c - 如何通过C中的PID监视外部进程的事件？

Question

是否有任何具有某些功能的库，允许其pid_t监视外部进程的事件？我的意思是，监视外部进程是否已退出，或者是否已创建一个或多个子进程(使用fork)，或者是否已变成另一个可执行镜像(通过exec或posix_spawn函数族调用)，或者是否检测到Unix信号。交付给它。

编辑

我需要一些不会干扰正在监视的程序的执行的东西。因此，我不应该使用ptrace，因为它会在发出某种信号时停止正在监视的进程，并且有必要在发生这种情况时恢复该进程。

Answer 1

使用捕获fork()的预加载库运行目标二进制文件。只要所有子进程也都使用预加载库，无论执行如何，您都将看到所有本地子进程。

这是一个示例实现。

首先，forkmonitor.h头文件。它定义了从预加载库传递到监视过程的消息:

#ifndef   FORKMONITOR_H
#define   FORKMONITOR_H

#define   FORKMONITOR_ENVNAME "FORKMONITOR_SOCKET"

#ifndef   UNIX_PATH_MAX
#define   UNIX_PATH_MAX 108
#endif

#define TYPE_EXEC       1   /* When a binary is executed */
#define TYPE_DONE       2   /* exit() or return from main() */
#define TYPE_FORK       3
#define TYPE_VFORK      4
#define TYPE_EXIT       5   /* _exit() or _Exit() */
#define TYPE_ABORT      6   /* abort() */

struct message {
    pid_t          pid;     /* Process ID */
    pid_t          ppid;    /* Parent process ID */
    pid_t          sid;     /* Session ID */
    pid_t          pgid;    /* Process group ID */
    uid_t          uid;     /* Real user ID */
    gid_t          gid;     /* Real group ID */
    uid_t          euid;    /* Effective user ID */
    gid_t          egid;    /* Effective group ID */
    unsigned short len;     /* Length of data[] */
    unsigned char  type;    /* One of the TYPE_ constants */
    char           data[0]; /* Optional payload, possibly longer */
};

#endif /* FORKMONITOR_H */

FORKMONITOR_SOCKET环境变量(由上面的 FORKMONITOR_ENVNAME宏命名)为监视过程指定了Unix域数据报套接字地址。如果未定义或为空，则不会发送任何监视消息。

这是库本身 libforkmonitor.c。
请注意，我将代码简化了很多，省去了多线程初始化(因为很少有库调用任何被拦截的函数，甚至更难从多个线程执行)。最好使用原子内置函数(__sync_bool_compare_and_swap())更新函数指针，并使用原子 setter/getter (__sync_fetch_and_or(，0))检索函数指针，以免出现库问题。 (对于多线程程序，这是相当安全的，因为仅在执行 main()之前修改指针。)

#define  _POSIX_C_SOURCE 200809L
#define  _GNU_SOURCE
#include <stdlib.h>
#include <unistd.h>
#include <sys/types.h>
#include <sys/socket.h>
#include <sys/stat.h>
#include <sys/un.h>
#include <dlfcn.h>
#include <limits.h>
#include <string.h>
#include <stdio.h>
#include <errno.h>
#include "forkmonitor.h"

static pid_t (*actual_fork)(void)  = NULL;
static pid_t (*actual_vfork)(void) = NULL;
static void  (*actual_abort)(void) = NULL;
static void  (*actual__exit)(int)  = NULL;
static void  (*actual__Exit)(int)  = NULL;
static int     commfd = -1;

#define MINIMUM_COMMFD  31

static void notify(const int type, struct message *const msg, const size_t extra)
{
    const int    saved_errno = errno;

    msg->pid  = getpid();
    msg->ppid = getppid();
    msg->sid  = getsid(0);
    msg->pgid = getpgrp();
    msg->uid  = getuid();
    msg->gid  = getgid();
    msg->euid = geteuid();
    msg->egid = getegid();
    msg->len  = extra;
    msg->type = type;

    /* Since we don't have any method of dealing with send() errors
     * or partial send()s, we just fire one off and hope for the best. */
    send(commfd, msg, sizeof (struct message) + extra, MSG_EOR | MSG_NOSIGNAL);

    errno = saved_errno;
}

void libforkmonitor_init(void) __attribute__((constructor));
void libforkmonitor_init(void)
{
    const int saved_errno = errno;
    int       result;

    /* Save the actual fork() call pointer. */
    if (!actual_fork)
        *(void **)&actual_fork = dlsym(RTLD_NEXT, "fork");

    /* Save the actual vfork() call pointer. */
    if (!actual_vfork)
        *(void **)&actual_vfork = dlsym(RTLD_NEXT, "vfork");

    /* Save the actual abort() call pointer. */
    if (!actual_abort)
        *(void **)&actual_abort = dlsym(RTLD_NEXT, "abort");

    /* Save the actual _exit() call pointer. */
    if (!actual__exit)
        *(void **)&actual__exit = dlsym(RTLD_NEXT, "_exit");
    if (!actual__exit)
        *(void **)&actual__exit = dlsym(RTLD_NEXT, "_Exit");

    /* Save the actual abort() call pointer. */
    if (!actual__Exit)
        *(void **)&actual__Exit = dlsym(RTLD_NEXT, "_Exit");
    if (!actual__Exit)
        *(void **)&actual__Exit = dlsym(RTLD_NEXT, "_exit");

    /* Open an Unix domain datagram socket to the observer. */
    if (commfd == -1) {
        const char *address;

        /* Connect to where? */
        address = getenv(FORKMONITOR_ENVNAME);
        if (address && *address) {
            struct sockaddr_un addr;

            memset(&addr, 0, sizeof addr);
            addr.sun_family = AF_UNIX;
            strncpy(addr.sun_path, address, sizeof addr.sun_path - 1);

            /* Create and bind the socket. */
            commfd = socket(AF_UNIX, SOCK_DGRAM, 0);
            if (commfd != -1) {
                if (connect(commfd, (const struct sockaddr *)&addr, sizeof (addr)) == -1) {
                    /* Failed. Close the socket. */
                    do {
                        result = close(commfd);
                    } while (result == -1 && errno == EINTR);
                    commfd = -1;
                }
            }

            /* Move commfd to a high descriptor, to avoid complications. */
            if (commfd != -1 && commfd < MINIMUM_COMMFD) {
                const int newfd = MINIMUM_COMMFD;
                do {
                    result = dup2(commfd, newfd);
                } while (result == -1 && errno == EINTR);
                if (!result) {
                    do {
                        result = close(commfd);
                    } while (result == -1 && errno == EINTR);
                    commfd = newfd;
                }
            }
        }
    }

    /* Send an init message, listing the executable path. */
    if (commfd != -1) {
        size_t          len = 128;
        struct message *msg = NULL;

        while (1) {
            ssize_t n;

            free(msg);
            msg = malloc(sizeof (struct message) + len);
            if (!msg) {
                len = 0;
                break;
            }

            n = readlink("/proc/self/exe", msg->data, len);
            if (n > (ssize_t)0 && (size_t)n < len) {
                msg->data[n] = '\0';
                len = n + 1;
                break;
            }

            len = (3 * len) / 2;
            if (len >= 65536U) {
                free(msg);
                msg = NULL;
                len = 0;
                break;
            }
        }

        if (len > 0) {
            /* INIT message with executable name */
            notify(TYPE_EXEC, msg, len);
            free(msg);
        } else {
            /* INIT message without executable name */
            struct message msg2;
            notify(TYPE_EXEC, &msg2, sizeof msg2);
        }
    }

    /* Restore errno. */
    errno = saved_errno;
}

void libforkmonitor_done(void) __attribute__((destructor));
void libforkmonitor_done(void)
{
    const int saved_errno = errno;
    int       result;

    /* Send an exit message, no data. */
    if (commfd != -1) {
        struct message msg;
        notify(TYPE_DONE, &msg, sizeof msg);
    }

    /* If commfd is open, close it. */
    if (commfd != -1) {
        do {
            result = close(commfd);
        } while (result == -1 && errno == EINTR);
    }

    /* Restore errno. */
    errno = saved_errno;
}

/*
 * Hooked C library functions.
*/

pid_t fork(void)
{
    pid_t result;

    if (!actual_fork) {
        const int saved_errno = errno;

        *(void **)&actual_fork = dlsym(RTLD_NEXT, "fork");
        if (!actual_fork) {
            errno = EAGAIN;
            return (pid_t)-1;
        }

        errno = saved_errno;
    }

    result = actual_fork();
    if (!result && commfd != -1) {
        struct message msg;
        notify(TYPE_FORK, &msg, sizeof msg);
    }

    return result;
}

pid_t vfork(void)
{
    pid_t result;

    if (!actual_vfork) {
        const int saved_errno = errno;

        *(void **)&actual_vfork = dlsym(RTLD_NEXT, "vfork");
        if (!actual_vfork) {
            errno = EAGAIN;
            return (pid_t)-1;
        }

        errno = saved_errno;
    }

    result = actual_vfork();
    if (!result && commfd != -1) {
        struct message msg;
        notify(TYPE_VFORK, &msg, sizeof msg);
    }

    return result;
}

void _exit(const int code)
{
    if (!actual__exit) {
        const int saved_errno = errno;
        *(void **)&actual__exit = dlsym(RTLD_NEXT, "_exit");
        if (!actual__exit)
            *(void **)&actual__exit = dlsym(RTLD_NEXT, "_Exit");
        errno = saved_errno;
    }

    if (commfd != -1) {
        struct {
            struct message  msg;
            int             extra;
        } data;

        memcpy(&data.msg.data[0], &code, sizeof code);
        notify(TYPE_EXIT, &(data.msg), sizeof (struct message) + sizeof (int));
    }

    if (actual__exit)
        actual__exit(code);

    exit(code);
}

void _Exit(const int code)
{
    if (!actual__Exit) {
        const int saved_errno = errno;
        *(void **)&actual__Exit = dlsym(RTLD_NEXT, "_Exit");
        if (!actual__Exit)
            *(void **)&actual__Exit = dlsym(RTLD_NEXT, "_exit");
        errno = saved_errno;
    }

    if (commfd != -1) {
        struct {
            struct message  msg;
            int             extra;
        } data;

        memcpy(&data.msg.data[0], &code, sizeof code);
        notify(TYPE_EXIT, &(data.msg), sizeof (struct message) + sizeof (int));
    }

    if (actual__Exit)
        actual__Exit(code);

    exit(code);
}

void abort(void)
{
    if (!actual_abort) {
        const int saved_errno = errno;
        *(void **)&actual_abort = dlsym(RTLD_NEXT, "abort");
        errno = saved_errno;
    }

    if (commfd != -1) {
        struct message msg;
        notify(TYPE_ABORT, &msg, sizeof msg);
    }

    actual_abort();
    exit(127);
}

在调用进程 libforkmonitor_init()之前，运行时链接程序会自动调用 main()函数，当进程从 libforkmonitor_done()返回或调用 main()时，会调用 exit()。
libforkmonitor_init()将Unix域数据报套接字打开到监视过程，并将其凭据和路径发送到当前可执行文件。每个子进程(只要仍然加载预加载库)都在加载后执行此操作，因此根本不需要捕获 exec*()或 posix_spawn*()或'popen()`等函数。

C库函数 fork()和 vfork()被拦截。需要这些拦截来捕获原始程序派生创建从属进程而无需执行任何其他二进制文件的情况。 (至少GNU C库在内部使用 fork()，因此它们也将捕获 popen()， posix_spawn()等。)

此外，C库函数 _exit()， _Exit()和 abort()也被拦截。我添加这些是因为某些二进制文件(尤其是Dash)喜欢使用 _exit()，并且我认为捕获所有形式的正常导出会很好。 (但是，不会检测到由于信号导致的死亡；并且如果一个二进制文件执行另一个二进制文件，则只会收到新的EXEC消息。请注意该进程和父进程ID。)

这是一个简单的监视程序 forkmonitor.c:

#define  _POSIX_C_SOURCE 200809L
#include <unistd.h>
#include <stdlib.h>
#include <sys/socket.h>
#include <sys/un.h>
#include <signal.h>
#include <pwd.h>
#include <grp.h>
#include <string.h>
#include <stdio.h>
#include <errno.h>
#include "forkmonitor.h"

static volatile sig_atomic_t  done = 0;

static void done_handler(const int signum)
{
    if (!done)
        done = signum;
}

static int catch_done(const int signum)
{
    struct sigaction  act;

    sigemptyset(&act.sa_mask);
    act.sa_handler = done_handler;
    act.sa_flags = 0;

    if (sigaction(signum, &act, NULL) == -1)
        return errno;

    return 0;
}

static const char *username(const uid_t uid)
{
    static char    buffer[128];
    struct passwd *pw;

    pw = getpwuid(uid);
    if (!pw)
        return NULL;

    strncpy(buffer, pw->pw_name, sizeof buffer - 1);
    buffer[sizeof buffer - 1] = '\0';

    return (const char *)buffer;
}

static const char *groupname(const gid_t gid)
{
    static char   buffer[128];
    struct group *gr;

    gr = getgrgid(gid);
    if (!gr)
        return NULL;

    strncpy(buffer, gr->gr_name, sizeof buffer - 1);
    buffer[sizeof buffer - 1] = '\0';

    return (const char *)buffer;
}

int main(int argc, char *argv[])
{
    const size_t    msglen = 65536;
    struct message *msg;
    int             socketfd, result;
    const char     *user, *group;

    if (catch_done(SIGINT) || catch_done(SIGQUIT) || catch_done(SIGHUP) ||
        catch_done(SIGTERM) || catch_done(SIGPIPE)) {
        fprintf(stderr, "Cannot set signal handlers: %s.\n", strerror(errno));
        return 1;
    }

    if (argc != 2 || !strcmp(argv[1], "-h") || !strcmp(argv[1], "--help")) {
        fprintf(stderr, "\n");
        fprintf(stderr, "Usage: %s [ -h | --help ]\n", argv[0]);
        fprintf(stderr, "       %s MONITOR-SOCKET-PATH\n", argv[0]);
        fprintf(stderr, "\n");
        fprintf(stderr, "This program outputs events reported by libforkmonitor\n");
        fprintf(stderr, "to Unix domain datagram sockets at MONITOR-SOCKET-PATH.\n");
        fprintf(stderr, "\n");
        return 0;
    }

    msg = malloc(msglen);
    if (!msg) {
        fprintf(stderr, "Out of memory.\n");
        return 1;
    }

    socketfd = socket(AF_UNIX, SOCK_DGRAM, 0);
    if (socketfd == -1) {
        fprintf(stderr, "Cannot create an Unix domain datagram socket: %s.\n", strerror(errno));
        return 1;
    }

    {
        struct sockaddr_un  addr;
        size_t              len;

        if (argv[1])
            len = strlen(argv[1]);
        else
            len = 0;
        if (len < 1 || len >= UNIX_PATH_MAX) {
            fprintf(stderr, "%s: Path is too long (max. %d characters)\n", argv[1], UNIX_PATH_MAX - 1);
            return 1;
        }

        memset(&addr, 0, sizeof addr);
        addr.sun_family = AF_UNIX;
        memcpy(addr.sun_path, argv[1], len + 1); /* Include '\0' at end */

        if (bind(socketfd, (struct sockaddr *)&addr, sizeof (addr)) == -1) {
            fprintf(stderr, "Cannot bind to %s: %s.\n", argv[1], strerror(errno));
            return 1;
        }
    }

    printf("Waiting for connections.\n");
    printf("\n");

    /* Infinite loop. */
    while (!done) {
        ssize_t  n;

        n = recv(socketfd, msg, msglen, 0);
        if (n == -1) {
            const char *const errmsg = strerror(errno);
            fprintf(stderr, "%s.\n", errmsg);
            fflush(stderr);
            break;
        }

        if (msglen < sizeof (struct message)) {
            fprintf(stderr, "Received a partial message; discarded.\n");
            fflush(stderr);
            continue;
        }

        switch (msg->type) {
        case TYPE_EXEC:
            printf("Received an EXEC message:\n");
            break;
        case TYPE_DONE:
            printf("Received a DONE message:\n");
            break;
        case TYPE_FORK:
            printf("Received a FORK message:\n");
            break;
        case TYPE_VFORK:
            printf("Received a VFORK message:\n");
            break;
        case TYPE_EXIT:
            printf("Received an EXIT message:\n");
            break;
        case TYPE_ABORT:
            printf("Received an ABORT message:\n");
            break;
        default:
            printf("Received an UNKNOWN message:\n");
            break;
        }

        if (msg->type == TYPE_EXEC && (size_t)n > sizeof (struct message)) {
            if (*((char *)msg + n - 1) == '\0')
                printf("\tExecutable:        '%s'\n", (char *)msg + sizeof (struct message));
        }

        printf("\tProcess ID:         %d\n", (int)msg->pid);
        printf("\tParent process ID:  %d\n", (int)msg->ppid);
        printf("\tSession ID:         %d\n", (int)msg->sid);
        printf("\tProcess group ID:   %d\n", (int)msg->pgid);

        user = username(msg->uid);
        if (user)
            printf("\tReal user:         '%s' (%d)\n", user, (int)msg->uid);
        else
            printf("\tReal user:          %d\n", (int)msg->uid);

        group = groupname(msg->gid);
        if (group)
            printf("\tReal group:        '%s' (%d)\n", group, (int)msg->gid);
        else
            printf("\tReal group:         %d\n", (int)msg->gid);

        user = username(msg->euid);
        if (user)
            printf("\tEffective user:    '%s' (%d)\n", user, (int)msg->euid);
        else
            printf("\tEffective user:     %d\n", (int)msg->euid);

        group = groupname(msg->egid);
        if (group)
            printf("\tEffective group:   '%s' (%d)\n", group, (int)msg->egid);
        else
            printf("\tEffective group:    %d\n", (int)msg->egid);

        printf("\n");
        fflush(stdout);
    }

    do {
        result = close(socketfd);
    } while (result == -1 && errno == EINTR);

    unlink(argv[1]);

    return 0;
}

它采用一个命令行参数，即Unix域套接字地址。它应该是绝对文件系统路径。

您可以通过 INT(Ctrl + C)， HUP， QUIT和 TERM信号停止监视程序。

使用编译库

gcc -W -Wall -O3 -fpic -fPIC -c libforkmonitor.c
gcc -shared -Wl,-soname,libforkmonitor.so libforkmonitor.o -ldl -o libforkmonitor.so

和监视程序使用

gcc -W -Wall -O3 forkmonitor.c -o forkmonitor

在一个终端窗口中，首先启动forkmonitor:

./forkmonitor "$PWD/commsocket"

在另一个终端窗口的同一目录中，运行受监视的命令，自动预加载 libforkmonitor.so库并指定监视器的套接字:

env "LD_PRELOAD=$PWD/libforkmonitor.so" "FORKMONITOR_SOCKET=$PWD/commsocket" command args...

请注意，因为这使用了 LD_PRELOAD和 FORKMONITOR_SOCKET环境变量，所以如果子进程的父进程修改了环境(删除了两个环境变量)，并且在执行 setuid或 setgid二进制文件时，它们将被忽略。可以通过消除环境变量并对它们进行硬编码来避免此限制。

除非该库位于标准库目录之一中，并且标记为 setuid，否则运行时链接程序将不会预加载 setgid或 setgid二进制文件的库。

将库名称添加到 /etc/ld.so.preload将为所有二进制文件预加载库，但是您可能应该在 libforkmonitor_init()中添加一种机制，该机制将监视范围限制为所需的二进制文件和/或指定的实际用户(随着有效用户在运行setuid二进制文件时的更改)。

例如，当我运行

env "LD_PRELOAD=$PWD/libforkmonitor.so" "FORKMONITOR_SOCKET=$PWD/commsocket" sh -c 'date ; ls -laF'

监视输出为(匿名):

Received an EXEC message:
Executable:        'bin/dash'
Process ID:         11403
Parent process ID:  9265
Session ID:         9265
Process group ID:   11403
Real user:         'username' (1000)
Real group:        'username' (1000)
Effective user:    'username' (1000)
Effective group:   'username' (1000)

Received a FORK message:
Process ID:         11404
Parent process ID:  11403
Session ID:         9265
Process group ID:   11403
Real user:         'username' (1000)
Real group:        'username' (1000)
Effective user:    'username' (1000)
Effective group:   'username' (1000)

Received an EXEC message:
Executable:        'bin/date'
Process ID:         11404
Parent process ID:  11403
Session ID:         9265
Process group ID:   11403
Real user:         'username' (1000)
Real group:        'username' (1000)
Effective user:    'username' (1000)
Effective group:   'username' (1000)

Received a DONE message:
Process ID:         11404
Parent process ID:  11403
Session ID:         9265
Process group ID:   11403
Real user:         'username' (1000)
Real group:        'username' (1000)
Effective user:    'username' (1000)
Effective group:   'username' (1000)

Received a FORK message:
Process ID:         11405
Parent process ID:  11403
Session ID:         9265
Process group ID:   11403
Real user:         'username' (1000)
Real group:        'username' (1000)
Effective user:    'username' (1000)
Effective group:   'username' (1000)

Received an EXEC message:
Executable:        'bin/ls'
Process ID:         11405
Parent process ID:  11403
Session ID:         9265
Process group ID:   11403
Real user:         'username' (1000)
Real group:        'username' (1000)
Effective user:    'username' (1000)
Effective group:   'username' (1000)

Received a DONE message:
Process ID:         11405
Parent process ID:  11403
Session ID:         9265
Process group ID:   11403
Real user:         'username' (1000)
Real group:        'username' (1000)
Effective user:    'username' (1000)
Effective group:   'username' (1000)

Received an EXIT message:
Process ID:         11403
Parent process ID:  9265
Session ID:         9265
Process group ID:   11403
Real user:         'username' (1000)
Real group:        'username' (1000)
Effective user:    'username' (1000)
Effective group:   'username' (1000)

这是一个非常轻量级的过程树监视解决方案。除了进程启动，退出和调用截获的函数之一( fork()， vfork()， _exit()， _Exit()， abort())以外，程序执行完全不会受到影响。因为该库非常轻巧，所以即使是受影响的库也只会受到非常非常小的影响。可能不足以可靠地进行测量。

显然有可能拦截其他功能，和/或使用双向通信，“暂停”所拦截功能的执行，直到监视应用程序做出响应为止。

总体上存在一些陷阱，特别是与setuid/setgid进程以及生成新环境(忽略 LD_PRELOAD和 FORKMONITOR_SOCKET环境变量)的进程有关的陷阱，但是如果可以使用 super 用户特权，则可以解决这些陷阱。

希望您能找到有用的信息。有什么问题吗