diff options
Diffstat (limited to 'runtime/docs/html/probes_2shellsnoop_2README-source.html')
| -rw-r--r-- | runtime/docs/html/probes_2shellsnoop_2README-source.html | 83 |
1 files changed, 0 insertions, 83 deletions
diff --git a/runtime/docs/html/probes_2shellsnoop_2README-source.html b/runtime/docs/html/probes_2shellsnoop_2README-source.html deleted file mode 100644 index e7384ecb..00000000 --- a/runtime/docs/html/probes_2shellsnoop_2README-source.html +++ /dev/null @@ -1,83 +0,0 @@ -<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"> -<html><head><meta http-equiv="Content-Type" content="text/html;charset=iso-8859-1"> -<title>SystemTap: probes/shellsnoop/README Source File</title> -<link href="doxygen.css" rel="stylesheet" type="text/css"> -</head><body> -<!-- Generated by Doxygen 1.4.1 --> -<div class="qindex"><a class="qindex" href="index.html">Main Page</a> | <a class="qindex" href="modules.html">Modules</a> | <a class="qindex" href="dirs.html">Directories</a> | <a class="qindex" href="files.html">File List</a> | <a class="qindex" href="globals.html">Globals</a> | <a class="qindex" href="pages.html">Related Pages</a></div> -<div class="nav"> -<a class="el" href="dir_000000.html">probes</a> / <a class="el" href="dir_000001.html">shellsnoop</a></div> -<h1>README</h1><div class="fragment"><pre class="fragment">00001 <span class="comment">/** @dir shellsnoop</span> -00002 <span class="comment">Snoops on what commands are being run by shells.</span> -00003 <span class="comment"></span> -00004 <span class="comment">This is a translation of on an old dtr probe. It demonstrates maps,</span> -00005 <span class="comment">lists, and how to use _stp_copy_argv_from_user() and _stp_strncpy_from_user().</span> -00006 <span class="comment"></span> -00007 <span class="comment">Original dtr source:</span> -00008 <span class="comment"></span> -00009 <span class="comment">\verbatim</span> -00010 <span class="comment"># shellsnoop.probe - snoop shell execution as it occurs.</span> -00011 <span class="comment"># clone of dtrace shellsnoop example</span> -00012 <span class="comment"></span> -00013 <span class="comment">global {</span> -00014 <span class="comment"> long @pids[long];</span> -00015 <span class="comment">}</span> -00016 <span class="comment"></span> -00017 <span class="comment">probe do_execve:entry {</span> -00018 <span class="comment"> char __user *vstr;</span> -00019 <span class="comment"> char str[256];</span> -00020 <span class="comment"> int len;</span> -00021 <span class="comment"></span> -00022 <span class="comment"> /* watch shells only */</span> -00023 <span class="comment">/* FIXME: detect more shells, like csh, tcsh, zsh */</span> -00024 -00025 <span class="keywordflow">if</span> (!strcmp(current->comm,<span class="stringliteral">"bash"</span>) || !strcmp(current->comm,<span class="stringliteral">"sh"</span>) || !strcmp(current->comm, <span class="stringliteral">"zsh"</span>) -00026 || !strcmp(current->comm, <span class="stringliteral">"tcsh"</span>) || !strcmp(current->comm, <span class="stringliteral">"pdksh"</span>)) -00027 { -00028 dlog (<span class="stringliteral">"%d\t%d\t%d\t%s "</span>, current->uid, current->pid, current->parent->pid, filename); -00029 @pids[current->pid] = 1; -00030 -00031 <span class="comment">/* print out argv, ignoring argv[0] */</span> -00032 <span class="keywordflow">if</span> (argv) argv++; -00033 while (argv != NULL) -00034 { -00035 <span class="keywordflow">if</span> (get_user (vstr, argv)) -00036 break; -00037 if (!vstr) -00038 break; -00039 len = dtr_strncpy_from_user(str, vstr, 256); -00040 str[len] = 0; -00041 printk ("%s ", str); -00042 argv++; -00043 } -00044 printk ("\n"); -00045 } -00046 } -00047 -00048 # use filp_open because copy_from_user not needed there -00049 probe filp_open:entry { -00050 <span class="keywordflow">if</span> (@pids[current->pid]) -00051 dlog ("%d\t%d\t%s\tO %s\n", current->pid, current->parent->pid, current->comm, filename); -00052 } -00053 -00054 probe sys_read:entry { -00055 <span class="keywordflow">if</span> (@pids[current->pid]) -00056 dlog ("%d\t%d\t%s\tR %d\n", current->pid, current->parent->pid, current->comm, fd); -00057 } -00058 -00059 probe sys_write:entry { -00060 size_t len; -00061 <span class="keywordtype">char</span> str[256]; -00062 <span class="keywordflow">if</span> (@pids[current->pid]) -00063 { -00064 <span class="keywordflow">if</span> (count < 64) len = count; -00065 else len = 64; -00066 if (len = dtr_strncpy_from_user(str, buf, len)) { -00067 str[len] = 0; -00068 dlog (<span class="stringliteral">"%d\t%d\t%s\tW %s\n"</span>, current->pid, current->parent->pid, current->comm, str); -00069 } -00070 } -00071 } -00072 \endverbatim -00073 */ -</pre></div></body></html> |