source: trunk/src/samhain_erase.c @ 1

Last change on this file since 1 was 1, checked in by katerina, 16 years ago

Initial import

File size: 3.2 KB
Line 
1/***************************************************************************
2 *
3 * Purpose:
4 * -------
5 *   Hide loaded kernel modules with names including the string MAGIC_HIDE
6
7 *
8 * Configuration:
9 * -------------
10 *   If not building within the samhain system, you may remove the
11 *   line '#include "config.h"' and in the line
12 *   '#define MAGIC_HIDE SH_MAGIC_HIDE', replace SH_MAGIC_HIDE with
13 *   "someString" (in quotes !).
14 */
15
16
17#include "config.h"
18
19#define MAGIC_HIDE SH_MAGIC_HIDE
20
21/*  #define MAGIC_HIDE "someString"              */
22
23/* define this if you have a modversioned kernel */
24/*  #define MODVERSIONS                           */
25
26/*
27 * Install:
28 * -------
29 *   gcc -Wall -O2 -c samhain_erase.c
30 *   mv samhain_hide.o  /lib/modules/KERNEL_VERSION/misc/
31 *   
32 *   (Replace KERNEL_VERSION with your kernel's version.)
33 *
34 * Usage:
35 * -----
36 *   To load the module:
37 *    insmod samhain_hide (for improved safety: 'sync && insmod samhain_hide')
38 *
39 *   To unload the module
40 *    rmmod samhain_hide  (for improved safety: 'sync && rmmod samhain_hide')
41 *
42 *
43 * Tested on:
44 * ---------
45 *   Linux 2.2
46 *
47 * Copyright:
48 * ---------
49 *   Copyright (C) 2001 Rainer Wichmann (http://la-samhna.de)
50 *
51 * License:
52 * -------
53 *   This program is free software; you can redistribute it and/or modify
54 *   it under the terms of the GNU General Public License, version 2, as
55 *   published by the Free Software Foundation.
56 *                                                                         
57 *   This program is distributed in the hope that it will be useful,       
58 *   but WITHOUT ANY WARRANTY; without even the implied warranty of         
59 *   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the         
60 *   GNU General Public License for more details.                           
61 *                                                                         
62 *   You should have received a copy of the GNU General Public License     
63 *   along with this program; if not, write to the Free Software           
64 *   Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.             
65 *
66 ***************************************************************************/
67
68#define __KERNEL__
69#define MODULE
70
71/* The configure options (#defines) for the Kernel
72 */
73#include <linux/config.h>
74
75#ifdef CONFIG_MODVERSIONS
76#include <linux/modversions.h>
77#endif
78
79#include <linux/kernel.h>
80#include <linux/module.h>
81#include <linux/string.h>
82
83#define N_(string) string
84#include "config.h"
85
86#ifdef MODULE_LICENSE
87MODULE_LICENSE("GPL"); 
88#endif
89
90#undef  NULL
91#define NULL ((void *)0)
92
93
94int init_module()
95{
96  struct module * ptr;
97  struct module * prev;
98  int             found  = 0;
99
100  ptr  = &(__this_module);
101  prev = &(__this_module);
102
103  /* skip this module to allow 'rmmod'
104   */
105  ptr  = ptr->next;
106
107  while (ptr)
108    {
109      found = 0;
110
111      if (ptr->name && ptr->name[0] != '\0')
112        {
113          /* printk("%s <%s>\n", ptr->name, SH_MAGIC_HIDE); */
114          if (NULL != strstr(ptr->name, SH_MAGIC_HIDE))
115            {
116              prev->next = ptr->next;
117              /* printk("-->HIDE\n"); */
118              found = 1;
119            }
120        } 
121
122      if (ptr->next)
123        {
124          if (found == 0)
125            prev = ptr;
126          ptr = ptr->next;
127        }
128      else
129        break;
130    }
131
132  return 0;
133}
134
135void cleanup_module()
136{
137        return;
138}
139
140
Note: See TracBrowser for help on using the repository browser.