source: trunk/src/samhain_erase.c @ 443

Last change on this file since 443 was 443, checked in by katerina, 8 years ago

Fix for ticket #347 (the --enable-khide option does not work on Linux 3.x)

File size: 3.5 KB
Line 
1/***************************************************************************
2 *
3 * Purpose:
4 * -------
5 *   Hide loaded kernel modules with names including the string MAGIC_HIDE
6
7 *
8 * Configuration:
9 * -------------
10 *   If not building within the samhain system, you may remove the
11 *   line '#include "config.h"' and in the line
12 *   '#define MAGIC_HIDE SH_MAGIC_HIDE', replace SH_MAGIC_HIDE with
13 *   "someString" (in quotes !).
14 */
15
16
17#include "config.h"
18
19#define MAGIC_HIDE SH_MAGIC_HIDE
20
21/*  #define MAGIC_HIDE "someString"              */
22
23/* define this if you have a modversioned kernel */
24/*  #define MODVERSIONS                           */
25
26/*
27 * Install:
28 * -------
29 *   gcc -Wall -O2 -c samhain_erase.c
30 *   mv samhain_hide.o  /lib/modules/KERNEL_VERSION/misc/
31 *   
32 *   (Replace KERNEL_VERSION with your kernel's version.)
33 *
34 * Usage:
35 * -----
36 *   To load the module:
37 *    insmod samhain_hide (for improved safety: 'sync && insmod samhain_hide')
38 *
39 *   To unload the module
40 *    rmmod samhain_hide  (for improved safety: 'sync && rmmod samhain_hide')
41 *
42 *
43 * Tested on:
44 * ---------
45 *   Linux 2.2
46 *
47 * Copyright:
48 * ---------
49 *   Copyright (C) 2001 Rainer Wichmann (http://la-samhna.de)
50 *
51 * License:
52 * -------
53 *   This program is free software; you can redistribute it and/or modify
54 *   it under the terms of the GNU General Public License, version 2, as
55 *   published by the Free Software Foundation.
56 *                                                                         
57 *   This program is distributed in the hope that it will be useful,       
58 *   but WITHOUT ANY WARRANTY; without even the implied warranty of         
59 *   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the         
60 *   GNU General Public License for more details.                           
61 *                                                                         
62 *   You should have received a copy of the GNU General Public License     
63 *   along with this program; if not, write to the Free Software           
64 *   Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.             
65 *
66 ***************************************************************************/
67
68#define __KERNEL__
69#define MODULE
70
71/* The configure options (#defines) for the Kernel
72 */
73#define KERNEL_VERSION(a,b,c) (((a) << 16) + ((b) << 8) + (c))
74
75#if SH_KERNEL_NUMERIC >= KERNEL_VERSION(2,6,33)
76#include <generated/autoconf.h>
77#else
78#if SH_KERNEL_NUMERIC >= KERNEL_VERSION(2,6,19)
79#include <linux/autoconf.h>
80#else
81#include <linux/config.h>
82#ifdef CONFIG_MODVERSIONS
83#include <linux/modversions.h>
84#endif
85#endif
86#endif
87
88#include <linux/kernel.h>
89#include <linux/module.h>
90#include <linux/string.h>
91
92#define N_(string) string
93#include "config.h"
94
95#ifdef MODULE_LICENSE
96MODULE_LICENSE("GPL"); 
97#endif
98
99#undef  NULL
100#define NULL ((void *)0)
101
102
103int init_module()
104{
105  struct module * ptr;
106  struct module * prev;
107  int             found  = 0;
108
109  ptr  = &(__this_module);
110  prev = &(__this_module);
111
112  /* skip this module to allow 'rmmod'
113   */
114  ptr  = ptr->next;
115
116  while (ptr)
117    {
118      found = 0;
119
120      if (ptr->name && ptr->name[0] != '\0')
121        {
122          /* printk("%s <%s>\n", ptr->name, SH_MAGIC_HIDE); */
123          if (NULL != strstr(ptr->name, SH_MAGIC_HIDE))
124            {
125              prev->next = ptr->next;
126              /* printk("-->HIDE\n"); */
127              found = 1;
128            }
129        } 
130
131      if (ptr->next)
132        {
133          if (found == 0)
134            prev = ptr;
135          ptr = ptr->next;
136        }
137      else
138        break;
139    }
140
141  return 0;
142}
143
144void cleanup_module()
145{
146        return;
147}
148
149
Note: See TracBrowser for help on using the repository browser.