freebsd-src/filemon/filemon_ktrace.c

/*	$NetBSD: filemon_ktrace.c,v 1.15 2021/07/31 09:30:17 rillig Exp $	*/

/*
 * Copyright (c) 2019 The NetBSD Foundation, Inc.
 * All rights reserved.
 *
 * This code is derived from software contributed to The NetBSD Foundation
 * by Taylor R. Campbell.
 *
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions
 * are met:
 * 1. Redistributions of source code must retain the above copyright
 *    notice, this list of conditions and the following disclaimer.
 * 2. Redistributions in binary form must reproduce the above copyright
 *    notice, this list of conditions and the following disclaimer in the
 *    documentation and/or other materials provided with the distribution.
 *
 * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS
 * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
 * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
 * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS
 * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
 * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
 * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
 * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
 * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
 * POSSIBILITY OF SUCH DAMAGE.
 */

#define _KERNTYPES		/* register_t */

#include "filemon.h"

#include <sys/param.h>
#include <sys/types.h>
#include <sys/rbtree.h>
#include <sys/syscall.h>
#include <sys/time.h>
#include <sys/uio.h>
#include <sys/wait.h>

#include <sys/ktrace.h>

#include <assert.h>
#include <err.h>
#include <errno.h>
#include <fcntl.h>
#include <stdbool.h>
#include <stddef.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <unistd.h>

#ifndef AT_CWD
#define AT_CWD -1
#endif

struct filemon;
struct filemon_key;
struct filemon_state;

typedef struct filemon_state *filemon_syscall_t(struct filemon *,
    const struct filemon_key *, const struct ktr_syscall *);

static filemon_syscall_t filemon_sys_chdir;
static filemon_syscall_t filemon_sys_execve;
static filemon_syscall_t filemon_sys_exit;
static filemon_syscall_t filemon_sys_fork;
static filemon_syscall_t filemon_sys_link;
static filemon_syscall_t filemon_sys_open;
static filemon_syscall_t filemon_sys_openat;
static filemon_syscall_t filemon_sys_symlink;
static filemon_syscall_t filemon_sys_unlink;
static filemon_syscall_t filemon_sys_rename;

static filemon_syscall_t *const filemon_syscalls[] = {
	[SYS_chdir] = &filemon_sys_chdir,
	[SYS_execve] = &filemon_sys_execve,
	[SYS_exit] = &filemon_sys_exit,
	[SYS_fork] = &filemon_sys_fork,
	[SYS_link] = &filemon_sys_link,
	[SYS_open] = &filemon_sys_open,
	[SYS_openat] = &filemon_sys_openat,
	[SYS_symlink] = &filemon_sys_symlink,
	[SYS_unlink] = &filemon_sys_unlink,
	[SYS_rename] = &filemon_sys_rename,
};

struct filemon {
	int			ktrfd;	/* kernel writes ktrace events here */
	FILE			*in;	/* we read ktrace events from here */
	FILE			*out;	/* we write filemon events to here */
	rb_tree_t		active;
	pid_t			child;

	/* I/O state machine.  */
	enum {
		FILEMON_START = 0,
		FILEMON_HEADER,
		FILEMON_PAYLOAD,
		FILEMON_ERROR,
	}			state;
	unsigned char		*p;
	size_t			resid;

	/* I/O buffer.  */
	struct ktr_header	hdr;
	union {
		struct ktr_syscall	syscall;
		struct ktr_sysret	sysret;
		char			namei[PATH_MAX];
		unsigned char		buf[4096];
	}			payload;
};

struct filemon_state {
	struct filemon_key {
		pid_t		pid;
		lwpid_t		lid;
	}		key;
	struct rb_node	node;
	int		syscode;
	void		(*show)(struct filemon *, const struct filemon_state *,
			    const struct ktr_sysret *);
	unsigned	i;
	unsigned	npath;
	char		*path[/*npath*/];
};

/*ARGSUSED*/
static int
compare_filemon_states(void *cookie, const void *na, const void *nb)
{
	const struct filemon_state *Sa = na;
	const struct filemon_state *Sb = nb;

	if (Sa->key.pid < Sb->key.pid)
		return -1;
	if (Sa->key.pid > Sb->key.pid)
		return +1;
	if (Sa->key.lid < Sb->key.lid)
		return -1;
	if (Sa->key.lid > Sb->key.lid)
		return +1;
	return 0;
}

/*ARGSUSED*/
static int
compare_filemon_key(void *cookie, const void *n, const void *k)
{
	const struct filemon_state *S = n;
	const struct filemon_key *key = k;

	if (S->key.pid < key->pid)
		return -1;
	if (S->key.pid > key->pid)
		return +1;
	if (S->key.lid < key->lid)
		return -1;
	if (S->key.lid > key->lid)
		return +1;
	return 0;
}

static const rb_tree_ops_t filemon_rb_ops = {
	.rbto_compare_nodes = &compare_filemon_states,
	.rbto_compare_key = &compare_filemon_key,
	.rbto_node_offset = offsetof(struct filemon_state, node),
	.rbto_context = NULL,
};

/*
 * filemon_path()
 *
 *	Return a pointer to a constant string denoting the `path' of
 *	the filemon.
 */
const char *
filemon_path(void)
{

	return "ktrace";
}

/*
 * filemon_open()
 *
 *	Allocate a filemon descriptor.  Returns NULL and sets errno on
 *	failure.
 */
struct filemon *
filemon_open(void)
{
	struct filemon *F;
	int ktrpipe[2];
	int error;

	/* Allocate and zero a struct filemon object.  */
	F = calloc(1, sizeof *F);
	if (F == NULL)
		return NULL;

	/* Create a pipe for ktrace events.  */
	if (pipe2(ktrpipe, O_CLOEXEC|O_NONBLOCK) == -1) {
		error = errno;
		goto fail0;
	}

	/* Create a file stream for reading the ktrace events.  */
	if ((F->in = fdopen(ktrpipe[0], "r")) == NULL) {
		error = errno;
		goto fail1;
	}
	ktrpipe[0] = -1;	/* claimed by fdopen */

	/*
	 * Set the fd for writing ktrace events and initialize the
	 * rbtree.  The rest can be safely initialized to zero.
	 */
	F->ktrfd = ktrpipe[1];
	rb_tree_init(&F->active, &filemon_rb_ops);

	/* Success!  */
	return F;

fail1:	(void)close(ktrpipe[0]);
	(void)close(ktrpipe[1]);
fail0:	free(F);
	errno = error;
	return NULL;
}

/*
 * filemon_closefd(F)
 *
 *	Internal subroutine to try to flush and close the output file.
 *	If F is not open for output, do nothing.  Never leaves F open
 *	for output even on failure.  Returns 0 on success; sets errno
 *	and return -1 on failure.
 */
static int
filemon_closefd(struct filemon *F)
{
	int error = 0;

	/* If we're not open, nothing to do.  */
	if (F->out == NULL)
		return 0;

	/*
	 * Flush it, close it, and null it unconditionally, but be
	 * careful to return the earliest error in errno.
	 */
	if (fflush(F->out) == EOF && error == 0)
		error = errno;
	if (fclose(F->out) == EOF && error == 0)
		error = errno;
	F->out = NULL;

	/* Set errno and return -1 if anything went wrong.  */
	if (error != 0) {
		errno = error;
		return -1;
	}

	/* Success!  */
	return 0;
}

/*
 * filemon_setfd(F, fd)
 *
 *	Cause filemon activity on F to be sent to fd.  Claims ownership
 *	of fd; caller should not use fd afterward, and any duplicates
 *	of fd may see their file positions changed.
 */
int
filemon_setfd(struct filemon *F, int fd)
{

	/*
	 * Close an existing output file if done.  Fail now if there's
	 * an error closing.
	 */
	if ((filemon_closefd(F)) == -1)
		return -1;
	assert(F->out == NULL);

	/* Open a file stream and claim ownership of the fd.  */
	if ((F->out = fdopen(fd, "a")) == NULL)
		return -1;

	/*
	 * Print the opening output.  Any failure will be deferred
	 * until closing.  For hysterical raisins, we show the parent
	 * pid, not the child pid.
	 */
	fprintf(F->out, "# filemon version 4\n");
	fprintf(F->out, "# Target pid %jd\n", (intmax_t)getpid());
	fprintf(F->out, "V 4\n");

	/* Success!  */
	return 0;
}

/*
 * filemon_setpid_parent(F, pid)
 *
 *	Set the traced pid, from the parent.  Never fails.
 */
void
filemon_setpid_parent(struct filemon *F, pid_t pid)
{

	F->child = pid;
}

/*
 * filemon_setpid_child(F, pid)
 *
 *	Set the traced pid, from the child.  Returns 0 on success; sets
 *	errno and returns -1 on failure.
 */
int
filemon_setpid_child(const struct filemon *F, pid_t pid)
{
	int ops, trpoints;

	ops = KTROP_SET|KTRFLAG_DESCEND;
	trpoints = KTRFACv2;
	trpoints |= KTRFAC_SYSCALL|KTRFAC_NAMEI|KTRFAC_SYSRET;
	trpoints |= KTRFAC_INHERIT;
	if (fktrace(F->ktrfd, ops, trpoints, pid) == -1)
		return -1;

	return 0;
}

/*
 * filemon_close(F)
 *
 *	Close F for output if necessary, and free a filemon descriptor.
 *	Returns 0 on success; sets errno and returns -1 on failure, but
 *	frees the filemon descriptor either way;
 */
int
filemon_close(struct filemon *F)
{
	struct filemon_state *S;
	int error = 0;

	/* Close for output.  */
	if (filemon_closefd(F) == -1 && error == 0)
		error = errno;

	/* Close the ktrace pipe.  */
	if (fclose(F->in) == EOF && error == 0)
		error = errno;
	if (close(F->ktrfd) == -1 && error == 0)
		error = errno;

	/* Free any active records.  */
	while ((S = RB_TREE_MIN(&F->active)) != NULL) {
		rb_tree_remove_node(&F->active, S);
		free(S);
	}

	/* Free the filemon descriptor.  */
	free(F);

	/* Set errno and return -1 if anything went wrong.  */
	if (error != 0) {
		errno = error;
		return -1;
	}

	/* Success!  */
	return 0;
}

/*
 * filemon_readfd(F)
 *
 *	Returns a file descriptor which will select/poll ready for read
 *	when there are filemon events to be processed by
 *	filemon_process, or -1 if anything has gone wrong.
 */
int
filemon_readfd(const struct filemon *F)
{

	if (F->state == FILEMON_ERROR)
		return -1;
	return fileno(F->in);
}

/*
 * filemon_dispatch(F)
 *
 *	Internal subroutine to dispatch a filemon ktrace event.
 *	Silently ignore events that we don't recognize.
 */
static void
filemon_dispatch(struct filemon *F)
{
	const struct filemon_key key = {
		.pid = F->hdr.ktr_pid,
		.lid = F->hdr.ktr_lid,
	};
	struct filemon_state *S;

	switch (F->hdr.ktr_type) {
	case KTR_SYSCALL: {
		struct ktr_syscall *call = &F->payload.syscall;
		struct filemon_state *S1;

		/* Validate the syscall code.  */
		if (call->ktr_code < 0 ||
		    (size_t)call->ktr_code >= __arraycount(filemon_syscalls) ||
		    filemon_syscalls[call->ktr_code] == NULL)
			break;

		/*
		 * Invoke the syscall-specific logic to create a new
		 * active state.
		 */
		S = (*filemon_syscalls[call->ktr_code])(F, &key, call);
		if (S == NULL)
			break;

		/*
		 * Insert the active state, or ignore it if there
		 * already is one.
		 *
		 * Collisions shouldn't happen because the states are
		 * keyed by <pid,lid>, in which syscalls should happen
		 * sequentially in CALL/RET pairs, but let's be
		 * defensive.
		 */
		S1 = rb_tree_insert_node(&F->active, S);
		if (S1 != S) {
			/* XXX Which one to drop?  */
			free(S);
			break;
		}
		break;
	}
	case KTR_NAMEI:
		/* Find an active syscall state, or drop it.  */
		S = rb_tree_find_node(&F->active, &key);
		if (S == NULL)
			break;
		/* Find the position of the next path, or drop it.  */
		if (S->i >= S->npath)
			break;
		/* Record the path.  */
		S->path[S->i++] = strndup(F->payload.namei,
		    sizeof F->payload.namei);
		break;
	case KTR_SYSRET: {
		struct ktr_sysret *ret = &F->payload.sysret;
		unsigned i;

		/* Find and remove an active syscall state, or drop it.  */
		S = rb_tree_find_node(&F->active, &key);
		if (S == NULL)
			break;
		rb_tree_remove_node(&F->active, S);

		/*
		 * If the active syscall state matches this return,
		 * invoke the syscall-specific logic to show a filemon
		 * event.
		 */
		/* XXX What to do if syscall code doesn't match?  */
		if (S->i == S->npath && S->syscode == ret->ktr_code)
			S->show(F, S, ret);

		/* Free the state now that it is no longer active.  */
		for (i = 0; i < S->i; i++)
			free(S->path[i]);
		free(S);
		break;
	}
	default:
		/* Ignore all other ktrace events.  */
		break;
	}
}

/*
 * filemon_process(F)
 *
 *	Process all pending events after filemon_readfd(F) has
 *	selected/polled ready for read.
 *
 *	Returns -1 on failure, 0 on end of events, and anything else if
 *	there may be more events.
 *
 *	XXX What about fairness to other activities in the event loop?
 *	If we stop while there's events buffered in F->in, then select
 *	or poll may not return ready even though there's work queued up
 *	in the buffer of F->in, but if we don't stop then ktrace events
 *	may overwhelm all other activity in the event loop.
 */
int
filemon_process(struct filemon *F)
{
	size_t nread;

top:	/* If the child has exited, nothing to do.  */
	/* XXX What if one thread calls exit while another is running?  */
	if (F->child == 0)
		return 0;

	/* If we're waiting for input, read some.  */
	if (F->resid > 0) {
		nread = fread(F->p, 1, F->resid, F->in);
		if (nread == 0) {
			if (feof(F->in) != 0)
				return 0;
			assert(ferror(F->in) != 0);
			/*
			 * If interrupted or would block, there may be
			 * more events.  Otherwise fail.
			 */
			if (errno == EAGAIN || errno == EINTR)
				return 1;
			F->state = FILEMON_ERROR;
			F->p = NULL;
			F->resid = 0;
			return -1;
		}
		assert(nread <= F->resid);
		F->p += nread;
		F->resid -= nread;
		if (F->resid > 0)	/* may be more events */
			return 1;
	}

	/* Process a state transition now that we've read a buffer.  */
	switch (F->state) {
	case FILEMON_START:	/* just started filemon; read header next */
		F->state = FILEMON_HEADER;
		F->p = (void *)&F->hdr;
		F->resid = sizeof F->hdr;
		goto top;
	case FILEMON_HEADER:	/* read header */
		/* Sanity-check ktrace header; then read payload.  */
		if (F->hdr.ktr_len < 0 ||
		    (size_t)F->hdr.ktr_len > sizeof F->payload) {
			F->state = FILEMON_ERROR;
			F->p = NULL;
			F->resid = 0;
			errno = EIO;
			return -1;
		}
		F->state = FILEMON_PAYLOAD;
		F->p = (void *)&F->payload;
		F->resid = (size_t)F->hdr.ktr_len;
		goto top;
	case FILEMON_PAYLOAD:	/* read header and payload */
		/* Dispatch ktrace event; then read next header.  */
		filemon_dispatch(F);
		F->state = FILEMON_HEADER;
		F->p = (void *)&F->hdr;
		F->resid = sizeof F->hdr;
		goto top;
	default:		/* paranoia */
		F->state = FILEMON_ERROR;
		/*FALLTHROUGH*/
	case FILEMON_ERROR:	/* persistent error indicator */
		F->p = NULL;
		F->resid = 0;
		errno = EIO;
		return -1;
	}
}

static struct filemon_state *
syscall_enter(
    const struct filemon_key *key, const struct ktr_syscall *call,
    unsigned npath,
    void (*show)(struct filemon *, const struct filemon_state *,
	const struct ktr_sysret *))
{
	struct filemon_state *S;
	unsigned i;

	S = calloc(1, offsetof(struct filemon_state, path[npath]));
	if (S == NULL)
		return NULL;
	S->key = *key;
	S->show = show;
	S->syscode = call->ktr_code;
	S->i = 0;
	S->npath = npath;
	for (i = 0; i < npath; i++)
		 S->path[i] = NULL; /* paranoia */

	return S;
}

static void
show_paths(struct filemon *F, const struct filemon_state *S,
    const struct ktr_sysret *ret, const char *prefix)
{
	unsigned i;

	/* Caller must ensure all paths have been specified.  */
	assert(S->i == S->npath);

	/*
	 * Ignore it if it failed or yielded EJUSTRETURN (-2), or if
	 * we're not producing output.
	 */
	if (ret->ktr_error != 0 && ret->ktr_error != -2)
		return;
	if (F->out == NULL)
		return;

	/*
	 * Print the prefix, pid, and paths -- with the paths quoted if
	 * there's more than one.
	 */
	fprintf(F->out, "%s %jd", prefix, (intmax_t)S->key.pid);
	for (i = 0; i < S->npath; i++) {
		const char *q = S->npath > 1 ? "'" : "";
		fprintf(F->out, " %s%s%s", q, S->path[i], q);
	}
	fprintf(F->out, "\n");
}

static void
show_retval(struct filemon *F, const struct filemon_state *S,
    const struct ktr_sysret *ret, const char *prefix)
{

	/*
	 * Ignore it if it failed or yielded EJUSTRETURN (-2), or if
	 * we're not producing output.
	 */
	if (ret->ktr_error != 0 && ret->ktr_error != -2)
		return;
	if (F->out == NULL)
		return;

	fprintf(F->out, "%s %jd %jd\n", prefix, (intmax_t)S->key.pid,
	    (intmax_t)ret->ktr_retval);
}

static void
show_chdir(struct filemon *F, const struct filemon_state *S,
    const struct ktr_sysret *ret)
{
	show_paths(F, S, ret, "C");
}

static void
show_execve(struct filemon *F, const struct filemon_state *S,
    const struct ktr_sysret *ret)
{
	show_paths(F, S, ret, "E");
}

static void
show_fork(struct filemon *F, const struct filemon_state *S,
    const struct ktr_sysret *ret)
{
	show_retval(F, S, ret, "F");
}

static void
show_link(struct filemon *F, const struct filemon_state *S,
    const struct ktr_sysret *ret)
{
	show_paths(F, S, ret, "L"); /* XXX same as symlink */
}

static void
show_open_read(struct filemon *F, const struct filemon_state *S,
    const struct ktr_sysret *ret)
{
	show_paths(F, S, ret, "R");
}

static void
show_open_write(struct filemon *F, const struct filemon_state *S,
    const struct ktr_sysret *ret)
{
	show_paths(F, S, ret, "W");
}

static void
show_open_readwrite(struct filemon *F, const struct filemon_state *S,
    const struct ktr_sysret *ret)
{
	show_paths(F, S, ret, "R");
	show_paths(F, S, ret, "W");
}

static void
show_openat_read(struct filemon *F, const struct filemon_state *S,
    const struct ktr_sysret *ret)
{
	if (S->path[0][0] != '/')
		show_paths(F, S, ret, "A");
	show_paths(F, S, ret, "R");
}

static void
show_openat_write(struct filemon *F, const struct filemon_state *S,
    const struct ktr_sysret *ret)
{
	if (S->path[0][0] != '/')
		show_paths(F, S, ret, "A");
	show_paths(F, S, ret, "W");
}

static void
show_openat_readwrite(struct filemon *F, const struct filemon_state *S,
    const struct ktr_sysret *ret)
{
	if (S->path[0][0] != '/')
		show_paths(F, S, ret, "A");
	show_paths(F, S, ret, "R");
	show_paths(F, S, ret, "W");
}

static void
show_symlink(struct filemon *F, const struct filemon_state *S,
    const struct ktr_sysret *ret)
{
	show_paths(F, S, ret, "L"); /* XXX same as link */
}

static void
show_unlink(struct filemon *F, const struct filemon_state *S,
    const struct ktr_sysret *ret)
{
	show_paths(F, S, ret, "D");
}

static void
show_rename(struct filemon *F, const struct filemon_state *S,
    const struct ktr_sysret *ret)
{
	show_paths(F, S, ret, "M");
}

/*ARGSUSED*/
static struct filemon_state *
filemon_sys_chdir(struct filemon *F, const struct filemon_key *key,
    const struct ktr_syscall *call)
{
	return syscall_enter(key, call, 1, &show_chdir);
}

/* TODO: monitor fchdir as well */

/*ARGSUSED*/
static struct filemon_state *
filemon_sys_execve(struct filemon *F, const struct filemon_key *key,
    const struct ktr_syscall *call)
{
	return syscall_enter(key, call, 1, &show_execve);
}

static struct filemon_state *
filemon_sys_exit(struct filemon *F, const struct filemon_key *key,
    const struct ktr_syscall *call)
{
	const register_t *args = (const void *)&call[1];
	int status = (int)args[0];

	if (F->out != NULL) {
		fprintf(F->out, "X %jd %d\n", (intmax_t)key->pid, status);
		if (key->pid == F->child) {
			fprintf(F->out, "# Bye bye\n");
			F->child = 0;
		}
	}
	return NULL;
}

/*ARGSUSED*/
static struct filemon_state *
filemon_sys_fork(struct filemon *F, const struct filemon_key *key,
    const struct ktr_syscall *call)
{
	return syscall_enter(key, call, 0, &show_fork);
}

/*ARGSUSED*/
static struct filemon_state *
filemon_sys_link(struct filemon *F, const struct filemon_key *key,
    const struct ktr_syscall *call)
{
	return syscall_enter(key, call, 2, &show_link);
}

/*ARGSUSED*/
static struct filemon_state *
filemon_sys_open(struct filemon *F, const struct filemon_key *key,
    const struct ktr_syscall *call)
{
	const register_t *args = (const void *)&call[1];
	int flags;

	if (call->ktr_argsize < 2)
		return NULL;
	flags = (int)args[1];

	if ((flags & O_RDWR) == O_RDWR)
		return syscall_enter(key, call, 1, &show_open_readwrite);
	else if ((flags & O_WRONLY) == O_WRONLY)
		return syscall_enter(key, call, 1, &show_open_write);
	else if ((flags & O_RDONLY) == O_RDONLY)
		return syscall_enter(key, call, 1, &show_open_read);
	else
		return NULL;	/* XXX Do we care if no read or write?  */
}

/*ARGSUSED*/
static struct filemon_state *
filemon_sys_openat(struct filemon *F, const struct filemon_key *key,
    const struct ktr_syscall *call)
{
	const register_t *args = (const void *)&call[1];
	int flags, fd;

	/*
	 * XXX: In the .meta log, the base directory is missing, which makes
	 * all references to relative pathnames useless.
	 */

	if (call->ktr_argsize < 3)
		return NULL;
	fd = (int)args[0];
	flags = (int)args[2];

	if (fd == AT_CWD) {
		if ((flags & O_RDWR) == O_RDWR)
			return syscall_enter(key, call, 1,
			    &show_open_readwrite);
		else if ((flags & O_WRONLY) == O_WRONLY)
			return syscall_enter(key, call, 1, &show_open_write);
		else if ((flags & O_RDONLY) == O_RDONLY)
			return syscall_enter(key, call, 1, &show_open_read);
		else
			return NULL;
	} else {
		if ((flags & O_RDWR) == O_RDWR)
			return syscall_enter(key, call, 1,
			    &show_openat_readwrite);
		else if ((flags & O_WRONLY) == O_WRONLY)
			return syscall_enter(key, call, 1, &show_openat_write);
		else if ((flags & O_RDONLY) == O_RDONLY)
			return syscall_enter(key, call, 1, &show_openat_read);
		else
			return NULL;
	}
}

/* TODO: monitor the other *at syscalls as well, not only openat. */

/*ARGSUSED*/
static struct filemon_state *
filemon_sys_symlink(struct filemon *F, const struct filemon_key *key,
    const struct ktr_syscall *call)
{
	return syscall_enter(key, call, 2, &show_symlink);
}

/*ARGSUSED*/
static struct filemon_state *
filemon_sys_unlink(struct filemon *F, const struct filemon_key *key,
    const struct ktr_syscall *call)
{
	return syscall_enter(key, call, 1, &show_unlink);
}

/*ARGSUSED*/
static struct filemon_state *
filemon_sys_rename(struct filemon *F, const struct filemon_key *key,
    const struct ktr_syscall *call)
{
	return syscall_enter(key, call, 2, &show_rename);
}