4 files changed, 210 insertions, 0 deletions
diff --git a/runtime/tests/shellsnoop/Makefile b/runtime/tests/shellsnoop/Makefile
new file mode 100644
index 00000000..86d61266
--- /dev/null
+++ b/runtime/tests/shellsnoop/Makefile
@@ -0,0 +1,9 @@
+# Makefile
+#
+# make -C path/to/kernel/src M=`pwd` modules
+
+obj-m := dtr.o
+
+
+
+
diff --git a/runtime/tests/shellsnoop/README b/runtime/tests/shellsnoop/README
new file mode 100644
index 00000000..ce37a2db
--- /dev/null
+++ b/runtime/tests/shellsnoop/README
@@ -0,0 +1,70 @@
+Sample probe.
+
+To build, edit the path in buildit and the addresses in struct dtr_probes
+in dtr.c Then "source buildit"
+
+This is a translation of on an old dtr probe:
+
+# shellsnoop.probe - snoop shell execution as it occurs.
+# clone of dtrace shellsnoop example
+
+global {
+  long @pids[long];
+}
+
+probe do_execve:entry {
+  char __user *vstr;
+  char str[256];
+  int len;
+
+  /* watch shells only */
+  /* FIXME: detect more shells, like csh, tcsh, zsh */
+
+  if (!strcmp(current->comm,"bash") || !strcmp(current->comm,"sh") || !strcmp(current->comm, "zsh")
+      || !strcmp(current->comm, "tcsh") || !strcmp(current->comm, "pdksh"))
+    {
+      dlog ("%d\t%d\t%d\t%s ", current->uid, current->pid, current->parent->pid, filename);
+      @pids[current->pid] = 1;
+
+      /* print out argv, ignoring argv[0] */
+      if (argv) argv++;
+      while (argv != NULL)
+        {
+          if (get_user (vstr, argv))
+            break;
+          if (!vstr)
+            break;
+          len = dtr_strncpy_from_user(str, vstr, 256);
+          str[len] = 0;
+          printk ("%s ", str);
+          argv++;
+        }
+      printk ("\n");
+    }
+}
+
+# use filp_open because copy_from_user not needed there
+probe filp_open:entry {
+  if (@pids[current->pid])
+    dlog ("%d\t%d\t%s\tO %s\n", current->pid, current->parent->pid, current->comm, filename);
+}
+
+probe sys_read:entry {
+  if (@pids[current->pid])
+    dlog ("%d\t%d\t%s\tR %d\n", current->pid, current->parent->pid, current->comm, fd);
+}
+
+probe sys_write:entry {
+  size_t len;
+  char str[256];
+  if (@pids[current->pid])
+    {
+      if (count < 64) len = count;
+      else len = 64;
+      if (len = dtr_strncpy_from_user(str, buf, len)) {
+        str[len] = 0;
+        dlog ("%d\t%d\t%s\tW %s\n", current->pid, current->parent->pid, current->comm, str);
+        }
+    }
+}
+
diff --git a/runtime/tests/shellsnoop/buildit b/runtime/tests/shellsnoop/buildit
new file mode 100644
index 00000000..8d90a0ec
--- /dev/null
+++ b/runtime/tests/shellsnoop/buildit
@@ -0,0 +1 @@
+make -C /lib/modules/2.6.10-1.770_FC3smp/build M=`pwd`
diff --git a/runtime/tests/shellsnoop/dtr.c b/runtime/tests/shellsnoop/dtr.c
new file mode 100644
index 00000000..790a907a
--- /dev/null
+++ b/runtime/tests/shellsnoop/dtr.c
@@ -0,0 +1,130 @@
+#define HASH_TABLE_BITS 8
+#define HASH_TABLE_SIZE (1<<HASH_TABLE_BITS)
+#define BUCKETS 16 /* largest histogram width */
+#include "../../runtime.h"
+
+#include "../../io.c"
+#include "../../map.c"
+#include "../../copy.c"
+
+MODULE_PARM_DESC(dtr, "\n");
+
+MAP pids, arglist ;
+
+int inst_do_execve (char * filename, char __user *__user *argv, char __user *__user *envp, struct pt_regs * regs)
+{
+  struct map_node_str *ptr;
+
+  /* watch shells only */
+  /* FIXME: detect more shells, like csh, tcsh, zsh */
+  
+  if (!strcmp(current->comm,"bash") || !strcmp(current->comm,"sh") || !strcmp(current->comm, "zsh")
+      || !strcmp(current->comm, "tcsh") || !strcmp(current->comm, "pdksh"))
+    {
+      dlog ("%d\t%d\t%d\t%s ", current->uid, current->pid, current->parent->pid, filename);
+
+      _stp_map_key_long (pids, current->pid);
+      _stp_map_set_int64 (pids, 1);
+      
+      _stp_copy_argv_from_user (arglist, argv);
+      foreach (arglist, ptr)
+	printk ("%s ", ptr->str);
+      printk ("\n");
+    }
+  jprobe_return();
+  return 0;
+}
+
+struct file * inst_filp_open (const char * filename, int flags, int mode)
+{
+  _stp_map_key_long (pids, current->pid);
+  if (_stp_map_get_int64 (pids))
+    dlog ("%d\t%d\t%s\tO %s\n", current->pid, current->parent->pid, current->comm, filename);
+  
+  jprobe_return();
+  return 0;
+}
+
+asmlinkage ssize_t inst_sys_read (unsigned int fd, char __user * buf, size_t count)
+{
+  _stp_map_key_long (pids, current->pid);
+  if (_stp_map_get_int64 (pids))
+    dlog ("%d\t%d\t%s\tR %d\n", current->pid, current->parent->pid, current->comm, fd);
+  
+  jprobe_return();
+  return 0;
+}
+
+asmlinkage ssize_t inst_sys_write (unsigned int fd, const char __user * buf, size_t count)
+{
+  size_t len;
+  char str[256];
+  _stp_map_key_long (pids, current->pid);
+  if (_stp_map_get_int64 (pids))
+    {
+      if (count < 64) 
+	len = count;
+      else 
+	len = 64;
+      len = _stp_strncpy_from_user(str, buf, len);
+      if (len < 0) len = 0;
+      str[len] = 0;
+      dlog ("%d\t%d\t%s\tW %s\n", current->pid, current->parent->pid, current->comm, str);
+    }
+  
+  jprobe_return();
+  return 0;
+}
+
+static struct jprobe dtr_probes[] = {
+  {
+    .kp.addr = (kprobe_opcode_t *)0xffffffff8017b034,
+    .entry = (kprobe_opcode_t *) inst_do_execve
+  },
+  {
+    .kp.addr = (kprobe_opcode_t *)0xffffffff80170706,
+    .entry = (kprobe_opcode_t *) inst_filp_open
+  },
+  {
+    .kp.addr = (kprobe_opcode_t *)0xffffffff801711dd,
+    .entry = (kprobe_opcode_t *) inst_sys_read
+  },
+  {
+    .kp.addr = (kprobe_opcode_t *)0xffffffff8017124b,
+    .entry = (kprobe_opcode_t *) inst_sys_write
+  },
+};
+
+#define MAX_DTR_ROUTINE (sizeof(dtr_probes)/sizeof(struct jprobe))
+
+static int init_dtr(void)
+{
+  int i;
+
+  pids = _stp_map_new (10000, INT64);
+  arglist = _stp_list_new (10, STRING);
+
+  for (i = 0; i < MAX_DTR_ROUTINE; i++) {
+    printk("DTR: plant jprobe at %p, handler addr %p\n",
+	   dtr_probes[i].kp.addr, dtr_probes[i].entry);
+    register_jprobe(&dtr_probes[i]);
+  }
+  printk("DTR: instrumentation is enabled...\n");
+  return 0;
+}
+
+static void cleanup_dtr(void)
+{
+  int i;
+
+  for (i = 0; i < MAX_DTR_ROUTINE; i++)
+    unregister_jprobe(&dtr_probes[i]);
+
+  _stp_map_del (pids);
+  printk("DTR: EXIT\n");
+}
+
+module_init(init_dtr);
+module_exit(cleanup_dtr);
+MODULE_LICENSE("GPL");
+