コード例 #2
0
void *onas_ddd_th(void *arg) {
	struct ddd_thrarg *tharg = (struct ddd_thrarg *) arg;
	sigset_t sigset;
	struct sigaction act;
	const struct optstruct *pt;
	short int scan;
	int sizelimit = 0, extinfo;
	STATBUF sb;
	uint64_t in_mask = IN_ONLYDIR | IN_MOVE | IN_DELETE | IN_CREATE;
	fd_set rfds;
	char buf[4096];
	ssize_t bread;
	const struct inotify_event *event;
	int ret, len;

	/* ignore all signals except SIGUSR1 */
	sigfillset(&sigset);
	sigdelset(&sigset, SIGUSR1);
	/* The behavior of a process is undefined after it ignores a 
	 * SIGFPE, SIGILL, SIGSEGV, or SIGBUS signal */
	sigdelset(&sigset, SIGFPE);
	sigdelset(&sigset, SIGILL);
	sigdelset(&sigset, SIGSEGV);
#ifdef SIGBUS    
	sigdelset(&sigset, SIGBUS);
#endif
	pthread_sigmask(SIG_SETMASK, &sigset, NULL);
	memset(&act, 0, sizeof(struct sigaction));
	act.sa_handler = onas_ddd_exit;
	sigfillset(&(act.sa_mask));
	sigaction(SIGUSR1, &act, NULL);
	sigaction(SIGSEGV, &act, NULL);

	onas_in_fd = inotify_init1(IN_NONBLOCK);
	if (onas_in_fd == -1) {
		logg("!ScanOnAccess: Could not init inotify.");
		return NULL;
	}

	ret = onas_ddd_init(0, ONAS_DEFAULT_HT_SIZE);
	if (ret) {
		logg("!ScanOnAccess: Failed to initialize 3D. \n");
		return NULL;
	}

	/* Add provided paths recursively. */
	if((pt = optget(tharg->opts, "OnAccessIncludePath"))->enabled) {
		while(pt) {
			if (!strcmp(pt->strarg, "/")) {
				logg("!ScanOnAcess: Not inlcuding path '%s' while DDD is enabled\n", pt->strarg);
				logg("!ScanOnAcess: Please use the OnAccessMountPath option to watch '%s'\n", pt->strarg);
				pt = (struct optstruct *) pt->nextarg;
				continue;
			}
			if(onas_ht_get(ddd_ht, pt->strarg, strlen(pt->strarg), NULL) != CL_SUCCESS) {
				if(onas_ht_add_hierarchy(ddd_ht, pt->strarg)) {
					logg("!ScanOnAccess: Can't include path '%s'\n", pt->strarg);
					return NULL;
				} else
					logg("ScanOnAccess: Protecting directory '%s' (and all sub-directories)\n", pt->strarg);
			}

			pt = (struct optstruct *) pt->nextarg;
		}
	} else {
		logg("!ScanOnAccess: Please specify at least one path with OnAccessIncludePath\n");
		return NULL;
	}

	/* Remove provided paths recursively. */
	if((pt = optget(tharg->opts, "OnAccessExcludePath"))->enabled) {
		while(pt) {
			size_t ptlen = strlen(pt->strarg);
			if(onas_ht_get(ddd_ht, pt->strarg, ptlen, NULL) == CL_SUCCESS) {
				if(onas_ht_rm_hierarchy(ddd_ht, pt->strarg, ptlen, 0)) {
					logg("!ScanOnAccess: Can't exclude path '%s'\n", pt->strarg);
					return NULL;
				} else
					logg("ScanOnAccess: Excluding  directory '%s' (and all sub-directories)\n", pt->strarg);
			}

			pt = (struct optstruct *) pt->nextarg;
		}
	}

	/* Watch provided paths recursively */
	if((pt = optget(tharg->opts, "OnAccessIncludePath"))->enabled) {
		while(pt) {
			size_t ptlen = strlen(pt->strarg);
			if(onas_ht_get(ddd_ht, pt->strarg, ptlen, NULL) == CL_SUCCESS) {
				if(onas_ddd_watch(pt->strarg, tharg->fan_fd, tharg->fan_mask, onas_in_fd, in_mask)) {
					logg("!ScanOnAccess: Could not watch path '%s', %s\n", pt->strarg, strerror(errno));
					return NULL;
				}
			}
			pt = (struct optstruct *) pt->nextarg;
		}
	}


	FD_ZERO(&rfds);
	FD_SET(onas_in_fd, &rfds);

	while (1) {
		do {
			ret = select(onas_in_fd + 1, &rfds, NULL, NULL, NULL);
		} while(ret == -1 && errno == EINTR);

		while((bread = read(onas_in_fd, buf, sizeof(buf))) > 0) {

			/* Handle events. */
			int wd;
			char *p = buf;
			const char *path = NULL;
			const char *child = NULL;
			for(p; p < buf + bread; p += sizeof(struct inotify_event) + event->len) {

				event = (const struct inotify_event *) p;
				wd = event->wd;
				path = wdlt[wd];
				child = event->name;

				len = strlen(path);
				size_t size = strlen(child) + len + 2;
				char *child_path = (char *) cli_malloc(size);
				if (child_path == NULL)
					return CL_EMEM;
				if (path[len-1] == '/')
					snprintf(child_path, --size, "%s%s", path, child);
				else
					snprintf(child_path, size, "%s/%s", path, child);

				struct stat s;
				if(stat(child_path, &s) == 0 && S_ISREG(s.st_mode)) continue;
				if(!(event->mask & IN_ISDIR)) continue;

				if (event->mask & IN_DELETE) {
					logg("*ddd: DELETE - Removing %s from %s with wd:%d\n", child_path, path, wd);
					onas_ddd_unwatch(child_path, tharg->fan_fd, onas_in_fd);
					onas_ht_rm_hierarchy(ddd_ht, child_path, strlen(child_path), 0);

				} else if (event->mask & IN_MOVED_FROM) {
					logg("*ddd: MOVED_FROM - Removing %s from %s with wd:%d\n", child_path, path, wd);
					onas_ddd_unwatch(child_path, tharg->fan_fd, onas_in_fd);
					onas_ht_rm_hierarchy(ddd_ht, child_path, strlen(child_path), 0);

				} else if (event->mask & IN_CREATE) {
					logg("*ddd: CREATE - Adding %s to %s with wd:%d\n", child_path, path, wd);
					onas_ht_add_hierarchy(ddd_ht, child_path);
					onas_ddd_watch(child_path, tharg->fan_fd, tharg->fan_mask, onas_in_fd, in_mask);

				} else if (event->mask & IN_MOVED_TO) {
					logg("*ddd: MOVED_TO - Adding %s to %s with wd:%d\n", child_path, path, wd);
					onas_ht_add_hierarchy(ddd_ht, child_path);
					onas_ddd_watch(child_path, tharg->fan_fd, tharg->fan_mask, onas_in_fd, in_mask);
				}
			}
		}
	}

	return NULL;
}
コード例 #3
0
ファイル: onaccess_ddd.c プロジェクト: Distrotech/clamav
void *onas_ddd_th(void *arg) {
	struct ddd_thrarg *tharg = (struct ddd_thrarg *) arg;
	sigset_t sigset;
	struct sigaction act;
	const struct optstruct *pt;
	uint64_t in_mask = IN_ONLYDIR | IN_MOVE | IN_DELETE | IN_CREATE;
	fd_set rfds;
	char buf[4096];
	ssize_t bread;
	const struct inotify_event *event;
	int ret, len;

	/* ignore all signals except SIGUSR1 */
	sigfillset(&sigset);
	sigdelset(&sigset, SIGUSR1);
	/* The behavior of a process is undefined after it ignores a
	 * SIGFPE, SIGILL, SIGSEGV, or SIGBUS signal */
	sigdelset(&sigset, SIGFPE);
	sigdelset(&sigset, SIGILL);
	sigdelset(&sigset, SIGSEGV);
#ifdef SIGBUS
	sigdelset(&sigset, SIGBUS);
#endif
	pthread_sigmask(SIG_SETMASK, &sigset, NULL);
	memset(&act, 0, sizeof(struct sigaction));
	act.sa_handler = onas_ddd_exit;
	sigfillset(&(act.sa_mask));
	sigaction(SIGUSR1, &act, NULL);
	sigaction(SIGSEGV, &act, NULL);

	onas_in_fd = inotify_init1(IN_NONBLOCK);
	if (onas_in_fd == -1) {
		logg("!ScanOnAccess: Could not init inotify.");
		return NULL;
	}

	ret = onas_ddd_init(0, ONAS_DEFAULT_HT_SIZE);
	if (ret) {
		logg("!ScanOnAccess: Failed to initialize 3D. \n");
		return NULL;
	}

	/* Add provided paths recursively. */
	if((pt = optget(tharg->opts, "OnAccessIncludePath"))->enabled) {
		while(pt) {
			if (!strcmp(pt->strarg, "/")) {
				logg("!ScanOnAcess: Not inlcuding path '%s' while DDD is enabled\n", pt->strarg);
				logg("!ScanOnAcess: Please use the OnAccessMountPath option to watch '%s'\n", pt->strarg);
				pt = (struct optstruct *) pt->nextarg;
				continue;
			}
			if(onas_ht_get(ddd_ht, pt->strarg, strlen(pt->strarg), NULL) != CL_SUCCESS) {
				if(onas_ht_add_hierarchy(ddd_ht, pt->strarg)) {
					logg("!ScanOnAccess: Can't include path '%s'\n", pt->strarg);
					return NULL;
				} else
					logg("ScanOnAccess: Protecting directory '%s' (and all sub-directories)\n", pt->strarg);
			}

			pt = (struct optstruct *) pt->nextarg;
		}
	} else {
		logg("!ScanOnAccess: Please specify at least one path with OnAccessIncludePath\n");
		return NULL;
	}

	/* Remove provided paths recursively. */
	if((pt = optget(tharg->opts, "OnAccessExcludePath"))->enabled) {
		while(pt) {
			size_t ptlen = strlen(pt->strarg);
			if(onas_ht_get(ddd_ht, pt->strarg, ptlen, NULL) == CL_SUCCESS) {
				if(onas_ht_rm_hierarchy(ddd_ht, pt->strarg, ptlen, 0)) {
					logg("!ScanOnAccess: Can't exclude path '%s'\n", pt->strarg);
					return NULL;
				} else
					logg("ScanOnAccess: Excluding  directory '%s' (and all sub-directories)\n", pt->strarg);
			}

			pt = (struct optstruct *) pt->nextarg;
		}
	}

	/* Watch provided paths recursively */
	if((pt = optget(tharg->opts, "OnAccessIncludePath"))->enabled) {
		while(pt) {
			size_t ptlen = strlen(pt->strarg);
			if(onas_ht_get(ddd_ht, pt->strarg, ptlen, NULL) == CL_SUCCESS) {
				if(onas_ddd_watch(pt->strarg, tharg->fan_fd, tharg->fan_mask, onas_in_fd, in_mask)) {
					logg("!ScanOnAccess: Could not watch path '%s', %s\n", pt->strarg, strerror(errno));
					if(errno == EINVAL && optget(tharg->opts, "OnAccessPrevention")->enabled) {
						logg("!ScanOnAccess: When using the OnAccessPrevention option, please ensure your kernel\n\t\t\twas compiled with CONFIG_FANOTIFY_ACCESS_PERMISSIONS set to Y\n");

						kill(getpid(), SIGTERM);
					}
					return NULL;
				}
			}
			pt = (struct optstruct *) pt->nextarg;
		}
	}

	if(optget(tharg->opts, "OnAccessExtraScanning")->enabled) {
		logg("ScanOnAccess: Extra scanning and notifications enabled.\n");
	}


	FD_ZERO(&rfds);
	FD_SET(onas_in_fd, &rfds);

	while (1) {
		do {
			ret = select(onas_in_fd + 1, &rfds, NULL, NULL, NULL);
		} while(ret == -1 && errno == EINTR);

		while((bread = read(onas_in_fd, buf, sizeof(buf))) > 0) {

			/* Handle events. */
			int wd;
			char *p = buf;
			const char *path = NULL;
			const char *child = NULL;
			for(; p < buf + bread; p += sizeof(struct inotify_event) + event->len) {

				event = (const struct inotify_event *) p;
				wd = event->wd;
				path = wdlt[wd];
				child = event->name;

				len = strlen(path);
				size_t size = strlen(child) + len + 2;
				char *child_path = (char *) cli_malloc(size);
				if (child_path == NULL)
					return NULL;

				if (path[len-1] == '/')
					snprintf(child_path, --size, "%s%s", path, child);
				else
					snprintf(child_path, size, "%s/%s", path, child);

				if (event->mask & IN_DELETE) {
					onas_ddd_handle_in_delete(tharg, path, child_path, event, wd);

				} else if (event->mask & IN_MOVED_FROM) {
					onas_ddd_handle_in_moved_from(tharg, path, child_path, event, wd);

				} else if (event->mask & IN_CREATE) {
					onas_ddd_handle_in_create(tharg, path, child_path, event, wd, in_mask);

				} else if (event->mask & IN_MOVED_TO) {
					onas_ddd_handle_in_moved_to(tharg, path, child_path, event, wd, in_mask);
				}
			}
		}
	}

	return NULL;
}