CheckAccessDeleted.cc

Go to the documentation of this file.

/*---------------------------------------------------------------------\
|                          ____ _   __ __ ___                          |
|                         |__  / \ / / . \ . \                         |
|                           / / \ V /|  _/  _/                         |
|                          / /__ | | | | | |                           |
|                         /_____||_| |_| |_|                           |
|                                                                      |
\---------------------------------------------------------------------*/
#include <iostream>
#include <fstream>
#include <unordered_set>
#include "zypp/base/LogTools.h"
#include "zypp/base/String.h"
#include "zypp/base/Gettext.h"
#include "zypp/base/Exception.h"

#include "zypp/PathInfo.h"
#include "zypp/ExternalProgram.h"
#include "zypp/base/Regex.h"
#include "zypp/base/IOStream.h"
#include "zypp/base/InputStream.h"
#include "zypp/target/rpm/librpmDb.h"

#include "zypp/misc/CheckAccessDeleted.h"

using std::endl;

#undef ZYPP_BASE_LOGGER_LOGGROUP
#define ZYPP_BASE_LOGGER_LOGGROUP "zypp::misc"

namespace zypp
{ 

  namespace
  { 
    //
    // lsof output lines are a sequence of NUL terminated fields,
    // where the 1st char determines the fields type.
    //
    // (pcuL) pid command userid loginname
    // (ftkn).filedescriptor type linkcount filename
    //

    typedef std::pair<std::string,std::unordered_set<std::string>> CacheEntry;

    inline void addDataIf( std::vector<CheckAccessDeleted::ProcInfo> & data_r, const CacheEntry & cache_r )
    {
      const auto & filelist( cache_r.second );

      if ( filelist.empty() )
        return;

      // at least one file access so keep it:
      data_r.push_back( CheckAccessDeleted::ProcInfo() );
      CheckAccessDeleted::ProcInfo & pinfo( data_r.back() );
      pinfo.files.insert( pinfo.files.begin(), filelist.begin(), filelist.end() );

      const std::string & pline( cache_r.first );
      std::string commandname;  // pinfo.command if still needed...
      for_( ch, pline.begin(), pline.end() )
      {
        switch ( *ch )
        {
          case 'p':
            pinfo.pid = &*(ch+1);
            break;
          case 'R':
            pinfo.ppid = &*(ch+1);
            break;
          case 'u':
            pinfo.puid = &*(ch+1);
            break;
          case 'L':
            pinfo.login = &*(ch+1);
            break;
          case 'c':
            if ( pinfo.command.empty() )
              commandname = &*(ch+1);
            break;
        }
        if ( *ch == '\n' ) break;               // end of data
        do { ++ch; } while ( *ch != '\0' );     // skip to next field
      }

      if ( pinfo.command.empty() )
      {
        // the lsof command name might be truncated, so we prefer /proc/<pid>/exe
        pinfo.command = filesystem::readlink( Pathname("/proc")/pinfo.pid/"exe" ).basename();
        if ( pinfo.command.empty() )
          pinfo.command = std::move(commandname);
      }
    }


    inline void addCacheIf( CacheEntry & cache_r, const std::string & line_r, bool verbose_r  )
    {
      const char * f = 0;
      const char * t = 0;
      const char * n = 0;

      for_( ch, line_r.c_str(), ch+line_r.size() )
      {
        switch ( *ch )
        {
          case 'k':
            if ( *(ch+1) != '0' )       // skip non-zero link counts
              return;
            break;
          case 'f':
            f = ch+1;
            break;
          case 't':
            t = ch+1;
            break;
          case 'n':
            n = ch+1;
            break;
        }
        if ( *ch == '\n' ) break;               // end of data
        do { ++ch; } while ( *ch != '\0' );     // skip to next field
      }

      if ( !t || !f || !n )
        return; // wrong filedescriptor/type/name

      if ( !(    ( *t == 'R' && *(t+1) == 'E' && *(t+2) == 'G' && *(t+3) == '\0' )
              || ( *t == 'D' && *(t+1) == 'E' && *(t+2) == 'L' && *(t+3) == '\0' ) ) )
        return; // wrong type

      if ( !(    ( *f == 'm' && *(f+1) == 'e' && *(f+2) == 'm' && *(f+3) == '\0' )
              || ( *f == 't' && *(f+1) == 'x' && *(f+2) == 't' && *(f+3) == '\0' )
              || ( *f == 'D' && *(f+1) == 'E' && *(f+2) == 'L' && *(f+3) == '\0' )
              || ( *f == 'l' && *(f+1) == 't' && *(f+2) == 'x' && *(f+3) == '\0' ) ) )
        return; // wrong filedescriptor type

      if ( str::contains( n, "(stat: Permission denied)" ) )
        return; // Avoid reporting false positive due to insufficient permission.

      if ( ! verbose_r )
      {
        if ( ! ( str::contains( n, "/lib" ) || str::contains( n, "bin/" ) ) )
          return; // Try to avoid reporting false positive unless verbose.
      }

      if ( *f == 'm' || *f == 'D' )     // skip some wellknown nonlibrary memorymapped files
      {
        static const char * black[] = {
            "/SYSV"
          , "/var/run/"
          , "/var/lib/sss/"
          , "/dev/"
          , "/var/lib/gdm"
        };
        for_( it, arrayBegin( black ), arrayEnd( black ) )
        {
          if ( str::hasPrefix( n, *it ) )
            return;
        }
      }
      // Add if no duplicate
      cache_r.second.insert( n );
    }

    struct FilterRunsInLXC
    {
      bool operator()( pid_t pid_r ) const
      { return( nsIno( pid_r, "pid" ) != pidNS ); }

      FilterRunsInLXC()
      : pidNS( nsIno( "self", "pid" ) )
      {}

      static inline ino_t nsIno( const std::string & pid_r, const std::string & ns_r )
      { return PathInfo("/proc/"+pid_r+"/ns/"+ns_r).ino(); }

      static inline ino_t nsIno( pid_t pid_r, const std::string & ns_r )
      { return  nsIno( asString(pid_r), ns_r ); }

      ino_t pidNS;
    };

#if 0
    void lsofdebug( const Pathname & file_r )
    {
      std::ifstream infile( file_r.c_str() );
      USR << infile << endl;
      std::vector<std::string> fields;
      CacheEntry cache;
      for( iostr::EachLine in( infile ); in; in.next() )
      {
        std::string field( *in );
        if ( field[0] == 'f' || field[0] == 'p' )
        {
          if ( !fields.empty() )
          {
            // consume
            std::string line( str::join( fields, "\n" ) );
            for ( char & c : line )
            { if ( c == '\n' ) c = '\0'; }
            line.push_back( '\n' );

            size_t sze = cache.second.size();
            addCacheIf( cache, line, false );
            if ( sze != cache.second.size() )
              USR << fields << endl;

            fields.clear();
          }
          if ( field[0] == 'p' )
            continue;
          fields.push_back( field );
        }
        else if ( !fields.empty() )
        {
          fields.push_back( field );
        }
      }
    }
#endif

    bool lsofNoOptKi()
    {
      using target::rpm::librpmDb;
      // RpmDb access is blocked while the Target is not initialized.
      // Launching the Target just for this query would be an overkill.
      struct TmpUnblock {
        TmpUnblock()
        : _wasBlocked( librpmDb::isBlocked() )
        { if ( _wasBlocked ) librpmDb::unblockAccess(); }
        ~TmpUnblock()
        { if ( _wasBlocked ) librpmDb::blockAccess(); }
      private:
        bool _wasBlocked;
      } tmpUnblock;

      librpmDb::db_const_iterator it;
      return( it.findPackage( "lsof" ) && it->tag_edition() < Edition("4.90") && !it->tag_provides().count( Capability("backported-option-Ki") ) );
    }

  } // namespace

  CheckAccessDeleted::size_type CheckAccessDeleted::check( bool verbose_r )
  {
    _data.clear();

    static const char* argv[] = { "lsof", "-n", "-FpcuLRftkn0", "-K", "i", NULL };
    if ( lsofNoOptKi() )
      argv[3] = NULL;
    ExternalProgram prog( argv, ExternalProgram::Discard_Stderr );

    // cachemap: PID => (deleted files)
    // NOTE: omit PIDs running in a (lxc/docker) container
    std::map<pid_t,CacheEntry> cachemap;
    pid_t cachepid = 0;
    FilterRunsInLXC runsInLXC;
    for( std::string line = prog.receiveLine(); ! line.empty(); line = prog.receiveLine() )
    {
      // NOTE: line contains '\0' separeated fields!
      if ( line[0] == 'p' )
      {
        str::strtonum( line.c_str()+1, cachepid );      // line is "p<PID>\0...."
        if ( !runsInLXC( cachepid ) )
          cachemap[cachepid].first.swap( line );
        else
          cachepid = 0; // ignore this pid
      }
      else if ( cachepid )
      {
        addCacheIf( cachemap[cachepid], line, verbose_r );
      }
    }

    int ret = prog.close();
    if ( ret != 0 )
    {
      if ( ret == 129 )
      {
        ZYPP_THROW( Exception(_("Please install package 'lsof' first.") ) );
      }
      Exception err( str::form("Executing 'lsof' failed (%d).", ret) );
      err.remember( prog.execError() );
      ZYPP_THROW( err );
    }

    std::vector<ProcInfo> data;
    for ( const auto & cached : cachemap )
    {
      addDataIf( data, cached.second );
    }
    _data.swap( data );
    return _data.size();
  }

  std::string CheckAccessDeleted::findService( pid_t pid_r )
  {
    ProcInfo p;
    p.pid = str::numstring( pid_r );
    return p.service();
  }

  namespace
  { 
  } // namespace

  std::string CheckAccessDeleted::ProcInfo::service() const
  {
    static const str::regex rx( "[0-9]+:name=systemd:/system.slice/(.*/)?(.*).service$" );
    str::smatch what;
    std::string ret;
    iostr::simpleParseFile( InputStream( Pathname("/proc")/pid/"cgroup" ),
                            [&]( int num_r, std::string line_r )->bool
                            {
                              if ( str::regex_match( line_r, what, rx ) )
                              {
                                ret = what[2];
                                return false;   // stop after match
                              }
                              return true;
                            } );
    return ret;
  }

  /******************************************************************
  **
  **    FUNCTION NAME : operator<<
  **    FUNCTION TYPE : std::ostream &
  */
  std::ostream & operator<<( std::ostream & str, const CheckAccessDeleted & obj )
  {
    return dumpRange( str << "CheckAccessDeleted ",
                      obj.begin(),
                      obj.end() );
  }

   /******************************************************************
  **
  **    FUNCTION NAME : operator<<
  **    FUNCTION TYPE : std::ostream &
  */
  std::ostream & operator<<( std::ostream & str, const CheckAccessDeleted::ProcInfo & obj )
  {
    if ( obj.pid.empty() )
      return str << "<NoProc>";

    return dumpRangeLine( str << obj.command
                              << '<' << obj.pid
                              << '|' << obj.ppid
                              << '|' << obj.puid
                              << '|' << obj.login
                              << '>',
                          obj.files.begin(),
                          obj.files.end() );
  }

} // namespace zypp