| Index: tools/isolate/trace_inputs.py
|
| diff --git a/tools/isolate/trace_inputs.py b/tools/isolate/trace_inputs.py
|
| deleted file mode 100755
|
| index 4e8df22757b15ef1672c50b6711df71ff068531c..0000000000000000000000000000000000000000
|
| --- a/tools/isolate/trace_inputs.py
|
| +++ /dev/null
|
| @@ -1,3258 +0,0 @@
|
| -#!/usr/bin/env python
|
| -# coding=utf-8
|
| -# Copyright (c) 2012 The Chromium Authors. All rights reserved.
|
| -# Use of this source code is governed by a BSD-style license that can be
|
| -# found in the LICENSE file.
|
| -
|
| -"""Traces an executable and its child processes and extract the files accessed
|
| -by them.
|
| -
|
| -The implementation uses OS-specific API. The native Kernel logger and the ETL
|
| -interface is used on Windows. Dtrace is used on OSX. Strace is used otherwise.
|
| -The OS-specific implementation is hidden in an 'API' interface.
|
| -
|
| -The results are embedded in a Results instance. The tracing is done in two
|
| -phases, the first is to do the actual trace and generate an
|
| -implementation-specific log file. Then the log file is parsed to extract the
|
| -information, including the individual child processes and the files accessed
|
| -from the log.
|
| -"""
|
| -
|
| -import codecs
|
| -import csv
|
| -import getpass
|
| -import glob
|
| -import json
|
| -import logging
|
| -import optparse
|
| -import os
|
| -import re
|
| -import subprocess
|
| -import sys
|
| -import tempfile
|
| -import threading
|
| -import time
|
| -import weakref
|
| -
|
| -## OS-specific imports
|
| -
|
| -if sys.platform == 'win32':
|
| - from ctypes.wintypes import byref, create_unicode_buffer, c_int, c_wchar_p
|
| - from ctypes.wintypes import windll, FormatError # pylint: disable=E0611
|
| - from ctypes.wintypes import GetLastError # pylint: disable=E0611
|
| -elif sys.platform == 'darwin':
|
| - import Carbon.File # pylint: disable=F0401
|
| - import MacOS # pylint: disable=F0401
|
| -
|
| -
|
| -BASE_DIR = os.path.dirname(os.path.abspath(__file__))
|
| -ROOT_DIR = os.path.dirname(os.path.dirname(BASE_DIR))
|
| -
|
| -
|
| -class TracingFailure(Exception):
|
| - """An exception occured during tracing."""
|
| - def __init__(self, description, pid, line_number, line, *args):
|
| - super(TracingFailure, self).__init__(
|
| - description, pid, line_number, line, *args)
|
| - self.description = description
|
| - self.pid = pid
|
| - self.line_number = line_number
|
| - self.line = line
|
| - self.extra = args
|
| -
|
| - def __str__(self):
|
| - out = self.description
|
| - if self.pid:
|
| - out += '\npid: %d' % self.pid
|
| - if self.line_number:
|
| - out += '\nline: %d' % self.line_number
|
| - if self.line:
|
| - out += '\n%s' % self.line
|
| - if self.extra:
|
| - out += '\n' + ', '.join(map(str, filter(None, self.extra)))
|
| - return out
|
| -
|
| -
|
| -## OS-specific functions
|
| -
|
| -if sys.platform == 'win32':
|
| - def QueryDosDevice(drive_letter):
|
| - """Returns the Windows 'native' path for a DOS drive letter."""
|
| - assert re.match(r'^[a-zA-Z]:$', drive_letter), drive_letter
|
| - # Guesswork. QueryDosDeviceW never returns the required number of bytes.
|
| - chars = 1024
|
| - drive_letter = unicode(drive_letter)
|
| - p = create_unicode_buffer(chars)
|
| - if 0 == windll.kernel32.QueryDosDeviceW(drive_letter, p, chars):
|
| - err = GetLastError()
|
| - if err:
|
| - # pylint: disable=E0602
|
| - raise WindowsError(
|
| - err,
|
| - 'QueryDosDevice(%s): %s (%d)' % (
|
| - str(drive_letter), FormatError(err), err))
|
| - return p.value
|
| -
|
| -
|
| - def GetShortPathName(long_path):
|
| - """Returns the Windows short path equivalent for a 'long' path."""
|
| - long_path = unicode(long_path)
|
| - # Adds '\\\\?\\' when given an absolute path so the MAX_PATH (260) limit is
|
| - # not enforced.
|
| - if os.path.isabs(long_path) and not long_path.startswith('\\\\?\\'):
|
| - long_path = '\\\\?\\' + long_path
|
| - chars = windll.kernel32.GetShortPathNameW(long_path, None, 0)
|
| - if chars:
|
| - p = create_unicode_buffer(chars)
|
| - if windll.kernel32.GetShortPathNameW(long_path, p, chars):
|
| - return p.value
|
| -
|
| - err = GetLastError()
|
| - if err:
|
| - # pylint: disable=E0602
|
| - raise WindowsError(
|
| - err,
|
| - 'GetShortPathName(%s): %s (%d)' % (
|
| - str(long_path), FormatError(err), err))
|
| -
|
| -
|
| - def GetLongPathName(short_path):
|
| - """Returns the Windows long path equivalent for a 'short' path."""
|
| - short_path = unicode(short_path)
|
| - # Adds '\\\\?\\' when given an absolute path so the MAX_PATH (260) limit is
|
| - # not enforced.
|
| - if os.path.isabs(short_path) and not short_path.startswith('\\\\?\\'):
|
| - short_path = '\\\\?\\' + short_path
|
| - chars = windll.kernel32.GetLongPathNameW(short_path, None, 0)
|
| - if chars:
|
| - p = create_unicode_buffer(chars)
|
| - if windll.kernel32.GetLongPathNameW(short_path, p, chars):
|
| - return p.value
|
| -
|
| - err = GetLastError()
|
| - if err:
|
| - # pylint: disable=E0602
|
| - raise WindowsError(
|
| - err,
|
| - 'GetLongPathName(%s): %s (%d)' % (
|
| - str(short_path), FormatError(err), err))
|
| -
|
| -
|
| - def get_current_encoding():
|
| - """Returns the 'ANSI' code page associated to the process."""
|
| - return 'cp%d' % int(windll.kernel32.GetACP())
|
| -
|
| -
|
| - class DosDriveMap(object):
|
| - """Maps \Device\HarddiskVolumeN to N: on Windows."""
|
| - # Keep one global cache.
|
| - _MAPPING = {}
|
| -
|
| - def __init__(self):
|
| - """Lazy loads the cache."""
|
| - if not self._MAPPING:
|
| - # This is related to UNC resolver on windows. Ignore that.
|
| - self._MAPPING['\\Device\\Mup'] = None
|
| - self._MAPPING['\\SystemRoot'] = os.environ['SystemRoot']
|
| -
|
| - for letter in (chr(l) for l in xrange(ord('C'), ord('Z')+1)):
|
| - try:
|
| - letter = '%s:' % letter
|
| - mapped = QueryDosDevice(letter)
|
| - if mapped in self._MAPPING:
|
| - logging.warn(
|
| - ('Two drives: \'%s\' and \'%s\', are mapped to the same disk'
|
| - '. Drive letters are a user-mode concept and the kernel '
|
| - 'traces only have NT path, so all accesses will be '
|
| - 'associated with the first drive letter, independent of the '
|
| - 'actual letter used by the code') % (
|
| - self._MAPPING[mapped], letter))
|
| - else:
|
| - self._MAPPING[mapped] = letter
|
| - except WindowsError: # pylint: disable=E0602
|
| - pass
|
| -
|
| - def to_win32(self, path):
|
| - """Converts a native NT path to Win32/DOS compatible path."""
|
| - match = re.match(r'(^\\Device\\[a-zA-Z0-9]+)(\\.*)?$', path)
|
| - if not match:
|
| - raise ValueError(
|
| - 'Can\'t convert %s into a Win32 compatible path' % path,
|
| - path)
|
| - if not match.group(1) in self._MAPPING:
|
| - # Unmapped partitions may be accessed by windows for the
|
| - # fun of it while the test is running. Discard these.
|
| - return None
|
| - drive = self._MAPPING[match.group(1)]
|
| - if not drive or not match.group(2):
|
| - return drive
|
| - return drive + match.group(2)
|
| -
|
| -
|
| - def isabs(path):
|
| - """Accepts X: as an absolute path, unlike python's os.path.isabs()."""
|
| - return os.path.isabs(path) or len(path) == 2 and path[1] == ':'
|
| -
|
| -
|
| - def get_native_path_case(p):
|
| - """Returns the native path case for an existing file.
|
| -
|
| - On Windows, removes any leading '\\?\'.
|
| - """
|
| - if not isabs(p):
|
| - raise ValueError(
|
| - 'Can\'t get native path case for a non-absolute path: %s' % p,
|
| - p)
|
| - # Windows used to have an option to turn on case sensitivity on non Win32
|
| - # subsystem but that's out of scope here and isn't supported anymore.
|
| - # Go figure why GetShortPathName() is needed.
|
| - try:
|
| - out = GetLongPathName(GetShortPathName(p))
|
| - except OSError, e:
|
| - if e.args[0] in (2, 3, 5):
|
| - # The path does not exist. Try to recurse and reconstruct the path.
|
| - base = os.path.dirname(p)
|
| - rest = os.path.basename(p)
|
| - return os.path.join(get_native_path_case(base), rest)
|
| - raise
|
| - if out.startswith('\\\\?\\'):
|
| - out = out[4:]
|
| - # Always upper case the first letter since GetLongPathName() will return the
|
| - # drive letter in the case it was given.
|
| - return out[0].upper() + out[1:]
|
| -
|
| -
|
| - def CommandLineToArgvW(command_line):
|
| - """Splits a commandline into argv using CommandLineToArgvW()."""
|
| - # http://msdn.microsoft.com/library/windows/desktop/bb776391.aspx
|
| - size = c_int()
|
| - ptr = windll.shell32.CommandLineToArgvW(unicode(command_line), byref(size))
|
| - try:
|
| - return [arg for arg in (c_wchar_p * size.value).from_address(ptr)]
|
| - finally:
|
| - windll.kernel32.LocalFree(ptr)
|
| -
|
| -
|
| -elif sys.platform == 'darwin':
|
| -
|
| -
|
| - # On non-windows, keep the stdlib behavior.
|
| - isabs = os.path.isabs
|
| -
|
| -
|
| - def _find_item_native_case(root_path, item):
|
| - """Gets the native path case of a single item based at root_path.
|
| -
|
| - There is no API to get the native path case of symlinks on OSX. So it
|
| - needs to be done the slow way.
|
| - """
|
| - item = item.lower()
|
| - for element in os.listdir(root_path):
|
| - if element.lower() == item:
|
| - return element
|
| -
|
| -
|
| - def _native_case(p):
|
| - """Gets the native path case. Warning: this function resolves symlinks."""
|
| - logging.debug('native_case(%s)' % p)
|
| - try:
|
| - rel_ref, _ = Carbon.File.FSPathMakeRef(p)
|
| - out = rel_ref.FSRefMakePath()
|
| - if p.endswith(os.path.sep) and not out.endswith(os.path.sep):
|
| - return out + os.path.sep
|
| - return out
|
| - except MacOS.Error, e:
|
| - if e.args[0] in (-43, -120):
|
| - # The path does not exist. Try to recurse and reconstruct the path.
|
| - # -43 means file not found.
|
| - # -120 means directory not found.
|
| - base = os.path.dirname(p)
|
| - rest = os.path.basename(p)
|
| - return os.path.join(_native_case(base), rest)
|
| - raise OSError(
|
| - e.args[0], 'Failed to get native path for %s' % p, p, e.args[1])
|
| -
|
| -
|
| - def _split_at_symlink_native(base_path, rest):
|
| - """Returns the native path for a symlink."""
|
| - base, symlink, rest = split_at_symlink(base_path, rest)
|
| - if symlink:
|
| - if not base_path:
|
| - base_path = base
|
| - else:
|
| - base_path = safe_join(base_path, base)
|
| - symlink = _find_item_native_case(base_path, symlink)
|
| - return base, symlink, rest
|
| -
|
| -
|
| - def get_native_path_case(path):
|
| - """Returns the native path case for an existing file.
|
| -
|
| - Technically, it's only HFS+ on OSX that is case preserving and
|
| - insensitive. It's the default setting on HFS+ but can be changed.
|
| - """
|
| - if not isabs(path):
|
| - raise ValueError(
|
| - 'Can\'t get native path case for a non-absolute path: %s' % path,
|
| - path)
|
| - if path.startswith('/dev'):
|
| - # /dev is not visible from Carbon, causing an exception.
|
| - return path
|
| -
|
| - # Starts assuming there is no symlink along the path.
|
| - resolved = _native_case(path)
|
| - if resolved.lower() == path.lower():
|
| - # This code path is incredibly faster.
|
| - return resolved
|
| -
|
| - # There was a symlink, process it.
|
| - base, symlink, rest = _split_at_symlink_native(None, path)
|
| - assert symlink, (path, base, symlink, rest, resolved)
|
| - prev = base
|
| - base = safe_join(_native_case(base), symlink)
|
| - assert len(base) > len(prev)
|
| - while rest:
|
| - prev = base
|
| - relbase, symlink, rest = _split_at_symlink_native(base, rest)
|
| - base = safe_join(base, relbase)
|
| - assert len(base) > len(prev), (prev, base, symlink)
|
| - if symlink:
|
| - base = safe_join(base, symlink)
|
| - assert len(base) > len(prev), (prev, base, symlink)
|
| - # Make sure no symlink was resolved.
|
| - assert base.lower() == path.lower(), (base, path)
|
| - return base
|
| -
|
| -
|
| -else: # OSes other than Windows and OSX.
|
| -
|
| -
|
| - # On non-windows, keep the stdlib behavior.
|
| - isabs = os.path.isabs
|
| -
|
| -
|
| - def get_native_path_case(path):
|
| - """Returns the native path case for an existing file.
|
| -
|
| - On OSes other than OSX and Windows, assume the file system is
|
| - case-sensitive.
|
| -
|
| - TODO(maruel): This is not strictly true. Implement if necessary.
|
| - """
|
| - if not isabs(path):
|
| - raise ValueError(
|
| - 'Can\'t get native path case for a non-absolute path: %s' % path,
|
| - path)
|
| - # Give up on cygwin, as GetLongPathName() can't be called.
|
| - # Linux traces tends to not be normalized so use this occasion to normalize
|
| - # it. This function implementation already normalizes the path on the other
|
| - # OS so this needs to be done here to be coherent between OSes.
|
| - out = os.path.normpath(path)
|
| - if path.endswith(os.path.sep) and not out.endswith(os.path.sep):
|
| - return out + os.path.sep
|
| - return out
|
| -
|
| -
|
| -if sys.platform != 'win32': # All non-Windows OSes.
|
| -
|
| -
|
| - def safe_join(*args):
|
| - """Joins path elements like os.path.join() but doesn't abort on absolute
|
| - path.
|
| -
|
| - os.path.join('foo', '/bar') == '/bar'
|
| - but safe_join('foo', '/bar') == 'foo/bar'.
|
| - """
|
| - out = ''
|
| - for element in args:
|
| - if element.startswith(os.path.sep):
|
| - if out.endswith(os.path.sep):
|
| - out += element[1:]
|
| - else:
|
| - out += element
|
| - else:
|
| - if out.endswith(os.path.sep):
|
| - out += element
|
| - else:
|
| - out += os.path.sep + element
|
| - return out
|
| -
|
| -
|
| - def split_at_symlink(base_dir, relfile):
|
| - """Scans each component of relfile and cut the string at the symlink if
|
| - there is any.
|
| -
|
| - Returns a tuple (base_path, symlink, rest), with symlink == rest == None if
|
| - not symlink was found.
|
| - """
|
| - if base_dir:
|
| - assert relfile
|
| - assert os.path.isabs(base_dir)
|
| - index = 0
|
| - else:
|
| - assert os.path.isabs(relfile)
|
| - index = 1
|
| -
|
| - def at_root(rest):
|
| - if base_dir:
|
| - return safe_join(base_dir, rest)
|
| - return rest
|
| -
|
| - while True:
|
| - try:
|
| - index = relfile.index(os.path.sep, index)
|
| - except ValueError:
|
| - index = len(relfile)
|
| - full = at_root(relfile[:index])
|
| - if os.path.islink(full):
|
| - # A symlink!
|
| - base = os.path.dirname(relfile[:index])
|
| - symlink = os.path.basename(relfile[:index])
|
| - rest = relfile[index:]
|
| - logging.debug(
|
| - 'split_at_symlink(%s, %s) -> (%s, %s, %s)' %
|
| - (base_dir, relfile, base, symlink, rest))
|
| - return base, symlink, rest
|
| - if index == len(relfile):
|
| - break
|
| - index += 1
|
| - return relfile, None, None
|
| -
|
| -
|
| -def fix_python_path(cmd):
|
| - """Returns the fixed command line to call the right python executable."""
|
| - out = cmd[:]
|
| - if out[0] == 'python':
|
| - out[0] = sys.executable
|
| - elif out[0].endswith('.py'):
|
| - out.insert(0, sys.executable)
|
| - return out
|
| -
|
| -
|
| -def create_thunk():
|
| - handle, name = tempfile.mkstemp(prefix='trace_inputs_thunk', suffix='.py')
|
| - os.write(
|
| - handle,
|
| - (
|
| - 'import subprocess\n'
|
| - 'import sys\n'
|
| - 'sys.exit(subprocess.call(sys.argv[2:]))\n'
|
| - ))
|
| - os.close(handle)
|
| - return name
|
| -
|
| -
|
| -def strace_process_quoted_arguments(text):
|
| - """Extracts quoted arguments on a string and return the arguments as a list.
|
| -
|
| - Implemented as an automaton. Supports incomplete strings in the form
|
| - '"foo"...'.
|
| -
|
| - Example:
|
| - With text = '"foo", "bar"', the function will return ['foo', 'bar']
|
| -
|
| - TODO(maruel): Implement escaping.
|
| - """
|
| - # All the possible states of the DFA.
|
| - ( NEED_QUOTE, # Begining of a new arguments.
|
| - INSIDE_STRING, # Inside an argument.
|
| - ESCAPED, # Found a '\' inside a quote. Treat the next char as-is.
|
| - NEED_COMMA_OR_DOT, # Right after the closing quote of an argument. Could be
|
| - # a serie of 3 dots or a comma.
|
| - NEED_SPACE, # Right after a comma
|
| - NEED_DOT_2, # Found a dot, need a second one.
|
| - NEED_DOT_3, # Found second dot, need a third one.
|
| - NEED_COMMA, # Found third dot, need a comma.
|
| - ) = range(8)
|
| -
|
| - state = NEED_QUOTE
|
| - out = []
|
| - for index, char in enumerate(text):
|
| - if char == '"':
|
| - if state == NEED_QUOTE:
|
| - state = INSIDE_STRING
|
| - # A new argument was found.
|
| - out.append('')
|
| - elif state == INSIDE_STRING:
|
| - # The argument is now closed.
|
| - state = NEED_COMMA_OR_DOT
|
| - elif state == ESCAPED:
|
| - out[-1] += char
|
| - state = INSIDE_STRING
|
| - else:
|
| - raise ValueError(
|
| - 'Can\'t process char at column %d for: %r' % (index, text),
|
| - index,
|
| - text)
|
| - elif char == ',':
|
| - if state in (NEED_COMMA_OR_DOT, NEED_COMMA):
|
| - state = NEED_SPACE
|
| - elif state == INSIDE_STRING:
|
| - out[-1] += char
|
| - elif state == ESCAPED:
|
| - out[-1] += char
|
| - state = INSIDE_STRING
|
| - else:
|
| - raise ValueError(
|
| - 'Can\'t process char at column %d for: %r' % (index, text),
|
| - index,
|
| - text)
|
| - elif char == ' ':
|
| - if state == NEED_SPACE:
|
| - state = NEED_QUOTE
|
| - elif state == INSIDE_STRING:
|
| - out[-1] += char
|
| - elif state == ESCAPED:
|
| - out[-1] += char
|
| - state = INSIDE_STRING
|
| - else:
|
| - raise ValueError(
|
| - 'Can\'t process char at column %d for: %r' % (index, text),
|
| - index,
|
| - text)
|
| - elif char == '.':
|
| - if state == NEED_COMMA_OR_DOT:
|
| - # The string is incomplete, this mean the strace -s flag should be
|
| - # increased.
|
| - state = NEED_DOT_2
|
| - elif state == NEED_DOT_2:
|
| - state = NEED_DOT_3
|
| - elif state == NEED_DOT_3:
|
| - state = NEED_COMMA
|
| - elif state == INSIDE_STRING:
|
| - out[-1] += char
|
| - elif state == ESCAPED:
|
| - out[-1] += char
|
| - state = INSIDE_STRING
|
| - else:
|
| - raise ValueError(
|
| - 'Can\'t process char at column %d for: %r' % (index, text),
|
| - index,
|
| - text)
|
| - elif char == '\\':
|
| - if state == ESCAPED:
|
| - out[-1] += char
|
| - state = INSIDE_STRING
|
| - elif state == INSIDE_STRING:
|
| - state = ESCAPED
|
| - else:
|
| - raise ValueError(
|
| - 'Can\'t process char at column %d for: %r' % (index, text),
|
| - index,
|
| - text)
|
| - else:
|
| - if state == INSIDE_STRING:
|
| - out[-1] += char
|
| - else:
|
| - raise ValueError(
|
| - 'Can\'t process char at column %d for: %r' % (index, text),
|
| - index,
|
| - text)
|
| - if state not in (NEED_COMMA, NEED_COMMA_OR_DOT):
|
| - raise ValueError(
|
| - 'String is incorrectly terminated: %r' % text,
|
| - text)
|
| - return out
|
| -
|
| -
|
| -def read_json(filepath):
|
| - with open(filepath, 'r') as f:
|
| - return json.load(f)
|
| -
|
| -
|
| -def write_json(filepath_or_handle, data, dense):
|
| - """Writes data into filepath or file handle encoded as json.
|
| -
|
| - If dense is True, the json is packed. Otherwise, it is human readable.
|
| - """
|
| - if hasattr(filepath_or_handle, 'write'):
|
| - if dense:
|
| - filepath_or_handle.write(
|
| - json.dumps(data, sort_keys=True, separators=(',',':')))
|
| - else:
|
| - filepath_or_handle.write(json.dumps(data, sort_keys=True, indent=2))
|
| - else:
|
| - with open(filepath_or_handle, 'wb') as f:
|
| - if dense:
|
| - json.dump(data, f, sort_keys=True, separators=(',',':'))
|
| - else:
|
| - json.dump(data, f, sort_keys=True, indent=2)
|
| -
|
| -
|
| -class Results(object):
|
| - """Results of a trace session."""
|
| -
|
| - class _TouchedObject(object):
|
| - """Something, a file or a directory, that was accessed."""
|
| - def __init__(self, root, path, tainted, size, nb_files):
|
| - logging.debug(
|
| - '%s(%s, %s, %s, %s, %s)' %
|
| - (self.__class__.__name__, root, path, tainted, size, nb_files))
|
| - self.root = root
|
| - self.path = path
|
| - self.tainted = tainted
|
| - self.nb_files = nb_files
|
| - # Can be used as a cache or a default value, depending on context.
|
| - self._size = size
|
| - # These are cache only.
|
| - self._real_path = None
|
| -
|
| - # Check internal consistency.
|
| - assert path, path
|
| - assert tainted or bool(root) != bool(isabs(path)), (root, path)
|
| - assert tainted or (
|
| - not os.path.exists(self.full_path) or
|
| - (self.full_path == get_native_path_case(self.full_path))), (
|
| - tainted, self.full_path, get_native_path_case(self.full_path))
|
| -
|
| - @property
|
| - def existent(self):
|
| - return self.size != -1
|
| -
|
| - @property
|
| - def full_path(self):
|
| - if self.root:
|
| - return os.path.join(self.root, self.path)
|
| - return self.path
|
| -
|
| - @property
|
| - def real_path(self):
|
| - """Returns the path with symlinks resolved."""
|
| - if not self._real_path:
|
| - self._real_path = os.path.realpath(self.full_path)
|
| - return self._real_path
|
| -
|
| - @property
|
| - def size(self):
|
| - """File's size. -1 is not existent."""
|
| - if self._size is None and not self.tainted:
|
| - try:
|
| - self._size = os.stat(self.full_path).st_size
|
| - except OSError:
|
| - self._size = -1
|
| - return self._size
|
| -
|
| - def flatten(self):
|
| - """Returns a dict representing this object.
|
| -
|
| - A 'size' of 0 means the file was only touched and not read.
|
| - """
|
| - return {
|
| - 'path': self.path,
|
| - 'size': self.size,
|
| - }
|
| -
|
| - def replace_variables(self, variables):
|
| - """Replaces the root of this File with one of the variables if it matches.
|
| -
|
| - If a variable replacement occurs, the cloned object becomes tainted.
|
| - """
|
| - for variable, root_path in variables.iteritems():
|
| - if self.path.startswith(root_path):
|
| - return self._clone(
|
| - self.root, variable + self.path[len(root_path):], True)
|
| - # No need to clone, returns ourself.
|
| - return self
|
| -
|
| - def strip_root(self, root):
|
| - """Returns a clone of itself with 'root' stripped off."""
|
| - # Check internal consistency.
|
| - assert self.tainted or (isabs(root) and root.endswith(os.path.sep)), root
|
| - if not self.full_path.startswith(root):
|
| - # Now try to resolve the symlinks to see if it can be reached this way.
|
| - # Only try *after* trying without resolving symlink.
|
| - if not self.real_path.startswith(root):
|
| - return None
|
| - path = self.real_path
|
| - else:
|
| - path = self.full_path
|
| - return self._clone(root, path[len(root):], self.tainted)
|
| -
|
| - def _clone(self, new_root, new_path, tainted):
|
| - raise NotImplementedError(self.__class__.__name__)
|
| -
|
| - class File(_TouchedObject):
|
| - """A file that was accessed. May not be present anymore.
|
| -
|
| - If tainted is true, it means it is not a real path anymore as a variable
|
| - replacement occured.
|
| -
|
| - If touched_only is True, this means the file was probed for existence, and
|
| - it is existent, but was never _opened_. If touched_only is True, the file
|
| - must have existed.
|
| - """
|
| - def __init__(self, root, path, tainted, size):
|
| - super(Results.File, self).__init__(root, path, tainted, size, 1)
|
| -
|
| - def _clone(self, new_root, new_path, tainted):
|
| - """Clones itself keeping meta-data."""
|
| - # Keep the self.size and self._real_path caches for performance reason. It
|
| - # is also important when the file becomes tainted (with a variable instead
|
| - # of the real path) since self.path is not an on-disk path anymore so
|
| - # out._size cannot be updated.
|
| - out = self.__class__(new_root, new_path, tainted, self.size)
|
| - out._real_path = self._real_path
|
| - return out
|
| -
|
| - class Directory(_TouchedObject):
|
| - """A directory of files. Must exist."""
|
| - def __init__(self, root, path, tainted, size, nb_files):
|
| - """path='.' is a valid value and must be handled appropriately."""
|
| - assert not path.endswith(os.path.sep), path
|
| - super(Results.Directory, self).__init__(
|
| - root, path + os.path.sep, tainted, size, nb_files)
|
| - # For a Directory instance, self.size is not a cache, it's an actual value
|
| - # that is never modified and represents the total size of the files
|
| - # contained in this directory. It is possible that the directory is empty
|
| - # so that size == 0; this happens if there's only an invalid symlink in
|
| - # it.
|
| -
|
| - def flatten(self):
|
| - out = super(Results.Directory, self).flatten()
|
| - out['nb_files'] = self.nb_files
|
| - return out
|
| -
|
| - def _clone(self, new_root, new_path, tainted):
|
| - """Clones itself keeping meta-data."""
|
| - out = self.__class__(
|
| - new_root,
|
| - new_path.rstrip(os.path.sep),
|
| - tainted,
|
| - self.size,
|
| - self.nb_files)
|
| - out._real_path = self._real_path
|
| - return out
|
| -
|
| - class Process(object):
|
| - """A process that was traced.
|
| -
|
| - Contains references to the files accessed by this process and its children.
|
| - """
|
| - def __init__(self, pid, files, executable, command, initial_cwd, children):
|
| - logging.debug('Process(%s, %d, ...)' % (pid, len(files)))
|
| - self.pid = pid
|
| - self.files = sorted(files, key=lambda x: x.path)
|
| - self.children = children
|
| - self.executable = executable
|
| - self.command = command
|
| - self.initial_cwd = initial_cwd
|
| -
|
| - # Check internal consistency.
|
| - assert len(set(f.path for f in self.files)) == len(self.files), sorted(
|
| - f.path for f in self.files)
|
| - assert isinstance(self.children, list)
|
| - assert isinstance(self.files, list)
|
| -
|
| - @property
|
| - def all(self):
|
| - for child in self.children:
|
| - for i in child.all:
|
| - yield i
|
| - yield self
|
| -
|
| - def flatten(self):
|
| - return {
|
| - 'children': [c.flatten() for c in self.children],
|
| - 'command': self.command,
|
| - 'executable': self.executable,
|
| - 'files': [f.flatten() for f in self.files],
|
| - 'initial_cwd': self.initial_cwd,
|
| - 'pid': self.pid,
|
| - }
|
| -
|
| - def strip_root(self, root):
|
| - assert isabs(root) and root.endswith(os.path.sep), root
|
| - # Loads the files after since they are constructed as objects.
|
| - out = self.__class__(
|
| - self.pid,
|
| - filter(None, (f.strip_root(root) for f in self.files)),
|
| - self.executable,
|
| - self.command,
|
| - self.initial_cwd,
|
| - [c.strip_root(root) for c in self.children])
|
| - logging.debug(
|
| - 'strip_root(%s) %d -> %d' % (root, len(self.files), len(out.files)))
|
| - return out
|
| -
|
| - def __init__(self, process):
|
| - self.process = process
|
| - # Cache.
|
| - self._files = None
|
| -
|
| - def flatten(self):
|
| - return {
|
| - 'root': self.process.flatten(),
|
| - }
|
| -
|
| - @property
|
| - def files(self):
|
| - if self._files is None:
|
| - self._files = sorted(
|
| - sum((p.files for p in self.process.all), []),
|
| - key=lambda x: x.path)
|
| - return self._files
|
| -
|
| - @property
|
| - def existent(self):
|
| - return [f for f in self.files if f.existent]
|
| -
|
| - @property
|
| - def non_existent(self):
|
| - return [f for f in self.files if not f.existent]
|
| -
|
| - def strip_root(self, root):
|
| - """Returns a clone with all the files outside the directory |root| removed
|
| - and converts all the path to be relative paths.
|
| - """
|
| - # Resolve any symlink
|
| - root = os.path.realpath(root)
|
| - root = get_native_path_case(root).rstrip(os.path.sep) + os.path.sep
|
| - logging.debug('strip_root(%s)' % root)
|
| - return Results(self.process.strip_root(root))
|
| -
|
| -
|
| -class ApiBase(object):
|
| - """OS-agnostic API to trace a process and its children."""
|
| - class Context(object):
|
| - """Processes one log line at a time and keeps the list of traced processes.
|
| -
|
| - The parsing is complicated by the fact that logs are traced out of order for
|
| - strace but in-order for dtrace and logman. In addition, on Windows it is
|
| - very frequent that processids are reused so a flat list cannot be used. But
|
| - at the same time, it is impossible to faithfully construct a graph when the
|
| - logs are processed out of order. So both a tree and a flat mapping are used,
|
| - the tree is the real process tree, while the flat mapping stores the last
|
| - valid process for the corresponding processid. For the strace case, the
|
| - tree's head is guessed at the last moment.
|
| - """
|
| - class Process(object):
|
| - """Keeps context for one traced child process.
|
| -
|
| - Logs all the files this process touched. Ignores directories.
|
| - """
|
| - def __init__(self, blacklist, pid, initial_cwd):
|
| - # Check internal consistency.
|
| - assert isinstance(pid, int), repr(pid)
|
| - self.pid = pid
|
| - # children are Process instances.
|
| - self.children = []
|
| - self.initial_cwd = initial_cwd
|
| - self.cwd = None
|
| - self.files = set()
|
| - self.only_touched = set()
|
| - self.executable = None
|
| - self.command = None
|
| - self._blacklist = blacklist
|
| -
|
| - def to_results_process(self):
|
| - """Resolves file case sensitivity and or late-bound strings."""
|
| - # When resolving files, it's normal to get dupe because a file could be
|
| - # opened multiple times with different case. Resolve the deduplication
|
| - # here.
|
| - def fix_path(x):
|
| - """Returns the native file path case.
|
| -
|
| - Converts late-bound strings.
|
| - """
|
| - if not x:
|
| - # Do not convert None instance to 'None'.
|
| - return x
|
| - # TODO(maruel): Do not upconvert to unicode here, on linux we don't
|
| - # know the file path encoding so they must be treated as bytes.
|
| - x = unicode(x)
|
| - if os.path.isabs(x):
|
| - # If the path is not absolute, which tends to happen occasionally on
|
| - # Windows, it is not possible to get the native path case so ignore
|
| - # that trace. It mostly happens for 'executable' value.
|
| - x = get_native_path_case(x)
|
| - return x
|
| -
|
| - def fix_and_blacklist_path(x):
|
| - x = fix_path(x)
|
| - if not x:
|
| - return
|
| - # The blacklist needs to be reapplied, since path casing could
|
| - # influence blacklisting.
|
| - if self._blacklist(x):
|
| - return
|
| - return x
|
| -
|
| - # Filters out directories. Some may have passed through.
|
| - files = set(f for f in map(fix_and_blacklist_path, self.files) if f)
|
| - only_touched = set(
|
| - f for f in map(fix_and_blacklist_path, self.only_touched) if f)
|
| - only_touched -= files
|
| -
|
| - files = [
|
| - Results.File(None, f, False, None) for f in files
|
| - if not os.path.isdir(f)
|
| - ]
|
| - # Using 0 as size means the file's content is ignored since the file was
|
| - # never opened for I/O.
|
| - files.extend(
|
| - Results.File(None, f, False, 0) for f in only_touched
|
| - if not os.path.isdir(f)
|
| - )
|
| - return Results.Process(
|
| - self.pid,
|
| - files,
|
| - fix_path(self.executable),
|
| - self.command,
|
| - fix_path(self.initial_cwd),
|
| - [c.to_results_process() for c in self.children])
|
| -
|
| - def add_file(self, filepath, touch_only):
|
| - """Adds a file if it passes the blacklist."""
|
| - if self._blacklist(unicode(filepath)):
|
| - return
|
| - logging.debug('add_file(%d, %s, %s)' % (self.pid, filepath, touch_only))
|
| - # Note that filepath and not unicode(filepath) is added. It is because
|
| - # filepath could be something else than a string, like a RelativePath
|
| - # instance for dtrace logs.
|
| - if touch_only:
|
| - self.only_touched.add(filepath)
|
| - else:
|
| - self.files.add(filepath)
|
| -
|
| - def __init__(self, blacklist):
|
| - self.blacklist = blacklist
|
| - # Initial process.
|
| - self.root_process = None
|
| - # dict to accelerate process lookup, to not have to lookup the whole graph
|
| - # each time.
|
| - self._process_lookup = {}
|
| -
|
| - class Tracer(object):
|
| - """During it's lifetime, the tracing subsystem is enabled."""
|
| - def __init__(self, logname):
|
| - self._logname = logname
|
| - self._lock = threading.Lock()
|
| - self._traces = []
|
| - self._initialized = True
|
| -
|
| - def trace(self, cmd, cwd, tracename, output):
|
| - """Runs the OS-specific trace program on an executable.
|
| -
|
| - Arguments:
|
| - - cmd: The command (a list) to run.
|
| - - cwd: Current directory to start the child process in.
|
| - - tracename: Name of the trace in the logname file.
|
| - - output: If False, redirects output to PIPEs.
|
| -
|
| - Returns a tuple (resultcode, output) and updates the internal trace
|
| - entries.
|
| - """
|
| - # The implementation adds an item to self._traces.
|
| - raise NotImplementedError(self.__class__.__name__)
|
| -
|
| - def close(self, _timeout=None):
|
| - """Saves the meta-data in the logname file.
|
| -
|
| - For kernel-based tracing, stops the tracing subsystem.
|
| -
|
| - Must not be used manually when using 'with' construct.
|
| - """
|
| - with self._lock:
|
| - assert self._initialized
|
| - try:
|
| - data = {
|
| - 'traces': self._traces,
|
| - }
|
| - write_json(self._logname, data, False)
|
| - finally:
|
| - self._initialized = False
|
| -
|
| - def post_process_log(self):
|
| - """Post-processes the log so it becomes faster to load afterward.
|
| -
|
| - Must not be used manually when using 'with' construct.
|
| - """
|
| - assert not self._initialized, 'Must stop tracing first.'
|
| -
|
| - def __enter__(self):
|
| - """Enables 'with' statement."""
|
| - return self
|
| -
|
| - def __exit__(self, exc_type, exc_value, traceback):
|
| - """Enables 'with' statement."""
|
| - self.close()
|
| - # If an exception was thrown, do not process logs.
|
| - if not exc_type:
|
| - self.post_process_log()
|
| -
|
| - def get_tracer(self, logname):
|
| - """Returns an ApiBase.Tracer instance.
|
| -
|
| - Initializes the tracing subsystem, which is a requirement for kernel-based
|
| - tracers. Only one tracer instance should be live at a time!
|
| -
|
| - logname is the filepath to the json file that will contain the meta-data
|
| - about the logs.
|
| - """
|
| - return self.Tracer(logname)
|
| -
|
| - @staticmethod
|
| - def clean_trace(logname):
|
| - """Deletes an old log."""
|
| - raise NotImplementedError()
|
| -
|
| - @classmethod
|
| - def parse_log(cls, logname, blacklist):
|
| - """Processes trace logs and returns the files opened and the files that do
|
| - not exist.
|
| -
|
| - It does not track directories.
|
| -
|
| - Most of the time, files that do not exist are temporary test files that
|
| - should be put in /tmp instead. See http://crbug.com/116251.
|
| -
|
| - Returns a list of dict with keys:
|
| - - results: A Results instance.
|
| - - trace: The corresponding tracename parameter provided to
|
| - get_tracer().trace().
|
| - - output: Output gathered during execution, if get_tracer().trace(...,
|
| - output=False) was used.
|
| - """
|
| - raise NotImplementedError(cls.__class__.__name__)
|
| -
|
| -
|
| -class Strace(ApiBase):
|
| - """strace implies linux."""
|
| - class Context(ApiBase.Context):
|
| - """Processes a strace log line and keeps the list of existent and non
|
| - existent files accessed.
|
| -
|
| - Ignores directories.
|
| -
|
| - Uses late-binding to processes the cwd of each process. The problem is that
|
| - strace generates one log file per process it traced but doesn't give any
|
| - information about which process was started when and by who. So we don't
|
| - even know which process is the initial one. So process the logs out of
|
| - order and use late binding with RelativePath to be able to deduce the
|
| - initial directory of each process once all the logs are parsed.
|
| - """
|
| - class Process(ApiBase.Context.Process):
|
| - """Represents the state of a process.
|
| -
|
| - Contains all the information retrieved from the pid-specific log.
|
| - """
|
| - # Function names are using ([a-z_0-9]+)
|
| - # This is the most common format. function(args) = result
|
| - RE_HEADER = re.compile(r'^([a-z_0-9]+)\((.+?)\)\s+= (.+)$')
|
| - # An interrupted function call, only grab the minimal header.
|
| - RE_UNFINISHED = re.compile(r'^([^\(]+)(.*) \<unfinished \.\.\.\>$')
|
| - # A resumed function call.
|
| - RE_RESUMED = re.compile(r'^<\.\.\. ([^ ]+) resumed> (.+)$')
|
| - # A process received a signal.
|
| - RE_SIGNAL = re.compile(r'^--- SIG[A-Z]+ .+ ---')
|
| - # A process didn't handle a signal. Ignore any junk appearing before,
|
| - # because the process was forcibly killed so it won't open any new file.
|
| - RE_KILLED = re.compile(
|
| - r'^.*\+\+\+ killed by ([A-Z]+)( \(core dumped\))? \+\+\+$')
|
| - # The process has exited.
|
| - RE_PROCESS_EXITED = re.compile(r'^\+\+\+ exited with (\d+) \+\+\+')
|
| - # A call was canceled. Ignore any prefix.
|
| - RE_UNAVAILABLE = re.compile(r'^.*\)\s*= \? <unavailable>$')
|
| - # Happens when strace fails to even get the function name.
|
| - UNNAMED_FUNCTION = '????'
|
| -
|
| - # Corner-case in python, a class member function decorator must not be
|
| - # @staticmethod.
|
| - def parse_args(regexp, expect_zero): # pylint: disable=E0213
|
| - """Automatically convert the str 'args' into a list of processed
|
| - arguments.
|
| -
|
| - Arguments:
|
| - - regexp is used to parse args.
|
| - - expect_zero: one of True, False or None.
|
| - - True: will check for result.startswith('0') first and will ignore
|
| - the trace line completely otherwise. This is important because for
|
| - many functions, the regexp will not process if the call failed.
|
| - - False: will check for not result.startswith(('?', '-1')) for the
|
| - same reason than with True.
|
| - - None: ignore result.
|
| - """
|
| - def meta_hook(function):
|
| - assert function.__name__.startswith('handle_')
|
| - def hook(self, args, result):
|
| - if expect_zero is True and not result.startswith('0'):
|
| - return
|
| - if expect_zero is False and result.startswith(('?', '-1')):
|
| - return
|
| - match = re.match(regexp, args)
|
| - if not match:
|
| - raise TracingFailure(
|
| - 'Failed to parse %s(%s) = %s' %
|
| - (function.__name__[len('handle_'):], args, result),
|
| - None, None, None)
|
| - return function(self, match.groups(), result)
|
| - return hook
|
| - return meta_hook
|
| -
|
| - class RelativePath(object):
|
| - """A late-bound relative path."""
|
| - def __init__(self, parent, value):
|
| - self.parent = parent
|
| - self.value = value
|
| -
|
| - def render(self):
|
| - """Returns the current directory this instance is representing.
|
| -
|
| - This function is used to return the late-bound value.
|
| - """
|
| - if self.value and self.value.startswith(u'/'):
|
| - # An absolute path.
|
| - return self.value
|
| - parent = self.parent.render() if self.parent else u'<None>'
|
| - if self.value:
|
| - return os.path.normpath(os.path.join(parent, self.value))
|
| - return parent
|
| -
|
| - def __unicode__(self):
|
| - """Acts as a string whenever needed."""
|
| - return unicode(self.render())
|
| -
|
| - def __str__(self):
|
| - """Acts as a string whenever needed."""
|
| - return str(self.render())
|
| -
|
| - def __init__(self, root, pid):
|
| - """Keeps enough information to be able to guess the original process
|
| - root.
|
| -
|
| - strace doesn't store which process was the initial process. So more
|
| - information needs to be kept so the graph can be reconstructed from the
|
| - flat map.
|
| - """
|
| - logging.info('%s(%d)' % (self.__class__.__name__, pid))
|
| - super(Strace.Context.Process, self).__init__(root.blacklist, pid, None)
|
| - assert isinstance(root, ApiBase.Context)
|
| - self._root = weakref.ref(root)
|
| - # The dict key is the function name of the pending call, like 'open'
|
| - # or 'execve'.
|
| - self._pending_calls = {}
|
| - self._line_number = 0
|
| - # Current directory when the process started.
|
| - self.initial_cwd = self.RelativePath(self._root(), None)
|
| - self.parentid = None
|
| -
|
| - def get_cwd(self):
|
| - """Returns the best known value of cwd."""
|
| - return self.cwd or self.initial_cwd
|
| -
|
| - def render(self):
|
| - """Returns the string value of the RelativePath() object.
|
| -
|
| - Used by RelativePath. Returns the initial directory and not the
|
| - current one since the current directory 'cwd' validity is time-limited.
|
| -
|
| - The validity is only guaranteed once all the logs are processed.
|
| - """
|
| - return self.initial_cwd.render()
|
| -
|
| - def on_line(self, line):
|
| - self._line_number += 1
|
| - if self.RE_SIGNAL.match(line):
|
| - # Ignore signals.
|
| - return
|
| -
|
| - try:
|
| - match = self.RE_KILLED.match(line)
|
| - if match:
|
| - # Converts a '+++ killed by Foo +++' trace into an exit_group().
|
| - self.handle_exit_group(match.group(1), None)
|
| - return
|
| -
|
| - match = self.RE_PROCESS_EXITED.match(line)
|
| - if match:
|
| - # Converts a '+++ exited with 1 +++' trace into an exit_group()
|
| - self.handle_exit_group(match.group(1), None)
|
| - return
|
| -
|
| - match = self.RE_UNFINISHED.match(line)
|
| - if match:
|
| - if match.group(1) in self._pending_calls:
|
| - raise TracingFailure(
|
| - 'Found two unfinished calls for the same function',
|
| - None, None, None,
|
| - self._pending_calls)
|
| - self._pending_calls[match.group(1)] = (
|
| - match.group(1) + match.group(2))
|
| - return
|
| -
|
| - match = self.RE_UNAVAILABLE.match(line)
|
| - if match:
|
| - # This usually means a process was killed and a pending call was
|
| - # canceled.
|
| - # TODO(maruel): Look up the last exit_group() trace just above and
|
| - # make sure any self._pending_calls[anything] is properly flushed.
|
| - return
|
| -
|
| - match = self.RE_RESUMED.match(line)
|
| - if match:
|
| - if match.group(1) not in self._pending_calls:
|
| - raise TracingFailure(
|
| - 'Found a resumed call that was not logged as unfinished',
|
| - None, None, None,
|
| - self._pending_calls)
|
| - pending = self._pending_calls.pop(match.group(1))
|
| - # Reconstruct the line.
|
| - line = pending + match.group(2)
|
| -
|
| - match = self.RE_HEADER.match(line)
|
| - if not match:
|
| - raise TracingFailure(
|
| - 'Found an invalid line: %s' % line,
|
| - None, None, None)
|
| - if match.group(1) == self.UNNAMED_FUNCTION:
|
| - return
|
| -
|
| - # It's a valid line, handle it.
|
| - handler = getattr(self, 'handle_%s' % match.group(1), None)
|
| - if not handler:
|
| - self._handle_unknown(match.group(1), match.group(2), match.group(3))
|
| - return handler(match.group(2), match.group(3))
|
| - except TracingFailure, e:
|
| - # Hack in the values since the handler could be a static function.
|
| - e.pid = self.pid
|
| - e.line = line
|
| - e.line_number = self._line_number
|
| - # Re-raise the modified exception.
|
| - raise
|
| - except (KeyError, NotImplementedError, ValueError), e:
|
| - raise TracingFailure(
|
| - 'Trace generated a %s exception: %s' % (
|
| - e.__class__.__name__, str(e)),
|
| - self.pid,
|
| - self._line_number,
|
| - line,
|
| - e)
|
| -
|
| - @parse_args(r'^\"(.+?)\", [FKORWX_|]+$', True)
|
| - def handle_access(self, args, _result):
|
| - self._handle_file(args[0], True)
|
| -
|
| - @parse_args(r'^\"(.+?)\"$', True)
|
| - def handle_chdir(self, args, _result):
|
| - """Updates cwd."""
|
| - self.cwd = self.RelativePath(self, args[0])
|
| - logging.debug('handle_chdir(%d, %s)' % (self.pid, self.cwd))
|
| -
|
| - def handle_clone(self, _args, result):
|
| - """Transfers cwd."""
|
| - if result.startswith(('?', '-1')):
|
| - # The call failed.
|
| - return
|
| - # Update the other process right away.
|
| - childpid = int(result)
|
| - child = self._root().get_or_set_proc(childpid)
|
| - if child.parentid is not None or childpid in self.children:
|
| - raise TracingFailure(
|
| - 'Found internal inconsitency in process lifetime detection '
|
| - 'during a clone() call',
|
| - None, None, None)
|
| -
|
| - # Copy the cwd object.
|
| - child.initial_cwd = self.get_cwd()
|
| - child.parentid = self.pid
|
| - # It is necessary because the logs are processed out of order.
|
| - self.children.append(child)
|
| -
|
| - def handle_close(self, _args, _result):
|
| - pass
|
| -
|
| - def handle_chmod(self, _args, _result):
|
| - pass
|
| -
|
| - def handle_creat(self, _args, _result):
|
| - # Ignore files created, since they didn't need to exist.
|
| - pass
|
| -
|
| - @parse_args(r'^\"(.+?)\", \[(.+)\], \[\/\* \d+ vars? \*\/\]$', True)
|
| - def handle_execve(self, args, _result):
|
| - # Even if in practice execve() doesn't returns when it succeeds, strace
|
| - # still prints '0' as the result.
|
| - filepath = args[0]
|
| - self._handle_file(filepath, False)
|
| - self.executable = self.RelativePath(self.get_cwd(), filepath)
|
| - self.command = strace_process_quoted_arguments(args[1])
|
| -
|
| - def handle_exit_group(self, _args, _result):
|
| - """Removes cwd."""
|
| - self.cwd = None
|
| -
|
| - def handle_fork(self, args, result):
|
| - self._handle_unknown('fork', args, result)
|
| -
|
| - def handle_getcwd(self, _args, _result):
|
| - pass
|
| -
|
| - @parse_args(r'^\"(.+?)\", \"(.+?)\"$', True)
|
| - def handle_link(self, args, _result):
|
| - self._handle_file(args[0], False)
|
| - self._handle_file(args[1], False)
|
| -
|
| - @parse_args(r'\"(.+?)\", \{.+?, \.\.\.\}', True)
|
| - def handle_lstat(self, args, _result):
|
| - self._handle_file(args[0], True)
|
| -
|
| - def handle_mkdir(self, _args, _result):
|
| - pass
|
| -
|
| - @parse_args(r'^\"(.*?)\", ([A-Z\_\|]+)(|, \d+)$', False)
|
| - def handle_open(self, args, _result):
|
| - if 'O_DIRECTORY' in args[1]:
|
| - return
|
| - self._handle_file(args[0], False)
|
| -
|
| - @parse_args(r'^(\d+|AT_FDCWD), \"(.*?)\", ([A-Z\_\|]+)(|, \d+)$', False)
|
| - def handle_openat(self, args, _result):
|
| - if 'O_DIRECTORY' in args[2]:
|
| - return
|
| - if args[1] == 'AT_FDCWD':
|
| - self._handle_file(args[1], False)
|
| - else:
|
| - # TODO(maruel): Implement relative open if necessary instead of the
|
| - # AT_FDCWD flag, let's hope not since this means tracking all active
|
| - # directory handles.
|
| - raise Exception('Relative open via openat not implemented.')
|
| -
|
| - @parse_args(r'^\"(.+?)\", \".+?\"(\.\.\.)?, \d+$', False)
|
| - def handle_readlink(self, args, _result):
|
| - self._handle_file(args[0], False)
|
| -
|
| - @parse_args(r'^\"(.+?)\", \"(.+?)\"$', True)
|
| - def handle_rename(self, args, _result):
|
| - self._handle_file(args[0], False)
|
| - self._handle_file(args[1], False)
|
| -
|
| - def handle_rmdir(self, _args, _result):
|
| - pass
|
| -
|
| - def handle_setxattr(self, _args, _result):
|
| - pass
|
| -
|
| - @parse_args(r'\"(.+?)\", \{.+?, \.\.\.\}', True)
|
| - def handle_stat(self, args, _result):
|
| - self._handle_file(args[0], True)
|
| -
|
| - def handle_symlink(self, _args, _result):
|
| - pass
|
| -
|
| - def handle_unlink(self, _args, _result):
|
| - # In theory, the file had to be created anyway.
|
| - pass
|
| -
|
| - def handle_statfs(self, _args, _result):
|
| - pass
|
| -
|
| - def handle_vfork(self, args, result):
|
| - self._handle_unknown('vfork', args, result)
|
| -
|
| - @staticmethod
|
| - def _handle_unknown(function, args, result):
|
| - raise TracingFailure(
|
| - 'Unexpected/unimplemented trace %s(%s)= %s' %
|
| - (function, args, result),
|
| - None, None, None)
|
| -
|
| - def _handle_file(self, filepath, touch_only):
|
| - filepath = self.RelativePath(self.get_cwd(), filepath)
|
| - #assert not touch_only, unicode(filepath)
|
| - self.add_file(filepath, touch_only)
|
| -
|
| - def __init__(self, blacklist, initial_cwd):
|
| - super(Strace.Context, self).__init__(blacklist)
|
| - self.initial_cwd = initial_cwd
|
| -
|
| - def render(self):
|
| - """Returns the string value of the initial cwd of the root process.
|
| -
|
| - Used by RelativePath.
|
| - """
|
| - return self.initial_cwd
|
| -
|
| - def on_line(self, pid, line):
|
| - """Transfers control into the Process.on_line() function."""
|
| - self.get_or_set_proc(pid).on_line(line.strip())
|
| -
|
| - def to_results(self):
|
| - """Finds back the root process and verify consistency."""
|
| - # TODO(maruel): Absolutely unecessary, fix me.
|
| - root = [p for p in self._process_lookup.itervalues() if not p.parentid]
|
| - if len(root) != 1:
|
| - raise TracingFailure(
|
| - 'Found internal inconsitency in process lifetime detection '
|
| - 'while finding the root process',
|
| - None,
|
| - None,
|
| - None,
|
| - sorted(p.pid for p in root))
|
| - self.root_process = root[0]
|
| - process = self.root_process.to_results_process()
|
| - if sorted(self._process_lookup) != sorted(p.pid for p in process.all):
|
| - raise TracingFailure(
|
| - 'Found internal inconsitency in process lifetime detection '
|
| - 'while looking for len(tree) == len(list)',
|
| - None,
|
| - None,
|
| - None,
|
| - sorted(self._process_lookup),
|
| - sorted(p.pid for p in process.all))
|
| - return Results(process)
|
| -
|
| - def get_or_set_proc(self, pid):
|
| - """Returns the Context.Process instance for this pid or creates a new one.
|
| - """
|
| - if not pid or not isinstance(pid, int):
|
| - raise TracingFailure(
|
| - 'Unpexpected value for pid: %r' % pid,
|
| - pid,
|
| - None,
|
| - None,
|
| - pid)
|
| - if pid not in self._process_lookup:
|
| - self._process_lookup[pid] = self.Process(self, pid)
|
| - return self._process_lookup[pid]
|
| -
|
| - @classmethod
|
| - def traces(cls):
|
| - """Returns the list of all handled traces to pass this as an argument to
|
| - strace.
|
| - """
|
| - prefix = 'handle_'
|
| - return [i[len(prefix):] for i in dir(cls.Process) if i.startswith(prefix)]
|
| -
|
| - class Tracer(ApiBase.Tracer):
|
| - MAX_LEN = 256
|
| -
|
| - def trace(self, cmd, cwd, tracename, output):
|
| - """Runs strace on an executable."""
|
| - logging.info('trace(%s, %s, %s, %s)' % (cmd, cwd, tracename, output))
|
| - assert os.path.isabs(cmd[0]), cmd[0]
|
| - assert os.path.isabs(cwd), cwd
|
| - assert os.path.normpath(cwd) == cwd, cwd
|
| - with self._lock:
|
| - if not self._initialized:
|
| - raise TracingFailure(
|
| - 'Called Tracer.trace() on an unitialized object',
|
| - None, None, None, tracename)
|
| - assert tracename not in (i['trace'] for i in self._traces)
|
| - stdout = stderr = None
|
| - if output:
|
| - stdout = subprocess.PIPE
|
| - stderr = subprocess.STDOUT
|
| - # Ensure all file related APIs are hooked.
|
| - traces = ','.join(Strace.Context.traces() + ['file'])
|
| - trace_cmd = [
|
| - 'strace',
|
| - '-ff',
|
| - '-s', '%d' % self.MAX_LEN,
|
| - '-e', 'trace=%s' % traces,
|
| - '-o', self._logname + '.' + tracename,
|
| - ]
|
| - child = subprocess.Popen(
|
| - trace_cmd + cmd,
|
| - cwd=cwd,
|
| - stdin=subprocess.PIPE,
|
| - stdout=stdout,
|
| - stderr=stderr)
|
| - out = child.communicate()[0]
|
| - # TODO(maruel): Walk the logs and figure out the root process would
|
| - # simplify parsing the logs a *lot*.
|
| - with self._lock:
|
| - assert tracename not in (i['trace'] for i in self._traces)
|
| - self._traces.append(
|
| - {
|
| - 'cmd': cmd,
|
| - 'cwd': cwd,
|
| - # The pid of strace process, not very useful.
|
| - 'pid': child.pid,
|
| - 'trace': tracename,
|
| - 'output': out,
|
| - })
|
| - return child.returncode, out
|
| -
|
| - @staticmethod
|
| - def clean_trace(logname):
|
| - if os.path.isfile(logname):
|
| - os.remove(logname)
|
| - # Also delete any pid specific file from previous traces.
|
| - for i in glob.iglob(logname + '.*'):
|
| - if i.rsplit('.', 1)[1].isdigit():
|
| - os.remove(i)
|
| -
|
| - @classmethod
|
| - def parse_log(cls, logname, blacklist):
|
| - logging.info('parse_log(%s, %s)' % (logname, blacklist))
|
| - data = read_json(logname)
|
| - out = []
|
| - for item in data['traces']:
|
| - result = {
|
| - 'trace': item['trace'],
|
| - 'output': item['output'],
|
| - }
|
| - try:
|
| - context = cls.Context(blacklist, item['cwd'])
|
| - for pidfile in glob.iglob('%s.%s.*' % (logname, item['trace'])):
|
| - pid = pidfile.rsplit('.', 1)[1]
|
| - if pid.isdigit():
|
| - pid = int(pid)
|
| - # TODO(maruel): Load as utf-8
|
| - for line in open(pidfile, 'rb'):
|
| - context.on_line(pid, line)
|
| - result['results'] = context.to_results()
|
| - except TracingFailure, e:
|
| - result['exception'] = e
|
| - out.append(result)
|
| - return out
|
| -
|
| -
|
| -class Dtrace(ApiBase):
|
| - """Uses DTrace framework through dtrace. Requires root access.
|
| -
|
| - Implies Mac OSX.
|
| -
|
| - dtruss can't be used because it has compatibility issues with python.
|
| -
|
| - Also, the pid->cwd handling needs to be done manually since OSX has no way to
|
| - get the absolute path of the 'cwd' dtrace variable from the probe.
|
| -
|
| - Also, OSX doesn't populate curpsinfo->pr_psargs properly, see
|
| - https://discussions.apple.com/thread/1980539. So resort to handling execve()
|
| - manually.
|
| -
|
| - errno is not printed in the log since this implementation currently only cares
|
| - about files that were successfully opened.
|
| - """
|
| - class Context(ApiBase.Context):
|
| - # Format: index pid function(args)
|
| - RE_HEADER = re.compile(r'^\d+ (\d+) ([a-zA-Z_\-]+)\((.*?)\)$')
|
| -
|
| - # Arguments parsing.
|
| - RE_DTRACE_BEGIN = re.compile(r'^\"(.+?)\"$')
|
| - RE_CHDIR = re.compile(r'^\"(.+?)\"$')
|
| - RE_EXECVE = re.compile(r'^\"(.+?)\", \[(\d+), (.+)\]$')
|
| - RE_OPEN = re.compile(r'^\"(.+?)\", (0x[0-9a-z]+), (0x[0-9a-z]+)$')
|
| - RE_PROC_START = re.compile(r'^(\d+), \"(.+?)\", (\d+)$')
|
| - RE_RENAME = re.compile(r'^\"(.+?)\", \"(.+?)\"$')
|
| -
|
| - O_DIRECTORY = 0x100000
|
| -
|
| - class Process(ApiBase.Context.Process):
|
| - def __init__(self, *args):
|
| - super(Dtrace.Context.Process, self).__init__(*args)
|
| - self.cwd = self.initial_cwd
|
| -
|
| - def __init__(self, blacklist, tracer_pid, initial_cwd):
|
| - logging.info(
|
| - '%s(%d, %s)' % (self.__class__.__name__, tracer_pid, initial_cwd))
|
| - super(Dtrace.Context, self).__init__(blacklist)
|
| - # Process ID of the temporary script created by create_thunk().
|
| - self._tracer_pid = tracer_pid
|
| - self._initial_cwd = initial_cwd
|
| - self._line_number = 0
|
| -
|
| - def on_line(self, line):
|
| - self._line_number += 1
|
| - match = self.RE_HEADER.match(line)
|
| - if not match:
|
| - raise TracingFailure(
|
| - 'Found malformed line: %s' % line,
|
| - None,
|
| - self._line_number,
|
| - line)
|
| - fn = getattr(
|
| - self,
|
| - 'handle_%s' % match.group(2).replace('-', '_'),
|
| - self._handle_ignored)
|
| - # It is guaranteed to succeed because of the regexp. Or at least I thought
|
| - # it would.
|
| - pid = int(match.group(1))
|
| - try:
|
| - return fn(pid, match.group(3))
|
| - except TracingFailure, e:
|
| - # Hack in the values since the handler could be a static function.
|
| - e.pid = pid
|
| - e.line = line
|
| - e.line_number = self._line_number
|
| - # Re-raise the modified exception.
|
| - raise
|
| - except (KeyError, NotImplementedError, ValueError), e:
|
| - raise TracingFailure(
|
| - 'Trace generated a %s exception: %s' % (
|
| - e.__class__.__name__, str(e)),
|
| - pid,
|
| - self._line_number,
|
| - line,
|
| - e)
|
| -
|
| - def to_results(self):
|
| - process = self.root_process.to_results_process()
|
| - # Internal concistency check.
|
| - if sorted(self._process_lookup) != sorted(p.pid for p in process.all):
|
| - raise TracingFailure(
|
| - 'Found internal inconsitency in process lifetime detection '
|
| - 'while looking for len(tree) == len(list)',
|
| - None,
|
| - None,
|
| - None,
|
| - sorted(self._process_lookup),
|
| - sorted(p.pid for p in process.all))
|
| - return Results(process)
|
| -
|
| - def handle_dtrace_BEGIN(self, _pid, args):
|
| - if not self.RE_DTRACE_BEGIN.match(args):
|
| - raise TracingFailure(
|
| - 'Found internal inconsitency in dtrace_BEGIN log line',
|
| - None, None, None)
|
| -
|
| - def handle_proc_start(self, pid, args):
|
| - """Transfers cwd.
|
| -
|
| - The dtrace script already takes care of only tracing the processes that
|
| - are child of the traced processes so there is no need to verify the
|
| - process hierarchy.
|
| - """
|
| - if pid in self._process_lookup:
|
| - raise TracingFailure(
|
| - 'Found internal inconsitency in proc_start: %d started two times' %
|
| - pid,
|
| - None, None, None)
|
| - match = self.RE_PROC_START.match(args)
|
| - if not match:
|
| - raise TracingFailure(
|
| - 'Failed to parse arguments: %s' % args,
|
| - None, None, None)
|
| - ppid = int(match.group(1))
|
| - if ppid == self._tracer_pid and not self.root_process:
|
| - proc = self.root_process = self.Process(
|
| - self.blacklist, pid, self._initial_cwd)
|
| - elif ppid in self._process_lookup:
|
| - proc = self.Process(self.blacklist, pid, self._process_lookup[ppid].cwd)
|
| - self._process_lookup[ppid].children.append(proc)
|
| - else:
|
| - # Another process tree, ignore.
|
| - return
|
| - self._process_lookup[pid] = proc
|
| - logging.debug(
|
| - 'New child: %s -> %d cwd:%s' %
|
| - (ppid, pid, unicode(proc.initial_cwd)))
|
| -
|
| - def handle_proc_exit(self, pid, _args):
|
| - """Removes cwd."""
|
| - if pid in self._process_lookup:
|
| - # self._tracer_pid is not traced itself and other traces run neither.
|
| - self._process_lookup[pid].cwd = None
|
| -
|
| - def handle_execve(self, pid, args):
|
| - """Sets the process' executable.
|
| -
|
| - TODO(maruel): Read command line arguments. See
|
| - https://discussions.apple.com/thread/1980539 for an example.
|
| - https://gist.github.com/1242279
|
| -
|
| - Will have to put the answer at http://stackoverflow.com/questions/7556249.
|
| - :)
|
| - """
|
| - if not pid in self._process_lookup:
|
| - # Another process tree, ignore.
|
| - return
|
| - match = self.RE_EXECVE.match(args)
|
| - if not match:
|
| - raise TracingFailure(
|
| - 'Failed to parse arguments: %r' % args,
|
| - None, None, None)
|
| - proc = self._process_lookup[pid]
|
| - proc.executable = match.group(1)
|
| - proc.command = self.process_escaped_arguments(match.group(3))
|
| - if int(match.group(2)) != len(proc.command):
|
| - raise TracingFailure(
|
| - 'Failed to parse execve() arguments: %s' % args,
|
| - None, None, None)
|
| -
|
| - def handle_chdir(self, pid, args):
|
| - """Updates cwd."""
|
| - if pid not in self._process_lookup:
|
| - # Another process tree, ignore.
|
| - return
|
| - cwd = self.RE_CHDIR.match(args).group(1)
|
| - if not cwd.startswith('/'):
|
| - cwd2 = os.path.join(self._process_lookup[pid].cwd, cwd)
|
| - logging.debug('handle_chdir(%d, %s) -> %s' % (pid, cwd, cwd2))
|
| - else:
|
| - logging.debug('handle_chdir(%d, %s)' % (pid, cwd))
|
| - cwd2 = cwd
|
| - self._process_lookup[pid].cwd = cwd2
|
| -
|
| - def handle_open_nocancel(self, pid, args):
|
| - """Redirects to handle_open()."""
|
| - return self.handle_open(pid, args)
|
| -
|
| - def handle_open(self, pid, args):
|
| - if pid not in self._process_lookup:
|
| - # Another process tree, ignore.
|
| - return
|
| - match = self.RE_OPEN.match(args)
|
| - if not match:
|
| - raise TracingFailure(
|
| - 'Failed to parse arguments: %s' % args,
|
| - None, None, None)
|
| - flag = int(match.group(2), 16)
|
| - if self.O_DIRECTORY & flag == self.O_DIRECTORY:
|
| - # Ignore directories.
|
| - return
|
| - self._handle_file(pid, match.group(1))
|
| -
|
| - def handle_rename(self, pid, args):
|
| - if pid not in self._process_lookup:
|
| - # Another process tree, ignore.
|
| - return
|
| - match = self.RE_RENAME.match(args)
|
| - if not match:
|
| - raise TracingFailure(
|
| - 'Failed to parse arguments: %s' % args,
|
| - None, None, None)
|
| - self._handle_file(pid, match.group(1))
|
| - self._handle_file(pid, match.group(2))
|
| -
|
| - def _handle_file(self, pid, filepath):
|
| - if not filepath.startswith('/'):
|
| - filepath = os.path.join(self._process_lookup[pid].cwd, filepath)
|
| - # We can get '..' in the path.
|
| - filepath = os.path.normpath(filepath)
|
| - # Sadly, still need to filter out directories here;
|
| - # saw open_nocancel(".", 0, 0) = 0 lines.
|
| - if os.path.isdir(filepath):
|
| - return
|
| - self._process_lookup[pid].add_file(filepath, False)
|
| -
|
| - def handle_ftruncate(self, pid, args):
|
| - """Just used as a signal to kill dtrace, ignoring."""
|
| - pass
|
| -
|
| - @staticmethod
|
| - def _handle_ignored(pid, args):
|
| - """Is called for all the event traces that are not handled."""
|
| - raise NotImplementedError('Please implement me')
|
| -
|
| - @staticmethod
|
| - def process_escaped_arguments(text):
|
| - """Extracts escaped arguments on a string and return the arguments as a
|
| - list.
|
| -
|
| - Implemented as an automaton.
|
| -
|
| - Example:
|
| - With text = '\\001python2.7\\001-c\\001print(\\"hi\\")\\0', the
|
| - function will return ['python2.7', '-c', 'print("hi")]
|
| - """
|
| - if not text.endswith('\\0'):
|
| - raise ValueError('String is not null terminated: %r' % text, text)
|
| - text = text[:-2]
|
| -
|
| - def unescape(x):
|
| - """Replaces '\\' with '\' and '\?' (where ? is anything) with ?."""
|
| - out = []
|
| - escaped = False
|
| - for i in x:
|
| - if i == '\\' and not escaped:
|
| - escaped = True
|
| - continue
|
| - escaped = False
|
| - out.append(i)
|
| - return ''.join(out)
|
| -
|
| - return [unescape(i) for i in text.split('\\001')]
|
| -
|
| - class Tracer(ApiBase.Tracer):
|
| - # pylint: disable=C0301
|
| - #
|
| - # To understand the following code, you'll want to take a look at:
|
| - # http://developers.sun.com/solaris/articles/dtrace_quickref/dtrace_quickref.html
|
| - # https://wikis.oracle.com/display/DTrace/Variables
|
| - # http://docs.oracle.com/cd/E19205-01/820-4221/
|
| - #
|
| - # 0. Dump all the valid probes into a text file. It is important, you
|
| - # want to redirect into a file and you don't want to constantly 'sudo'.
|
| - # $ sudo dtrace -l > probes.txt
|
| - #
|
| - # 1. Count the number of probes:
|
| - # $ wc -l probes.txt
|
| - # 81823 # On OSX 10.7, including 1 header line.
|
| - #
|
| - # 2. List providers, intentionally skipping all the 'syspolicy10925' and the
|
| - # likes and skipping the header with NR>1:
|
| - # $ awk 'NR>1 { print $2 }' probes.txt | sort | uniq | grep -v '[[:digit:]]'
|
| - # dtrace
|
| - # fbt
|
| - # io
|
| - # ip
|
| - # lockstat
|
| - # mach_trap
|
| - # proc
|
| - # profile
|
| - # sched
|
| - # syscall
|
| - # tcp
|
| - # vminfo
|
| - #
|
| - # 3. List of valid probes:
|
| - # $ grep syscall probes.txt | less
|
| - # or use dtrace directly:
|
| - # $ sudo dtrace -l -P syscall | less
|
| - #
|
| - # trackedpid is an associative array where its value can be 0, 1 or 2.
|
| - # 0 is for untracked processes and is the default value for items not
|
| - # in the associative array.
|
| - # 1 is for tracked processes.
|
| - # 2 is for the script created by create_thunk() only. It is not tracked
|
| - # itself but all its decendants are.
|
| - #
|
| - # The script will kill itself only once waiting_to_die == 1 and
|
| - # current_processes == 0, so that both getlogin() was called and that
|
| - # all traced processes exited.
|
| - #
|
| - # TODO(maruel): Use cacheable predicates. See
|
| - # https://wikis.oracle.com/display/DTrace/Performance+Considerations
|
| - D_CODE = """
|
| - dtrace:::BEGIN {
|
| - waiting_to_die = 0;
|
| - current_processes = 0;
|
| - logindex = 0;
|
| - printf("%d %d %s_%s(\\"%s\\")\\n",
|
| - logindex, PID, probeprov, probename, SCRIPT);
|
| - logindex++;
|
| - }
|
| -
|
| - proc:::start /trackedpid[ppid]/ {
|
| - trackedpid[pid] = 1;
|
| - current_processes += 1;
|
| - printf("%d %d %s_%s(%d, \\"%s\\", %d)\\n",
|
| - logindex, pid, probeprov, probename,
|
| - ppid,
|
| - execname,
|
| - current_processes);
|
| - logindex++;
|
| - }
|
| - /* Should use SCRIPT but there is no access to this variable at that
|
| - * point. */
|
| - proc:::start /ppid == PID && execname == "Python"/ {
|
| - trackedpid[pid] = 2;
|
| - current_processes += 1;
|
| - printf("%d %d %s_%s(%d, \\"%s\\", %d)\\n",
|
| - logindex, pid, probeprov, probename,
|
| - ppid,
|
| - execname,
|
| - current_processes);
|
| - logindex++;
|
| - }
|
| - proc:::exit /trackedpid[pid] &&
|
| - current_processes == 1 &&
|
| - waiting_to_die == 1/ {
|
| - trackedpid[pid] = 0;
|
| - current_processes -= 1;
|
| - printf("%d %d %s_%s(%d)\\n",
|
| - logindex, pid, probeprov, probename,
|
| - current_processes);
|
| - logindex++;
|
| - exit(0);
|
| - }
|
| - proc:::exit /trackedpid[pid]/ {
|
| - trackedpid[pid] = 0;
|
| - current_processes -= 1;
|
| - printf("%d %d %s_%s(%d)\\n",
|
| - logindex, pid, probeprov, probename,
|
| - current_processes);
|
| - logindex++;
|
| - }
|
| -
|
| - /* Use an arcane function to detect when we need to die */
|
| - syscall::ftruncate:entry /pid == PID && arg0 == FILE_ID/ {
|
| - waiting_to_die = 1;
|
| - printf("%d %d %s()\\n", logindex, pid, probefunc);
|
| - logindex++;
|
| - }
|
| - syscall::ftruncate:entry /
|
| - pid == PID && arg0 == FILE_ID && current_processes == 0/ {
|
| - exit(0);
|
| - }
|
| -
|
| - syscall::open*:entry /trackedpid[pid] == 1/ {
|
| - self->open_arg0 = arg0;
|
| - self->open_arg1 = arg1;
|
| - self->open_arg2 = arg2;
|
| - }
|
| - syscall::open*:return /trackedpid[pid] == 1 && errno == 0/ {
|
| - this->open_arg0 = copyinstr(self->open_arg0);
|
| - printf("%d %d %s(\\"%s\\", 0x%x, 0x%x)\\n",
|
| - logindex, pid, probefunc,
|
| - this->open_arg0,
|
| - self->open_arg1,
|
| - self->open_arg2);
|
| - logindex++;
|
| - this->open_arg0 = 0;
|
| - }
|
| - syscall::open*:return /trackedpid[pid] == 1/ {
|
| - self->open_arg0 = 0;
|
| - self->open_arg1 = 0;
|
| - self->open_arg2 = 0;
|
| - }
|
| -
|
| - syscall::rename:entry /trackedpid[pid] == 1/ {
|
| - self->rename_arg0 = arg0;
|
| - self->rename_arg1 = arg1;
|
| - }
|
| - syscall::rename:return /trackedpid[pid] == 1 && errno == 0/ {
|
| - this->rename_arg0 = copyinstr(self->rename_arg0);
|
| - this->rename_arg1 = copyinstr(self->rename_arg1);
|
| - printf("%d %d %s(\\"%s\\", \\"%s\\")\\n",
|
| - logindex, pid, probefunc,
|
| - this->rename_arg0,
|
| - this->rename_arg1);
|
| - logindex++;
|
| - this->rename_arg0 = 0;
|
| - this->rename_arg1 = 0;
|
| - }
|
| - syscall::rename:return /trackedpid[pid] == 1/ {
|
| - self->rename_arg0 = 0;
|
| - self->rename_arg1 = 0;
|
| - }
|
| -
|
| - /* Track chdir, it's painful because it is only receiving relative path.
|
| - */
|
| - syscall::chdir:entry /trackedpid[pid] == 1/ {
|
| - self->chdir_arg0 = arg0;
|
| - }
|
| - syscall::chdir:return /trackedpid[pid] == 1 && errno == 0/ {
|
| - this->chdir_arg0 = copyinstr(self->chdir_arg0);
|
| - printf("%d %d %s(\\"%s\\")\\n",
|
| - logindex, pid, probefunc,
|
| - this->chdir_arg0);
|
| - logindex++;
|
| - this->chdir_arg0 = 0;
|
| - }
|
| - syscall::chdir:return /trackedpid[pid] == 1/ {
|
| - self->chdir_arg0 = 0;
|
| - }
|
| - """
|
| -
|
| - # execve-specific code, tends to throw a lot of exceptions.
|
| - D_CODE_EXECVE = """
|
| - /* Finally what we care about! */
|
| - syscall::exec*:entry /trackedpid[pid]/ {
|
| - self->exec_arg0 = copyinstr(arg0);
|
| - /* Incrementally probe for a NULL in the argv parameter of execve() to
|
| - * figure out argc. */
|
| - /* TODO(maruel): Skip the remaining copyin() when a NULL pointer was
|
| - * found. */
|
| - self->exec_argc = 0;
|
| - /* Probe for argc==1 */
|
| - this->exec_argv = (user_addr_t*)copyin(
|
| - arg1, sizeof(user_addr_t) * (self->exec_argc + 1));
|
| - self->exec_argc = this->exec_argv[self->exec_argc] ?
|
| - (self->exec_argc + 1) : self->exec_argc;
|
| -
|
| - /* Probe for argc==2 */
|
| - this->exec_argv = (user_addr_t*)copyin(
|
| - arg1, sizeof(user_addr_t) * (self->exec_argc + 1));
|
| - self->exec_argc = this->exec_argv[self->exec_argc] ?
|
| - (self->exec_argc + 1) : self->exec_argc;
|
| -
|
| - /* Probe for argc==3 */
|
| - this->exec_argv = (user_addr_t*)copyin(
|
| - arg1, sizeof(user_addr_t) * (self->exec_argc + 1));
|
| - self->exec_argc = this->exec_argv[self->exec_argc] ?
|
| - (self->exec_argc + 1) : self->exec_argc;
|
| -
|
| - /* Probe for argc==4 */
|
| - this->exec_argv = (user_addr_t*)copyin(
|
| - arg1, sizeof(user_addr_t) * (self->exec_argc + 1));
|
| - self->exec_argc = this->exec_argv[self->exec_argc] ?
|
| - (self->exec_argc + 1) : self->exec_argc;
|
| -
|
| - /* Copy the inputs strings since there is no guarantee they'll be
|
| - * present after the call completed. */
|
| - self->exec_argv0 = (self->exec_argc > 0) ?
|
| - copyinstr(this->exec_argv[0]) : "";
|
| - self->exec_argv1 = (self->exec_argc > 1) ?
|
| - copyinstr(this->exec_argv[1]) : "";
|
| - self->exec_argv2 = (self->exec_argc > 2) ?
|
| - copyinstr(this->exec_argv[2]) : "";
|
| - self->exec_argv3 = (self->exec_argc > 3) ?
|
| - copyinstr(this->exec_argv[3]) : "";
|
| - this->exec_argv = 0;
|
| - }
|
| - syscall::exec*:return /trackedpid[pid] && errno == 0/ {
|
| - /* We need to join strings here, as using multiple printf() would
|
| - * cause tearing when multiple threads/processes are traced.
|
| - * Since it is impossible to escape a string and join it to another one,
|
| - * like sprintf("%s%S", previous, more), use hackery.
|
| - * Each of the elements are split with a \\1. \\0 cannot be used because
|
| - * it is simply ignored. This will conflict with any program putting a
|
| - * \\1 in their execve() string but this should be "rare enough" */
|
| - this->args = "";
|
| - /* Process exec_argv[0] */
|
| - this->args = strjoin(
|
| - this->args, (self->exec_argc > 0) ? self->exec_argv0 : "");
|
| -
|
| - /* Process exec_argv[1] */
|
| - this->args = strjoin(
|
| - this->args, (self->exec_argc > 1) ? "\\1" : "");
|
| - this->args = strjoin(
|
| - this->args, (self->exec_argc > 1) ? self->exec_argv1 : "");
|
| -
|
| - /* Process exec_argv[2] */
|
| - this->args = strjoin(
|
| - this->args, (self->exec_argc > 2) ? "\\1" : "");
|
| - this->args = strjoin(
|
| - this->args, (self->exec_argc > 2) ? self->exec_argv2 : "");
|
| -
|
| - /* Process exec_argv[3] */
|
| - this->args = strjoin(
|
| - this->args, (self->exec_argc > 3) ? "\\1" : "");
|
| - this->args = strjoin(
|
| - this->args, (self->exec_argc > 3) ? self->exec_argv3 : "");
|
| -
|
| - /* Prints self->exec_argc to permits verifying the internal
|
| - * consistency since this code is quite fishy. */
|
| - printf("%d %d %s(\\"%s\\", [%d, %S])\\n",
|
| - logindex, pid, probefunc,
|
| - self->exec_arg0,
|
| - self->exec_argc,
|
| - this->args);
|
| - logindex++;
|
| - this->args = 0;
|
| - }
|
| - syscall::exec*:return /trackedpid[pid]/ {
|
| - self->exec_arg0 = 0;
|
| - self->exec_argc = 0;
|
| - self->exec_argv0 = 0;
|
| - self->exec_argv1 = 0;
|
| - self->exec_argv2 = 0;
|
| - self->exec_argv3 = 0;
|
| - }
|
| - """
|
| -
|
| - # Code currently not used.
|
| - D_EXTRANEOUS = """
|
| - /* This is a good learning experience, since it traces a lot of things
|
| - * related to the process and child processes.
|
| - * Warning: it generates a gigantic log. For example, tracing
|
| - * "data/trace_inputs/child1.py --child" generates a 2mb log and takes
|
| - * several minutes to execute.
|
| - */
|
| - /*
|
| - mach_trap::: /trackedpid[pid] == 1 || trackedpid[ppid]/ {
|
| - printf("%d %d %s_%s() = %d\\n",
|
| - logindex, pid, probeprov, probefunc, errno);
|
| - logindex++;
|
| - }
|
| - proc::: /trackedpid[pid] == 1 || trackedpid[ppid]/ {
|
| - printf("%d %d %s_%s() = %d\\n",
|
| - logindex, pid, probeprov, probefunc, errno);
|
| - logindex++;
|
| - }
|
| - sched::: /trackedpid[pid] == 1 || trackedpid[ppid]/ {
|
| - printf("%d %d %s_%s() = %d\\n",
|
| - logindex, pid, probeprov, probefunc, errno);
|
| - logindex++;
|
| - }
|
| - syscall::: /trackedpid[pid] == 1 || trackedpid[ppid]/ {
|
| - printf("%d %d %s_%s() = %d\\n",
|
| - logindex, pid, probeprov, probefunc, errno);
|
| - logindex++;
|
| - }
|
| - vminfo::: /trackedpid[pid] == 1 || trackedpid[ppid]/ {
|
| - printf("%d %d %s_%s() = %d\\n",
|
| - logindex, pid, probeprov, probefunc, errno);
|
| - logindex++;
|
| - }
|
| - */
|
| - /* TODO(maruel): *stat* functions and friends
|
| - syscall::access:return,
|
| - syscall::chdir:return,
|
| - syscall::chflags:return,
|
| - syscall::chown:return,
|
| - syscall::chroot:return,
|
| - syscall::getattrlist:return,
|
| - syscall::getxattr:return,
|
| - syscall::lchown:return,
|
| - syscall::lstat64:return,
|
| - syscall::lstat:return,
|
| - syscall::mkdir:return,
|
| - syscall::pathconf:return,
|
| - syscall::readlink:return,
|
| - syscall::removexattr:return,
|
| - syscall::setxattr:return,
|
| - syscall::stat64:return,
|
| - syscall::stat:return,
|
| - syscall::truncate:return,
|
| - syscall::unlink:return,
|
| - syscall::utimes:return,
|
| - */
|
| - """
|
| -
|
| - def __init__(self, logname):
|
| - """Starts the log collection with dtrace.
|
| -
|
| - Requires root access or chmod 4555 on dtrace. dtrace is asynchronous so
|
| - this needs to wait for dtrace to be "warmed up".
|
| - """
|
| - super(Dtrace.Tracer, self).__init__(logname)
|
| - self._script = create_thunk()
|
| - # This unique dummy temp file is used to signal the dtrace script that it
|
| - # should stop as soon as all the child processes are done. A bit hackish
|
| - # but works fine enough.
|
| - self._dummy_file_id, self._dummy_file_name = tempfile.mkstemp(
|
| - prefix='trace_signal_file')
|
| -
|
| - # Note: do not use the -p flag. It's useless if the initial process quits
|
| - # too fast, resulting in missing traces from the grand-children. The D
|
| - # code manages the dtrace lifetime itself.
|
| - trace_cmd = [
|
| - 'sudo',
|
| - 'dtrace',
|
| - # Use a larger buffer if getting 'out of scratch space' errors.
|
| - # Ref: https://wikis.oracle.com/display/DTrace/Options+and+Tunables
|
| - '-b', '10m',
|
| - '-x', 'dynvarsize=10m',
|
| - #'-x', 'dtrace_global_maxsize=1m',
|
| - '-x', 'evaltime=exec',
|
| - '-o', '/dev/stderr',
|
| - '-q',
|
| - '-n', self._get_dtrace_code(),
|
| - ]
|
| - with open(self._logname + '.log', 'wb') as logfile:
|
| - self._dtrace = subprocess.Popen(
|
| - trace_cmd, stdout=logfile, stderr=subprocess.STDOUT)
|
| - logging.debug('Started dtrace pid: %d' % self._dtrace.pid)
|
| -
|
| - # Reads until one line is printed, which signifies dtrace is up and ready.
|
| - with open(self._logname + '.log', 'rb') as logfile:
|
| - while 'dtrace_BEGIN' not in logfile.readline():
|
| - if self._dtrace.poll() is not None:
|
| - # Do a busy wait. :/
|
| - break
|
| - logging.debug('dtrace started')
|
| -
|
| - def _get_dtrace_code(self):
|
| - """Setups the D code to implement child process tracking.
|
| -
|
| - Injects the cookie in the script so it knows when to stop.
|
| -
|
| - The script will detect any instance of the script created with
|
| - create_thunk() and will start tracing it.
|
| - """
|
| - return (
|
| - 'inline int PID = %d;\n'
|
| - 'inline string SCRIPT = "%s";\n'
|
| - 'inline int FILE_ID = %d;\n'
|
| - '\n'
|
| - '%s') % (
|
| - os.getpid(),
|
| - self._script,
|
| - self._dummy_file_id,
|
| - self.D_CODE) + self.D_CODE_EXECVE
|
| -
|
| - def trace(self, cmd, cwd, tracename, output):
|
| - """Runs dtrace on an executable.
|
| -
|
| - This dtruss is broken when it starts the process itself or when tracing
|
| - child processes, this code starts a wrapper process
|
| - generated with create_thunk() which starts the executable to trace.
|
| - """
|
| - logging.info('trace(%s, %s, %s, %s)' % (cmd, cwd, tracename, output))
|
| - assert os.path.isabs(cmd[0]), cmd[0]
|
| - assert os.path.isabs(cwd), cwd
|
| - assert os.path.normpath(cwd) == cwd, cwd
|
| - with self._lock:
|
| - if not self._initialized:
|
| - raise TracingFailure(
|
| - 'Called Tracer.trace() on an unitialized object',
|
| - None, None, None, tracename)
|
| - assert tracename not in (i['trace'] for i in self._traces)
|
| -
|
| - # Starts the script wrapper to start the child process. This signals the
|
| - # dtrace script that this process is to be traced.
|
| - stdout = stderr = None
|
| - if output:
|
| - stdout = subprocess.PIPE
|
| - stderr = subprocess.STDOUT
|
| - child_cmd = [
|
| - sys.executable,
|
| - self._script,
|
| - tracename,
|
| - ]
|
| - # Call a dummy function so that dtrace knows I'm about to launch a process
|
| - # that needs to be traced.
|
| - # Yummy.
|
| - child = subprocess.Popen(
|
| - child_cmd + fix_python_path(cmd),
|
| - stdin=subprocess.PIPE,
|
| - stdout=stdout,
|
| - stderr=stderr,
|
| - cwd=cwd)
|
| - logging.debug('Started child pid: %d' % child.pid)
|
| -
|
| - out = child.communicate()[0]
|
| - # This doesn't mean tracing is done, one of the grand-child process may
|
| - # still be alive. It will be tracked with the dtrace script.
|
| -
|
| - with self._lock:
|
| - assert tracename not in (i['trace'] for i in self._traces)
|
| - self._traces.append(
|
| - {
|
| - 'cmd': cmd,
|
| - 'cwd': cwd,
|
| - # The pid of strace process, not very useful.
|
| - 'pid': child.pid,
|
| - 'trace': tracename,
|
| - 'output': out,
|
| - })
|
| - return child.returncode, out
|
| -
|
| - def close(self, timeout=None):
|
| - """Terminates dtrace."""
|
| - logging.debug('close(%s)' % timeout)
|
| - try:
|
| - try:
|
| - super(Dtrace.Tracer, self).close(timeout)
|
| - # Signal dtrace that it should stop now.
|
| - os.ftruncate(self._dummy_file_id, 0)
|
| - if timeout:
|
| - start = time.time()
|
| - # Use polling. :/
|
| - while (self._dtrace.poll() is None and
|
| - (time.time() - start) < timeout):
|
| - time.sleep(0.1)
|
| - self._dtrace.kill()
|
| - self._dtrace.wait()
|
| - finally:
|
| - # Make sure to kill it in any case.
|
| - if self._dtrace.poll() is None:
|
| - try:
|
| - self._dtrace.kill()
|
| - self._dtrace.wait()
|
| - except OSError:
|
| - pass
|
| -
|
| - if self._dtrace.returncode != 0:
|
| - # Warn about any dtrace failure but basically ignore it.
|
| - print 'dtrace failure: %s' % self._dtrace.returncode
|
| - finally:
|
| - os.close(self._dummy_file_id)
|
| - os.remove(self._dummy_file_name)
|
| - os.remove(self._script)
|
| -
|
| - def post_process_log(self):
|
| - """Sorts the log back in order when each call occured.
|
| -
|
| - dtrace doesn't save the buffer in strict order since it keeps one buffer
|
| - per CPU.
|
| - """
|
| - super(Dtrace.Tracer, self).post_process_log()
|
| - logname = self._logname + '.log'
|
| - with open(logname, 'rb') as logfile:
|
| - lines = [l for l in logfile if l.strip()]
|
| - errors = [l for l in lines if l.startswith('dtrace:')]
|
| - if errors:
|
| - raise TracingFailure(
|
| - 'Found errors in the trace: %s' % '\n'.join(errors),
|
| - None, None, None, logname)
|
| - try:
|
| - lines = sorted(lines, key=lambda l: int(l.split(' ', 1)[0]))
|
| - except ValueError:
|
| - raise TracingFailure(
|
| - 'Found errors in the trace: %s' % '\n'.join(
|
| - l for l in lines if l.split(' ', 1)[0].isdigit()),
|
| - None, None, None, logname)
|
| - with open(logname, 'wb') as logfile:
|
| - logfile.write(''.join(lines))
|
| -
|
| - @staticmethod
|
| - def clean_trace(logname):
|
| - for ext in ('', '.log'):
|
| - if os.path.isfile(logname + ext):
|
| - os.remove(logname + ext)
|
| -
|
| - @classmethod
|
| - def parse_log(cls, logname, blacklist):
|
| - logging.info('parse_log(%s, ...)' % logname)
|
| -
|
| - def blacklist_more(filepath):
|
| - # All the HFS metadata is in the form /.vol/...
|
| - return blacklist(filepath) or re.match(r'^\/\.vol\/.+$', filepath)
|
| -
|
| - data = read_json(logname)
|
| - out = []
|
| - for item in data['traces']:
|
| - context = cls.Context(blacklist_more, item['pid'], item['cwd'])
|
| - for line in open(logname + '.log', 'rb'):
|
| - context.on_line(line)
|
| - out.append(
|
| - {
|
| - 'results': context.to_results(),
|
| - 'trace': item['trace'],
|
| - 'output': item['output'],
|
| - })
|
| - return out
|
| -
|
| -
|
| -class LogmanTrace(ApiBase):
|
| - """Uses the native Windows ETW based tracing functionality to trace a child
|
| - process.
|
| -
|
| - Caveat: this implementations doesn't track cwd or initial_cwd. It is because
|
| - the Windows Kernel doesn't have a concept of 'current working directory' at
|
| - all. A Win32 process has a map of current directories, one per drive letter
|
| - and it is managed by the user mode kernel32.dll. In kernel, a file is always
|
| - opened relative to another file_object or as an absolute path. All the current
|
| - working directory logic is done in user mode.
|
| - """
|
| - class Context(ApiBase.Context):
|
| - """Processes a ETW log line and keeps the list of existent and non
|
| - existent files accessed.
|
| -
|
| - Ignores directories.
|
| - """
|
| - # These indexes are for the stripped version in json.
|
| - EVENT_NAME = 0
|
| - TYPE = 1
|
| - PID = 2
|
| - TID = 3
|
| - PROCESSOR_ID = 4
|
| - TIMESTAMP = 5
|
| - USER_DATA = 6
|
| -
|
| - class Process(ApiBase.Context.Process):
|
| - def __init__(self, *args):
|
| - super(LogmanTrace.Context.Process, self).__init__(*args)
|
| - # Handle file objects that succeeded.
|
| - self.file_objects = {}
|
| -
|
| - def __init__(self, blacklist, tracer_pid):
|
| - logging.info('%s(%d)' % (self.__class__.__name__, tracer_pid))
|
| - super(LogmanTrace.Context, self).__init__(blacklist)
|
| - self._drive_map = DosDriveMap()
|
| - # Threads mapping to the corresponding process id.
|
| - self._threads_active = {}
|
| - # Process ID of the tracer, e.g. tracer_inputs.py
|
| - self._tracer_pid = tracer_pid
|
| - self._line_number = 0
|
| -
|
| - def on_line(self, line):
|
| - """Processes a json Event line."""
|
| - self._line_number += 1
|
| - try:
|
| - # By Opcode
|
| - handler = getattr(
|
| - self,
|
| - 'handle_%s_%s' % (line[self.EVENT_NAME], line[self.TYPE]),
|
| - None)
|
| - if not handler:
|
| - raise TracingFailure(
|
| - 'Unexpected event %s_%s' % (
|
| - line[self.EVENT_NAME], line[self.TYPE]),
|
| - None, None, None)
|
| - handler(line)
|
| - except TracingFailure, e:
|
| - # Hack in the values since the handler could be a static function.
|
| - e.pid = line[self.PID]
|
| - e.line = line
|
| - e.line_number = self._line_number
|
| - # Re-raise the modified exception.
|
| - raise
|
| - except (KeyError, NotImplementedError, ValueError), e:
|
| - raise TracingFailure(
|
| - 'Trace generated a %s exception: %s' % (
|
| - e.__class__.__name__, str(e)),
|
| - line[self.PID],
|
| - self._line_number,
|
| - line,
|
| - e)
|
| -
|
| - def to_results(self):
|
| - if not self.root_process:
|
| - raise TracingFailure(
|
| - 'Failed to detect the initial process',
|
| - None, None, None)
|
| - process = self.root_process.to_results_process()
|
| - return Results(process)
|
| -
|
| - def _thread_to_process(self, tid):
|
| - """Finds the process from the thread id."""
|
| - tid = int(tid, 16)
|
| - pid = self._threads_active.get(tid)
|
| - if not pid or not self._process_lookup.get(pid):
|
| - return
|
| - return self._process_lookup[pid]
|
| -
|
| - @classmethod
|
| - def handle_EventTrace_Header(cls, line):
|
| - """Verifies no event was dropped, e.g. no buffer overrun occured."""
|
| - BUFFER_SIZE = cls.USER_DATA
|
| - #VERSION = cls.USER_DATA + 1
|
| - #PROVIDER_VERSION = cls.USER_DATA + 2
|
| - #NUMBER_OF_PROCESSORS = cls.USER_DATA + 3
|
| - #END_TIME = cls.USER_DATA + 4
|
| - #TIMER_RESOLUTION = cls.USER_DATA + 5
|
| - #MAX_FILE_SIZE = cls.USER_DATA + 6
|
| - #LOG_FILE_MODE = cls.USER_DATA + 7
|
| - #BUFFERS_WRITTEN = cls.USER_DATA + 8
|
| - #START_BUFFERS = cls.USER_DATA + 9
|
| - #POINTER_SIZE = cls.USER_DATA + 10
|
| - EVENTS_LOST = cls.USER_DATA + 11
|
| - #CPU_SPEED = cls.USER_DATA + 12
|
| - #LOGGER_NAME = cls.USER_DATA + 13
|
| - #LOG_FILE_NAME = cls.USER_DATA + 14
|
| - #BOOT_TIME = cls.USER_DATA + 15
|
| - #PERF_FREQ = cls.USER_DATA + 16
|
| - #START_TIME = cls.USER_DATA + 17
|
| - #RESERVED_FLAGS = cls.USER_DATA + 18
|
| - #BUFFERS_LOST = cls.USER_DATA + 19
|
| - #SESSION_NAME_STRING = cls.USER_DATA + 20
|
| - #LOG_FILE_NAME_STRING = cls.USER_DATA + 21
|
| - if line[EVENTS_LOST] != '0':
|
| - raise TracingFailure(
|
| - ( '%s events were lost during trace, please increase the buffer '
|
| - 'size from %s') % (line[EVENTS_LOST], line[BUFFER_SIZE]),
|
| - None, None, None)
|
| -
|
| - def handle_FileIo_Cleanup(self, line):
|
| - """General wisdom: if a file is closed, it's because it was opened.
|
| -
|
| - Note that FileIo_Close is not used since if a file was opened properly but
|
| - not closed before the process exits, only Cleanup will be logged.
|
| - """
|
| - #IRP = self.USER_DATA
|
| - TTID = self.USER_DATA + 1 # Thread ID, that's what we want.
|
| - FILE_OBJECT = self.USER_DATA + 2
|
| - #FILE_KEY = self.USER_DATA + 3
|
| - proc = self._thread_to_process(line[TTID])
|
| - if not proc:
|
| - # Not a process we care about.
|
| - return
|
| - file_object = line[FILE_OBJECT]
|
| - if file_object in proc.file_objects:
|
| - proc.add_file(proc.file_objects.pop(file_object), False)
|
| -
|
| - def handle_FileIo_Create(self, line):
|
| - """Handles a file open.
|
| -
|
| - All FileIo events are described at
|
| - http://msdn.microsoft.com/library/windows/desktop/aa363884.aspx
|
| - for some value of 'description'.
|
| -
|
| - " (..) process and thread id values of the IO events (..) are not valid "
|
| - http://msdn.microsoft.com/magazine/ee358703.aspx
|
| -
|
| - The FileIo.Create event doesn't return if the CreateFile() call
|
| - succeeded, so keep track of the file_object and check that it is
|
| - eventually closed with FileIo_Cleanup.
|
| - """
|
| - #IRP = self.USER_DATA
|
| - TTID = self.USER_DATA + 1 # Thread ID, that's what we want.
|
| - FILE_OBJECT = self.USER_DATA + 2
|
| - #CREATE_OPTIONS = self.USER_DATA + 3
|
| - #FILE_ATTRIBUTES = self.USER_DATA + 4
|
| - #self.USER_DATA + SHARE_ACCESS = 5
|
| - OPEN_PATH = self.USER_DATA + 6
|
| -
|
| - proc = self._thread_to_process(line[TTID])
|
| - if not proc:
|
| - # Not a process we care about.
|
| - return
|
| -
|
| - match = re.match(r'^\"(.+)\"$', line[OPEN_PATH])
|
| - raw_path = match.group(1)
|
| - # Ignore directories and bare drive right away.
|
| - if raw_path.endswith(os.path.sep):
|
| - return
|
| - filepath = self._drive_map.to_win32(raw_path)
|
| - # Ignore bare drive right away. Some may still fall through with format
|
| - # like '\\?\X:'
|
| - if len(filepath) == 2:
|
| - return
|
| - file_object = line[FILE_OBJECT]
|
| - if os.path.isdir(filepath):
|
| - # There is no O_DIRECTORY equivalent on Windows. The closed is
|
| - # FILE_FLAG_BACKUP_SEMANTICS but it's not exactly right either. So
|
| - # simply discard directories are they are found.
|
| - return
|
| - # Override any stale file object
|
| - proc.file_objects[file_object] = filepath
|
| -
|
| - def handle_FileIo_Rename(self, line):
|
| - # TODO(maruel): Handle?
|
| - pass
|
| -
|
| - def handle_Process_End(self, line):
|
| - pid = line[self.PID]
|
| - if self._process_lookup.get(pid):
|
| - logging.info('Terminated: %d' % pid)
|
| - self._process_lookup[pid] = None
|
| - else:
|
| - logging.debug('Terminated: %d' % pid)
|
| -
|
| - def handle_Process_Start(self, line):
|
| - """Handles a new child process started by PID."""
|
| - #UNIQUE_PROCESS_KEY = self.USER_DATA
|
| - PROCESS_ID = self.USER_DATA + 1
|
| - #PARENT_PID = self.USER_DATA + 2
|
| - #SESSION_ID = self.USER_DATA + 3
|
| - #EXIT_STATUS = self.USER_DATA + 4
|
| - #DIRECTORY_TABLE_BASE = self.USER_DATA + 5
|
| - #USER_SID = self.USER_DATA + 6
|
| - IMAGE_FILE_NAME = self.USER_DATA + 7
|
| - COMMAND_LINE = self.USER_DATA + 8
|
| -
|
| - ppid = line[self.PID]
|
| - pid = int(line[PROCESS_ID], 16)
|
| - logging.debug(
|
| - 'New process %d->%d (%s) %s' %
|
| - (ppid, pid, line[IMAGE_FILE_NAME], line[COMMAND_LINE]))
|
| -
|
| - if ppid == self._tracer_pid:
|
| - # Need to ignore processes we don't know about because the log is
|
| - # system-wide. self._tracer_pid shall start only one process.
|
| - if self.root_process:
|
| - raise TracingFailure(
|
| - ( 'Parent process is _tracer_pid(%d) but root_process(%d) is '
|
| - 'already set') % (self._tracer_pid, self.root_process.pid),
|
| - None, None, None)
|
| - proc = self.Process(self.blacklist, pid, None)
|
| - self.root_process = proc
|
| - ppid = None
|
| - elif self._process_lookup.get(ppid):
|
| - proc = self.Process(self.blacklist, pid, None)
|
| - self._process_lookup[ppid].children.append(proc)
|
| - else:
|
| - # Ignore
|
| - return
|
| - self._process_lookup[pid] = proc
|
| -
|
| - if (not line[IMAGE_FILE_NAME].startswith('"') or
|
| - not line[IMAGE_FILE_NAME].endswith('"')):
|
| - raise TracingFailure(
|
| - 'Command line is not properly quoted: %s' % line[IMAGE_FILE_NAME],
|
| - None, None, None)
|
| -
|
| - # TODO(maruel): Process escapes.
|
| - if (not line[COMMAND_LINE].startswith('"') or
|
| - not line[COMMAND_LINE].endswith('"')):
|
| - raise TracingFailure(
|
| - 'Command line is not properly quoted: %s' % line[COMMAND_LINE],
|
| - None, None, None)
|
| - proc.command = CommandLineToArgvW(line[COMMAND_LINE][1:-1])
|
| - proc.executable = line[IMAGE_FILE_NAME][1:-1]
|
| - # proc.command[0] may be the absolute path of 'executable' but it may be
|
| - # anything else too. If it happens that command[0] ends with executable,
|
| - # use it, otherwise defaults to the base name.
|
| - cmd0 = proc.command[0].lower()
|
| - if not cmd0.endswith('.exe'):
|
| - # TODO(maruel): That's not strictly true either.
|
| - cmd0 += '.exe'
|
| - if cmd0.endswith(proc.executable) and os.path.isfile(cmd0):
|
| - # Fix the path.
|
| - cmd0 = cmd0.replace('/', os.path.sep)
|
| - cmd0 = os.path.normpath(cmd0)
|
| - proc.executable = get_native_path_case(cmd0)
|
| - logging.info(
|
| - 'New child: %s -> %d %s' % (ppid, pid, proc.executable))
|
| -
|
| - def handle_Thread_End(self, line):
|
| - """Has the same parameters as Thread_Start."""
|
| - tid = int(line[self.TID], 16)
|
| - self._threads_active.pop(tid, None)
|
| -
|
| - def handle_Thread_Start(self, line):
|
| - """Handles a new thread created.
|
| -
|
| - Do not use self.PID here since a process' initial thread is created by
|
| - the parent process.
|
| - """
|
| - PROCESS_ID = self.USER_DATA
|
| - TTHREAD_ID = self.USER_DATA + 1
|
| - #STACK_BASE = self.USER_DATA + 2
|
| - #STACK_LIMIT = self.USER_DATA + 3
|
| - #USER_STACK_BASE = self.USER_DATA + 4
|
| - #USER_STACK_LIMIT = self.USER_DATA + 5
|
| - #AFFINITY = self.USER_DATA + 6
|
| - #WIN32_START_ADDR = self.USER_DATA + 7
|
| - #TEB_BASE = self.USER_DATA + 8
|
| - #SUB_PROCESS_TAG = self.USER_DATA + 9
|
| - #BASE_PRIORITY = self.USER_DATA + 10
|
| - #PAGE_PRIORITY = self.USER_DATA + 11
|
| - #IO_PRIORITY = self.USER_DATA + 12
|
| - #THREAD_FLAGS = self.USER_DATA + 13
|
| - # Do not use self.PID here since a process' initial thread is created by
|
| - # the parent process.
|
| - pid = int(line[PROCESS_ID], 16)
|
| - tid = int(line[TTHREAD_ID], 16)
|
| - logging.debug('New thread pid:%d, tid:%d' % (pid, tid))
|
| - self._threads_active[tid] = pid
|
| -
|
| - @classmethod
|
| - def supported_events(cls):
|
| - """Returns all the procesed events."""
|
| - out = []
|
| - for member in dir(cls):
|
| - match = re.match(r'^handle_([A-Za-z]+)_([A-Za-z]+)$', member)
|
| - if match:
|
| - out.append(match.groups())
|
| - return out
|
| -
|
| - class Tracer(ApiBase.Tracer):
|
| - # The basic headers.
|
| - EXPECTED_HEADER = [
|
| - u'Event Name',
|
| - u'Type',
|
| - u'Event ID',
|
| - u'Version',
|
| - u'Channel',
|
| - u'Level', # 5
|
| - u'Opcode',
|
| - u'Task',
|
| - u'Keyword',
|
| - u'PID',
|
| - u'TID', # 10
|
| - u'Processor Number',
|
| - u'Instance ID',
|
| - u'Parent Instance ID',
|
| - u'Activity ID',
|
| - u'Related Activity ID', # 15
|
| - u'Clock-Time',
|
| - u'Kernel(ms)', # Both have a resolution of ~15ms which makes them
|
| - u'User(ms)', # pretty much useless.
|
| - u'User Data', # Extra arguments that are event-specific.
|
| - ]
|
| - # Only the useful headers common to all entries are listed there. Any column
|
| - # at 19 or higher is dependent on the specific event.
|
| - EVENT_NAME = 0
|
| - TYPE = 1
|
| - PID = 9
|
| - TID = 10
|
| - PROCESSOR_ID = 11
|
| - TIMESTAMP = 16
|
| - NULL_GUID = '{00000000-0000-0000-0000-000000000000}'
|
| - USER_DATA = 19
|
| -
|
| - def __init__(self, logname):
|
| - """Starts the log collection.
|
| -
|
| - Requires administrative access. logman.exe is synchronous so no need for a
|
| - "warmup" call. 'Windows Kernel Trace' is *localized* so use its GUID
|
| - instead. The GUID constant name is SystemTraceControlGuid. Lovely.
|
| -
|
| - One can get the list of potentially interesting providers with:
|
| - "logman query providers | findstr /i file"
|
| - """
|
| - super(LogmanTrace.Tracer, self).__init__(logname)
|
| - self._script = create_thunk()
|
| - cmd_start = [
|
| - 'logman.exe',
|
| - 'start',
|
| - 'NT Kernel Logger',
|
| - '-p', '{9e814aad-3204-11d2-9a82-006008a86939}',
|
| - # splitio,fileiocompletion,syscall,file,cswitch,img
|
| - '(process,fileio,thread)',
|
| - '-o', self._logname + '.etl',
|
| - '-ets', # Send directly to kernel
|
| - # Values extracted out of thin air.
|
| - # Event Trace Session buffer size in kb.
|
| - '-bs', '10240',
|
| - # Number of Event Trace Session buffers.
|
| - '-nb', '16', '256',
|
| - ]
|
| - logging.debug('Running: %s' % cmd_start)
|
| - try:
|
| - subprocess.check_call(
|
| - cmd_start,
|
| - stdin=subprocess.PIPE,
|
| - stdout=subprocess.PIPE,
|
| - stderr=subprocess.STDOUT)
|
| - except subprocess.CalledProcessError, e:
|
| - if e.returncode == -2147024891:
|
| - print >> sys.stderr, 'Please restart with an elevated admin prompt'
|
| - elif e.returncode == -2144337737:
|
| - print >> sys.stderr, (
|
| - 'A kernel trace was already running, stop it and try again')
|
| - raise
|
| -
|
| - def trace(self, cmd, cwd, tracename, output):
|
| - logging.info('trace(%s, %s, %s, %s)' % (cmd, cwd, tracename, output))
|
| - assert os.path.isabs(cmd[0]), cmd[0]
|
| - assert os.path.isabs(cwd), cwd
|
| - assert os.path.normpath(cwd) == cwd, cwd
|
| - with self._lock:
|
| - if not self._initialized:
|
| - raise TracingFailure(
|
| - 'Called Tracer.trace() on an unitialized object',
|
| - None, None, None, tracename)
|
| - assert tracename not in (i['trace'] for i in self._traces)
|
| -
|
| - # Use "logman -?" for help.
|
| -
|
| - stdout = stderr = None
|
| - if output:
|
| - stdout = subprocess.PIPE
|
| - stderr = subprocess.STDOUT
|
| -
|
| - # Run the child process.
|
| - logging.debug('Running: %s' % cmd)
|
| - # Use the temporary script generated with create_thunk() so we have a
|
| - # clear pid owner. Since trace_inputs.py can be used as a library and
|
| - # could trace multiple processes simultaneously, it makes it more complex
|
| - # if the executable to be traced is executed directly here. It also solves
|
| - # issues related to logman.exe that needs to be executed to control the
|
| - # kernel trace.
|
| - child_cmd = [
|
| - sys.executable,
|
| - self._script,
|
| - tracename,
|
| - ]
|
| - child = subprocess.Popen(
|
| - child_cmd + fix_python_path(cmd),
|
| - cwd=cwd,
|
| - stdin=subprocess.PIPE,
|
| - stdout=stdout,
|
| - stderr=stderr)
|
| - logging.debug('Started child pid: %d' % child.pid)
|
| - out = child.communicate()[0]
|
| - # This doesn't mean all the grand-children are done. Sadly, we don't have
|
| - # a good way to determine that.
|
| -
|
| - with self._lock:
|
| - assert tracename not in (i['trace'] for i in self._traces)
|
| - self._traces.append({
|
| - 'command': cmd,
|
| - 'cwd': cwd,
|
| - 'pid': child.pid,
|
| - 'trace': tracename,
|
| - 'output': out,
|
| - })
|
| -
|
| - return child.returncode, out
|
| -
|
| - def close(self, _timeout=None):
|
| - """Stops the kernel log collection and converts the traces to text
|
| - representation.
|
| - """
|
| - with self._lock:
|
| - if not self._initialized:
|
| - raise TracingFailure(
|
| - 'Called Tracer.close() on an unitialized object',
|
| - None, None, None)
|
| - os.remove(self._script)
|
| - # Save metadata, add 'format' key..
|
| - data = {
|
| - 'format': 'csv',
|
| - 'traces': self._traces,
|
| - }
|
| - write_json(self._logname, data, False)
|
| -
|
| - cmd_stop = [
|
| - 'logman.exe',
|
| - 'stop',
|
| - 'NT Kernel Logger',
|
| - '-ets', # Sends the command directly to the kernel.
|
| - ]
|
| - logging.debug('Running: %s' % cmd_stop)
|
| - subprocess.check_call(
|
| - cmd_stop,
|
| - stdin=subprocess.PIPE,
|
| - stdout=subprocess.PIPE,
|
| - stderr=subprocess.STDOUT)
|
| - self._initialized = False
|
| -
|
| - def post_process_log(self):
|
| - """Converts the .etl file into .csv then into .json."""
|
| - super(LogmanTrace.Tracer, self).post_process_log()
|
| - logformat = 'csv'
|
| - self._convert_log(logformat)
|
| -
|
| - if logformat == 'csv_utf16':
|
| - def load_file():
|
| - def utf_8_encoder(unicode_csv_data):
|
| - """Encodes the unicode object as utf-8 encoded str instance"""
|
| - for line in unicode_csv_data:
|
| - yield line.encode('utf-8')
|
| -
|
| - def unicode_csv_reader(unicode_csv_data, **kwargs):
|
| - """Encodes temporarily as UTF-8 since csv module doesn't do unicode.
|
| - """
|
| - csv_reader = csv.reader(utf_8_encoder(unicode_csv_data), **kwargs)
|
| - for row in csv_reader:
|
| - # Decode str utf-8 instances back to unicode instances, cell by
|
| - # cell:
|
| - yield [cell.decode('utf-8') for cell in row]
|
| -
|
| - # The CSV file is UTF-16 so use codecs.open() to load the file into
|
| - # the python internal unicode format (utf-8). Then explicitly
|
| - # re-encode as utf8 as str instances so csv can parse it fine. Then
|
| - # decode the utf-8 str back into python unicode instances. This
|
| - # sounds about right.
|
| - for line in unicode_csv_reader(
|
| - codecs.open(self._logname + '.' + logformat, 'r', 'utf-16')):
|
| - # line is a list of unicode objects
|
| - # So much white space!
|
| - yield [i.strip() for i in line]
|
| -
|
| - elif logformat == 'csv':
|
| - def load_file():
|
| - def ansi_csv_reader(ansi_csv_data, **kwargs):
|
| - """Loads an 'ANSI' code page and returns unicode() objects."""
|
| - assert sys.getfilesystemencoding() == 'mbcs'
|
| - encoding = get_current_encoding()
|
| - for row in csv.reader(ansi_csv_data, **kwargs):
|
| - # Decode str 'ansi' instances to unicode instances, cell by cell:
|
| - yield [cell.decode(encoding) for cell in row]
|
| -
|
| - # The fastest and smallest format but only supports 'ANSI' file paths.
|
| - # E.g. the filenames are encoding in the 'current' encoding.
|
| - for line in ansi_csv_reader(open(self._logname + '.' + logformat)):
|
| - # line is a list of unicode objects.
|
| - yield [i.strip() for i in line]
|
| -
|
| - supported_events = LogmanTrace.Context.supported_events()
|
| -
|
| - def trim(generator):
|
| - for index, line in enumerate(generator):
|
| - if not index:
|
| - if line != self.EXPECTED_HEADER:
|
| - raise TracingFailure(
|
| - 'Found malformed header: %s' % ' '.join(line),
|
| - None, None, None)
|
| - continue
|
| - # As you can see, the CSV is full of useful non-redundant information:
|
| - if (line[2] != '0' or # Event ID
|
| - line[3] not in ('2', '3') or # Version
|
| - line[4] != '0' or # Channel
|
| - line[5] != '0' or # Level
|
| - line[7] != '0' or # Task
|
| - line[8] != '0x0000000000000000' or # Keyword
|
| - line[12] != '' or # Instance ID
|
| - line[13] != '' or # Parent Instance ID
|
| - line[14] != self.NULL_GUID or # Activity ID
|
| - line[15] != ''): # Related Activity ID
|
| - raise TracingFailure(
|
| - 'Found unexpected values in line: %s' % ' '.join(line),
|
| - None, None, None)
|
| -
|
| - if (line[self.EVENT_NAME], line[self.TYPE]) not in supported_events:
|
| - continue
|
| -
|
| - # Convert the PID in-place from hex.
|
| - line[self.PID] = int(line[self.PID], 16)
|
| -
|
| - yield [
|
| - line[self.EVENT_NAME],
|
| - line[self.TYPE],
|
| - line[self.PID],
|
| - line[self.TID],
|
| - line[self.PROCESSOR_ID],
|
| - line[self.TIMESTAMP],
|
| - ] + line[self.USER_DATA:]
|
| -
|
| - write_json('%s.json' % self._logname, list(trim(load_file())), True)
|
| -
|
| - def _convert_log(self, logformat):
|
| - """Converts the ETL trace to text representation.
|
| -
|
| - Normally, 'csv' is sufficient. If complex scripts are used (like eastern
|
| - languages), use 'csv_utf16'. If localization gets in the way, use 'xml'.
|
| -
|
| - Arguments:
|
| - - logformat: Text format to be generated, csv, csv_utf16 or xml.
|
| -
|
| - Use "tracerpt -?" for help.
|
| - """
|
| - LOCALE_INVARIANT = 0x7F
|
| - windll.kernel32.SetThreadLocale(LOCALE_INVARIANT)
|
| - cmd_convert = [
|
| - 'tracerpt.exe',
|
| - '-l', self._logname + '.etl',
|
| - '-o', self._logname + '.' + logformat,
|
| - '-gmt', # Use UTC
|
| - '-y', # No prompt
|
| - # Use -of XML to get the header of each items after column 19, e.g. all
|
| - # the actual headers of 'User Data'.
|
| - ]
|
| -
|
| - if logformat == 'csv':
|
| - # tracerpt localizes the 'Type' column, for major brainfuck
|
| - # entertainment. I can't imagine any sane reason to do that.
|
| - cmd_convert.extend(['-of', 'CSV'])
|
| - elif logformat == 'csv_utf16':
|
| - # This causes it to use UTF-16, which doubles the log size but ensures
|
| - # the log is readable for non-ASCII characters.
|
| - cmd_convert.extend(['-of', 'CSV', '-en', 'Unicode'])
|
| - elif logformat == 'xml':
|
| - cmd_convert.extend(['-of', 'XML'])
|
| - else:
|
| - raise ValueError('Unexpected log format \'%s\'' % logformat)
|
| - logging.debug('Running: %s' % cmd_convert)
|
| - # This can takes tens of minutes for large logs.
|
| - # Redirects all output to stderr.
|
| - subprocess.check_call(
|
| - cmd_convert,
|
| - stdin=subprocess.PIPE,
|
| - stdout=sys.stderr,
|
| - stderr=sys.stderr)
|
| -
|
| - @staticmethod
|
| - def clean_trace(logname):
|
| - for ext in ('', '.csv', '.etl', '.json', '.xml'):
|
| - if os.path.isfile(logname + ext):
|
| - os.remove(logname + ext)
|
| -
|
| - @classmethod
|
| - def parse_log(cls, logname, blacklist):
|
| - logging.info('parse_log(%s, %s)' % (logname, blacklist))
|
| -
|
| - def blacklist_more(filepath):
|
| - # All the NTFS metadata is in the form x:\$EXTEND or stuff like that.
|
| - return blacklist(filepath) or re.match(r'[A-Z]\:\\\$EXTEND', filepath)
|
| -
|
| - data = read_json(logname)
|
| - lines = read_json(logname + '.json')
|
| - out = []
|
| - for item in data['traces']:
|
| - context = cls.Context(blacklist_more, item['pid'])
|
| - for line in lines:
|
| - context.on_line(line)
|
| - out.append(
|
| - {
|
| - 'results': context.to_results(),
|
| - 'trace': item['trace'],
|
| - 'output': item['output'],
|
| - })
|
| - return out
|
| -
|
| -
|
| -def get_api():
|
| - """Returns the correct implementation for the current OS."""
|
| - if sys.platform == 'cygwin':
|
| - raise NotImplementedError(
|
| - 'Not implemented for cygwin, start the script from Win32 python')
|
| - flavors = {
|
| - 'win32': LogmanTrace,
|
| - 'darwin': Dtrace,
|
| - 'sunos5': Dtrace,
|
| - 'freebsd7': Dtrace,
|
| - 'freebsd8': Dtrace,
|
| - }
|
| - # Defaults to strace.
|
| - return flavors.get(sys.platform, Strace)()
|
| -
|
| -
|
| -def extract_directories(root_dir, files, blacklist):
|
| - """Detects if all the files in a directory are in |files| and if so, replace
|
| - the individual files by a Results.Directory instance.
|
| -
|
| - Takes a list of Results.File instances and returns a shorter list of
|
| - Results.File and Results.Directory instances.
|
| -
|
| - Arguments:
|
| - - root_dir: Optional base directory that shouldn't be search further.
|
| - - files: list of Results.File instances.
|
| - - blacklist: regexp of files to ignore, for example r'.+\.pyc'.
|
| - """
|
| - logging.info(
|
| - 'extract_directories(%s, %d files, ...)' % (root_dir, len(files)))
|
| - assert not (root_dir or '').endswith(os.path.sep), root_dir
|
| - assert not root_dir or (get_native_path_case(root_dir) == root_dir)
|
| - assert not any(isinstance(f, Results.Directory) for f in files)
|
| - # Remove non existent files.
|
| - files = [f for f in files if f.existent]
|
| - if not files:
|
| - return files
|
| - # All files must share the same root, which can be None.
|
| - assert len(set(f.root for f in files)) == 1, set(f.root for f in files)
|
| -
|
| - # Creates a {directory: {filename: File}} mapping, up to root.
|
| - buckets = {}
|
| - if root_dir:
|
| - buckets[root_dir] = {}
|
| - for fileobj in files:
|
| - path = fileobj.full_path
|
| - directory = os.path.dirname(path)
|
| - assert directory
|
| - # Do not use os.path.basename() so trailing os.path.sep is kept.
|
| - basename = path[len(directory)+1:]
|
| - files_in_directory = buckets.setdefault(directory, {})
|
| - files_in_directory[basename] = fileobj
|
| - # Add all the directories recursively up to root.
|
| - while True:
|
| - old_d = directory
|
| - directory = os.path.dirname(directory)
|
| - if directory + os.path.sep == root_dir or directory == old_d:
|
| - break
|
| - buckets.setdefault(directory, {})
|
| -
|
| - root_prefix = len(root_dir) + 1 if root_dir else 0
|
| - for directory in sorted(buckets, reverse=True):
|
| - actual = set(f for f in os.listdir(directory) if not blacklist(f))
|
| - expected = set(buckets[directory])
|
| - if not (actual - expected):
|
| - parent = os.path.dirname(directory)
|
| - buckets[parent][os.path.basename(directory)] = Results.Directory(
|
| - root_dir,
|
| - directory[root_prefix:],
|
| - False,
|
| - sum(f.size for f in buckets[directory].itervalues()),
|
| - sum(f.nb_files for f in buckets[directory].itervalues()))
|
| - # Remove the whole bucket.
|
| - del buckets[directory]
|
| -
|
| - # Reverse the mapping with what remains. The original instances are returned,
|
| - # so the cached meta data is kept.
|
| - files = sum((x.values() for x in buckets.itervalues()), [])
|
| - return sorted(files, key=lambda x: x.path)
|
| -
|
| -
|
| -def trace(logfile, cmd, cwd, api, output):
|
| - """Traces an executable. Returns (returncode, output) from api.
|
| -
|
| - Arguments:
|
| - - logfile: file to write to.
|
| - - cmd: command to run.
|
| - - cwd: current directory to start the process in.
|
| - - api: a tracing api instance.
|
| - - output: if True, returns output, otherwise prints it at the console.
|
| - """
|
| - cmd = fix_python_path(cmd)
|
| - api.clean_trace(logfile)
|
| - with api.get_tracer(logfile) as tracer:
|
| - return tracer.trace(cmd, cwd, 'default', output)
|
| -
|
| -
|
| -def load_trace(logfile, root_dir, api, blacklist):
|
| - """Loads a trace file and returns the Results instance.
|
| -
|
| - Arguments:
|
| - - logfile: File to load.
|
| - - root_dir: Root directory to use to determine if a file is relevant to the
|
| - trace or not.
|
| - - api: A tracing api instance.
|
| - - blacklist: Optional blacklist function to filter out unimportant files.
|
| - """
|
| - data = api.parse_log(logfile, (blacklist or (lambda _: False)))
|
| - assert len(data) == 1, 'More than one trace was detected!'
|
| - if 'exception' in data[0]:
|
| - # It got an exception, raise it.
|
| - raise data[0]['exception']
|
| - results = data[0]['results']
|
| - if root_dir:
|
| - results = results.strip_root(root_dir)
|
| - return results
|
| -
|
| -
|
| -def CMDclean(args):
|
| - """Cleans up traces."""
|
| - parser = OptionParserTraceInputs(command='clean')
|
| - options, args = parser.parse_args(args)
|
| - api = get_api()
|
| - api.clean_trace(options.log)
|
| - return 0
|
| -
|
| -
|
| -def CMDtrace(args):
|
| - """Traces an executable."""
|
| - parser = OptionParserTraceInputs(command='trace')
|
| - parser.allow_interspersed_args = False
|
| - parser.add_option(
|
| - '-q', '--quiet', action='store_true',
|
| - help='Redirects traced executable output to /dev/null')
|
| - options, args = parser.parse_args(args)
|
| -
|
| - if not args:
|
| - parser.error('Please provide a command to run')
|
| -
|
| - if not os.path.isabs(args[0]) and os.access(args[0], os.X_OK):
|
| - args[0] = os.path.abspath(args[0])
|
| -
|
| - api = get_api()
|
| - return trace(options.log, args, os.getcwd(), api, options.quiet)[0]
|
| -
|
| -
|
| -def CMDread(args):
|
| - """Reads the logs and prints the result."""
|
| - parser = OptionParserTraceInputs(command='read')
|
| - parser.add_option(
|
| - '-V', '--variable',
|
| - nargs=2,
|
| - action='append',
|
| - dest='variables',
|
| - metavar='VAR_NAME directory',
|
| - default=[],
|
| - help=('Variables to replace relative directories against. Example: '
|
| - '"-v \'$HOME\' \'/home/%s\'" will replace all occurence of your '
|
| - 'home dir with $HOME') % getpass.getuser())
|
| - parser.add_option(
|
| - '--root-dir',
|
| - help='Root directory to base everything off it. Anything outside of this '
|
| - 'this directory will not be reported')
|
| - parser.add_option(
|
| - '-j', '--json', action='store_true',
|
| - help='Outputs raw result data as json')
|
| - parser.add_option(
|
| - '-b', '--blacklist', action='append', default=[],
|
| - help='List of regexp to use as blacklist filter')
|
| - options, args = parser.parse_args(args)
|
| -
|
| - if options.root_dir:
|
| - options.root_dir = os.path.abspath(options.root_dir)
|
| -
|
| - variables = dict(options.variables)
|
| - api = get_api()
|
| - def blacklist(f):
|
| - return any(re.match(b, f) for b in options.blacklist)
|
| - data = api.parse_log(options.log, blacklist)
|
| - # Process each trace.
|
| - output_as_json = []
|
| - for item in data:
|
| - if 'exception' in item:
|
| - print >> sys.stderr, (
|
| - 'Trace %s: Got an exception: %s' % (item['trace'], item['exception']))
|
| - continue
|
| - results = item['results']
|
| - if options.root_dir:
|
| - results = results.strip_root(options.root_dir)
|
| -
|
| - if options.json:
|
| - output_as_json.append(results.flatten())
|
| - else:
|
| - simplified = extract_directories(
|
| - options.root_dir, results.files, blacklist)
|
| - simplified = [f.replace_variables(variables) for f in simplified]
|
| - if len(data) > 1:
|
| - print('Trace: %s' % item['trace'])
|
| - print('Total: %d' % len(results.files))
|
| - print('Non existent: %d' % len(results.non_existent))
|
| - for f in results.non_existent:
|
| - print(' %s' % f.path)
|
| - print(
|
| - 'Interesting: %d reduced to %d' % (
|
| - len(results.existent), len(simplified)))
|
| - for f in simplified:
|
| - print(' %s' % f.path)
|
| -
|
| - if options.json:
|
| - write_json(sys.stdout, output_as_json, False)
|
| - return 0
|
| -
|
| -
|
| -class OptionParserWithLogging(optparse.OptionParser):
|
| - """Adds --verbose option."""
|
| - def __init__(self, verbose=0, **kwargs):
|
| - optparse.OptionParser.__init__(self, **kwargs)
|
| - self.add_option(
|
| - '-v', '--verbose',
|
| - action='count',
|
| - default=verbose,
|
| - help='Use multiple times to increase verbosity')
|
| -
|
| - def parse_args(self, *args, **kwargs):
|
| - options, args = optparse.OptionParser.parse_args(self, *args, **kwargs)
|
| - levels = [logging.ERROR, logging.INFO, logging.DEBUG]
|
| - logging.basicConfig(
|
| - level=levels[min(len(levels)-1, options.verbose)],
|
| - format='%(levelname)5s %(module)15s(%(lineno)3d): %(message)s')
|
| - return options, args
|
| -
|
| -
|
| -class OptionParserWithNiceDescription(OptionParserWithLogging):
|
| - """Generates the description with the command's docstring."""
|
| - def __init__(self, **kwargs):
|
| - """Sets 'description' and 'usage' if not already specified."""
|
| - command = kwargs.pop('command', 'help')
|
| - kwargs.setdefault(
|
| - 'description',
|
| - re.sub('[\r\n ]{2,}', ' ', get_command_handler(command).__doc__))
|
| - kwargs.setdefault('usage', '%%prog %s [options]' % command)
|
| - OptionParserWithLogging.__init__(self, **kwargs)
|
| -
|
| -
|
| -class OptionParserTraceInputs(OptionParserWithNiceDescription):
|
| - """Adds automatic --log handling."""
|
| - def __init__(self, **kwargs):
|
| - OptionParserWithNiceDescription.__init__(self, **kwargs)
|
| - self.add_option(
|
| - '-l', '--log', help='Log file to generate or read, required')
|
| -
|
| - def parse_args(self, *args, **kwargs):
|
| - """Makes sure the paths make sense.
|
| -
|
| - On Windows, / and \ are often mixed together in a path.
|
| - """
|
| - options, args = OptionParserWithNiceDescription.parse_args(
|
| - self, *args, **kwargs)
|
| - if not options.log:
|
| - self.error('Must supply a log file with -l')
|
| - options.log = os.path.abspath(options.log)
|
| - return options, args
|
| -
|
| -
|
| -def extract_documentation():
|
| - """Returns a dict {command: description} for each of documented command."""
|
| - commands = (
|
| - fn[3:]
|
| - for fn in dir(sys.modules['__main__'])
|
| - if fn.startswith('CMD') and get_command_handler(fn[3:]).__doc__)
|
| - return dict((fn, get_command_handler(fn).__doc__) for fn in commands)
|
| -
|
| -
|
| -def CMDhelp(args):
|
| - """Prints list of commands or help for a specific command."""
|
| - doc = extract_documentation()
|
| - # Calculates the optimal offset.
|
| - offset = max(len(cmd) for cmd in doc)
|
| - format_str = ' %-' + str(offset + 2) + 's %s'
|
| - # Generate a one-liner documentation of each commands.
|
| - commands_description = '\n'.join(
|
| - format_str % (cmd, doc[cmd].split('\n')[0]) for cmd in sorted(doc))
|
| -
|
| - parser = OptionParserWithNiceDescription(
|
| - usage='%prog <command> [options]',
|
| - description='Commands are:\n%s\n' % commands_description)
|
| - parser.format_description = lambda _: parser.description
|
| -
|
| - # Strip out any -h or --help argument.
|
| - _, args = parser.parse_args([i for i in args if not i in ('-h', '--help')])
|
| - if len(args) == 1:
|
| - if not get_command_handler(args[0]):
|
| - parser.error('Unknown command %s' % args[0])
|
| - # The command was "%prog help command", replaces ourself with
|
| - # "%prog command --help" so help is correctly printed out.
|
| - return main(args + ['--help'])
|
| - elif args:
|
| - parser.error('Unknown argument "%s"' % ' '.join(args))
|
| - parser.print_help()
|
| - return 0
|
| -
|
| -
|
| -def get_command_handler(name):
|
| - """Returns the command handler or CMDhelp if it doesn't exist."""
|
| - return getattr(sys.modules['__main__'], 'CMD%s' % name, None)
|
| -
|
| -
|
| -def main_impl(argv):
|
| - command = get_command_handler(argv[0] if argv else 'help')
|
| - if not command:
|
| - return CMDhelp(argv)
|
| - return command(argv[1:])
|
| -
|
| -def main(argv):
|
| - try:
|
| - main_impl(argv)
|
| - except TracingFailure, e:
|
| - sys.stderr.write('\nError: ')
|
| - sys.stderr.write(str(e))
|
| - sys.stderr.write('\n')
|
| - return 1
|
| -
|
| -
|
| -if __name__ == '__main__':
|
| - sys.exit(main(sys.argv[1:]))
|
|
|