source: trunk/src/samhain_hide.c@ 39

Last change on this file since 39 was 6, checked in by rainer, 19 years ago

Fix samhain_hide for kernel 2.6.14
File size: 17.6 KB
Line 
1/***************************************************************************
2 *
3 * Purpose:
4 * -------
5 * (1) Hide files with the string MAGIC_HIDE in filename,
6 * where MAGIC_HIDE is defined below.
7 * By default, MAGIC_HIDE is defined as "samhain".
8 *
9 * (2) Hide all processes, if the executable has the string MAGIC_HIDE
10 * in its name.
11 *
12 *
13 * Configuration:
14 * -------------
15 * If not building within the samhain system, you may remove the
16 * line '#include "config.h"' and in the line
17 * '#define MAGIC_HIDE SH_MAGIC_HIDE', replace SH_MAGIC_HIDE with
18 * "someString" (in quotes !).
19 */
20
21/* #define _(string) string */
22#include "config.h"
23
24#undef _
25#define _(string) string
26
27/* define if this is a 2.6 kernel */
28/* #define LINUX26 */
29
30#define MAGIC_HIDE SH_MAGIC_HIDE
31
32/* #define MAGIC_HIDE "someString" */
33
34/* define this if you have a modversioned kernel */
35/* #define MODVERSIONS */
36
37/* the address of the sys_call_table (not exported in 2.5 kernels) */
38#define MAGIC_ADDRESS SH_SYSCALLTABLE
39
40/*
41 * Install:
42 * -------
43 * gcc -Wall -O2 -c samhain_hide.c
44 * mv samhain_hide.o /lib/modules/KERNEL_VERSION/misc/
45 *
46 * (Replace KERNEL_VERSION with your kernel's version.)
47 *
48 * Usage:
49 * -----
50 * To load the module:
51 * insmod samhain_hide (for improved safety: 'sync && insmod samhain_hide')
52 *
53 * To unload the module
54 * rmmod samhain_hide (for improved safety: 'sync && rmmod samhain_hide')
55 *
56 *
57 * Details:
58 * -------
59 * The following kernel syscalls are replaced:
60 * sys_getdents [hide files/directories/processes (/proc/PID)]
61 *
62 * Tested on:
63 * ---------
64 * Linux 2.2, 2.4, 2.6
65 *
66 * Copyright:
67 * ---------
68 * Copyright (C) 2001, 2002 Rainer Wichmann (http://la-samhna.de)
69 *
70 * License:
71 * -------
72 * This program is free software; you can redistribute it and/or modify
73 * it under the terms of the GNU General Public License, version 2, as
74 * published by the Free Software Foundation.
75 *
76 * This program is distributed in the hope that it will be useful,
77 * but WITHOUT ANY WARRANTY; without even the implied warranty of
78 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
79 * GNU General Public License for more details.
80 *
81 * You should have received a copy of the GNU General Public License
82 * along with this program; if not, write to the Free Software
83 * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
84 *
85 ***************************************************************************/
86
87
88
89/*****************************************************
90 *
91 * The defines:
92 *
93 *****************************************************/
94
95/* This is a Linux Loadable Kernel Module.
96 */
97
98#ifndef LINUX26
99#define __KERNEL__
100#define MODULE
101#endif
102#define LINUX
103
104/* Define for debugging.
105 */
106/* #define HIDE_DEBUG */ /* query_module */
107/* #define FILE_DEBUG */ /* getdents */
108/* #define READ_DEBUG */ /* read */
109/* #define PROC_DEBUG */ /* procfs */
110
111
112/*****************************************************
113 *
114 * The include files:
115 *
116 *****************************************************/
117
118
119/* The configure options (#defines) for the Kernel
120 */
121#include <linux/config.h>
122
123#ifndef LINUX26
124#ifdef CONFIG_MODVERSIONS
125#include <linux/modversions.h>
126#endif
127#endif
128
129
130#ifdef LINUX26
131#include <linux/init.h>
132#endif
133
134#include <linux/module.h>
135
136/* File tables structures. If directory caching is used,
137 * <linux/dcache.h> will be included here, and __LINUX_DCACHE_H
138 * will thus be defined.
139 */
140#include <linux/fs.h>
141#include <linux/proc_fs.h>
142
143/* Include the SYS_syscall defines.
144 */
145#ifndef LINUX26
146#include <sys/syscall.h>
147#else
148#define SYS_getdents 141
149#define SYS_getdents64 220
150#endif
151
152
153/* Includes for 'getdents' per the manpage.
154 */
155#include <linux/types.h>
156#include <linux/dirent.h>
157#include <linux/unistd.h>
158
159/* To access userspace memory.
160 */
161#include <asm/uaccess.h>
162
163/* Include for lock_kernel().
164 */
165#include <linux/smp_lock.h>
166
167/* Include for fget().
168 */
169#include <linux/file.h>
170
171/*****************************************************
172 *
173 * The global variables:
174 *
175 *****************************************************/
176
177/* The kernel syscall table. Not exported anymore in 2.5 ff., and also
178 * not in the RedHat 2.4 kernel.
179 */
180
181#if 0
182extern void * sys_call_table[];
183#define sh_sys_call_table sys_call_table
184#endif
185
186unsigned long * sh_sys_call_table = (unsigned long *) MAGIC_ADDRESS;
187
188/* The old address of the sys_getdents syscall.
189 */
190int (*old_getdents)(unsigned int, struct dirent *, unsigned int);
191#ifdef __NR_getdents64
192long (*old_getdents64)(unsigned int, struct dirent64 *, unsigned int);
193#endif
194
195char hidden[] = MAGIC_HIDE;
196
197
198/*****************************************************
199 *
200 * The functions:
201 *
202 *****************************************************/
203
204
205MODULE_AUTHOR("Rainer Wichmann");
206MODULE_DESCRIPTION("Hide files/processes/modules with MAGIC_HIDE in name.");
207#if defined(MODULE_LICENSE) || defined(LINUX26)
208MODULE_LICENSE("GPL");
209#endif
210
211#ifdef LINUX26
212/* Default is to hide ourselves.
213 */
214static int removeme = 1;
215
216MODULE_PARM (removeme, "i");
217#endif
218
219
220/*
221 * struct task_struct is defined in linux/sched.h
222 *
223 * as of 2.4.20, the vanilla kernel holds (among others):
224 * struct task_struct *next_task, *prev_task;
225 *
226 * Redhat kernel seems to have a different scheduler.
227 * use:
228 * struct task_struct * find_task_by_pid (int pid);
229 */
230
231#if defined(SH_VANILLA_KERNEL) && !defined(LINUX26)
232/*
233 * Fetch the task struct for a given PID.
234 */
235struct task_struct * fetch_task_struct (int pid)
236{
237 struct task_struct * task_ptr;
238
239#ifdef PROC_DEBUG
240 printk("FETCH TASK %d\n", pid);
241#endif
242
243 task_ptr = current;
244
245 do
246 {
247 if (task_ptr->pid == (pid_t) pid )
248 return (task_ptr);
249 task_ptr = task_ptr->next_task;
250 }
251 while (task_ptr != current);
252
253#ifdef PROC_DEBUG
254 printk("FETCH TASK: NOT FOUND !!!\n");
255#endif
256
257 return (NULL);
258}
259
260#else
261/*
262 * RedHat 2.4.20 kernel
263 */
264struct task_struct * fetch_task_struct (int pid)
265{
266 struct task_struct * task_ptr = NULL;
267 task_ptr = find_task_by_pid (pid);
268 return (task_ptr);
269}
270#endif
271
272/* Convert a string to an int.
273 * Does not recognize integers with a sign (+/-) in front.
274 */
275int my_atoi(char * in_str)
276{
277 int i = 0;
278 int retval = 0;
279 int conv = 0;
280
281 if (in_str == NULL)
282 return (-1);
283
284 while(in_str[i] != '\0')
285 {
286 /* Break if not numeric.
287 */
288 if (in_str[i] < '0' || in_str[i] > '9')
289 break;
290
291 ++conv;
292
293 /* Leading zeroes (should not happen in /proc)
294 */
295 if (retval == 0 && in_str[i] == '0')
296 retval = retval;
297 else
298 retval = retval * 10;
299
300 retval = retval + (in_str[i] - '0');
301
302 i++;
303 }
304
305 if (conv == 0)
306 return (-1);
307 else
308 return (retval);
309}
310
311/* Purpose:
312 *
313 * Hide all files/dirs that include the string MAGIC_HIDE in their
314 * name.
315 */
316int new_getdents (unsigned int fd, struct dirent *dirp, unsigned int count)
317{
318 int status = 0; /* Return value from original getdents */
319 struct inode * dir_inode;
320 struct file * fd_file;
321 int dir_is_proc = 0;
322
323 struct dirent * dirp_prev;
324 struct dirent * dirp_new;
325 struct dirent * dirp_current;
326
327 int dir_table_bytes;
328 int forward_bytes;
329 struct task_struct * task_ptr;
330 int hide_it = 0;
331 long dirp_offset;
332
333 lock_kernel();
334
335 status = (*old_getdents)(fd, dirp, count);
336
337#ifdef FILE_DEBUG
338 printk("STATUS %d\n", status);
339#endif
340
341 /* 0: end of directory.
342 * -1: some error
343 */
344 if (status <= 0)
345 {
346 unlock_kernel();
347 return (status);
348 }
349
350 /* Handle directory caching. dir_inode is the inode of the directory.
351 */
352#if defined(files_fdtable)
353 {
354 struct fdtable *fdt = files_fdtable(current->files);
355 fd_file = rcu_dereference(fdt->fd[fd]);
356 }
357#else
358 {
359 fd_file = current->files->fd[fd];
360 }
361#endif
362
363#if defined(__LINUX_DCACHE_H)
364 dir_inode = fd_file->f_dentry->d_inode;
365#else
366 dir_inode = fd_file->f_inode;
367#endif
368
369 /* Check for the /proc directory
370 */
371 if (dir_inode->i_ino == PROC_ROOT_INO
372#ifndef LINUX26
373 && !MAJOR(dir_inode->i_dev) &&
374 MINOR(dir_inode->i_dev) == 1
375#endif
376 )
377 dir_is_proc = 1;
378
379 /* Allocate space for new dirent table. Can't use GFP_KERNEL
380 * (kernel oops)
381 */
382 dirp_new = (struct dirent *) kmalloc (status, GFP_ATOMIC);
383
384 if (dirp_new == NULL)
385 {
386 unlock_kernel();
387 return (status);
388 }
389
390 /* Copy the dirp table to kernel space.
391 */
392 copy_from_user(dirp_new, dirp, status);
393
394#ifdef FILE_DEBUG
395 printk("COPY to kernel\n");
396#endif
397
398 /* Loop over the dirp table to find entries to hide.
399 */
400 dir_table_bytes = status;
401 dirp_current = dirp_new;
402 dirp_prev = NULL;
403
404 while (dir_table_bytes > 0)
405 {
406 hide_it = 0;
407
408 if (dirp_current->d_reclen == 0)
409 break;
410
411 dirp_offset = dirp_current->d_off;
412
413#ifdef FILE_DEBUG
414 printk("DIRENT %d %d %ld\n",
415 dir_table_bytes,
416 dirp_current->d_reclen,
417 dirp_current->d_off);
418#endif
419
420 dir_table_bytes -= dirp_current->d_reclen;
421 forward_bytes = dirp_current->d_reclen;
422
423#ifdef FILE_DEBUG
424 printk("ENTRY %s\n", dirp_current->d_name);
425#endif
426
427 /* If /proc is scanned (e.g. by 'ps'), hide the entry for
428 * any process where the executable has MAGIC_HIDE in its name.
429 */
430 if (dir_is_proc == 1)
431 {
432 task_ptr = fetch_task_struct(my_atoi(dirp_current->d_name));
433 if (task_ptr != NULL)
434 {
435 if (strstr(task_ptr->comm, hidden) != NULL)
436 hide_it = 1;
437 }
438 }
439 /* If it is a regular directory, hide any entry with
440 * MAGIC_HIDE in its name.
441 */
442 else
443 {
444 if (strstr (dirp_current->d_name, hidden) != NULL)
445 hide_it = 1;
446 }
447
448 if (hide_it == 1)
449 {
450#ifdef FILE_DEBUG
451 printk(" -->HIDDEN %s\n", dirp_current->d_name);
452#endif
453 if (dir_table_bytes > 0)
454 {
455 status -= dirp_current->d_reclen;
456 memmove (dirp_current,
457 (char *) dirp_current + dirp_current->d_reclen,
458 dir_table_bytes);
459
460 /* Set forward_bytes to 0, because now dirp_current is the
461 * (previously) next entry in the dirp table.
462 */
463 forward_bytes = 0;
464 dirp_prev = dirp_current;
465 }
466 else
467 {
468 status -= dirp_current->d_reclen;
469 if (dirp_prev != NULL)
470 dirp_prev->d_off = dirp_offset;
471 }
472
473 }
474 else
475 {
476 dirp_prev = dirp_current;
477 if (dir_table_bytes == 0 && dirp_prev != NULL)
478 dirp_prev->d_off = dirp_offset;
479 }
480
481 /* Next entry in dirp table.
482 */
483 if (dir_table_bytes > 0)
484 dirp_current = (struct dirent *) ( (char *) dirp_current +
485 forward_bytes);
486 }
487
488 /* Copy our modified dirp table back to user space.
489 */
490 copy_to_user(dirp, dirp_new, status);
491#ifdef FILE_DEBUG
492 printk("COPY to user\n");
493#endif
494
495 kfree (dirp_new);
496#ifdef FILE_DEBUG
497 printk("KFREE\n");
498#endif
499
500 unlock_kernel();
501 return (status);
502}
503
504
505/* For 2.4 kernel
506 */
507#ifdef __NR_getdents64
508long new_getdents64 (unsigned int fd, struct dirent64 *dirp,
509 unsigned int count)
510{
511 long status = 0; /* Return value from original getdents */
512 struct inode * dir_inode;
513 struct file * fd_file;
514 int dir_is_proc = 0;
515
516 struct dirent64 * dirp_prev;
517 struct dirent64 * dirp_new;
518 struct dirent64 * dirp_current;
519
520 int dir_table_bytes;
521 int forward_bytes;
522 struct task_struct * task_ptr;
523 int hide_it = 0;
524 __s64 dirp_offset;
525
526 lock_kernel();
527
528 status = (*old_getdents64)(fd, dirp, count);
529
530#ifdef FILE_DEBUG
531 printk("STATUS64 %ld\n", status);
532#endif
533
534 /* 0: end of directory.
535 * -1: some error
536 */
537 if (status <= 0)
538 {
539 unlock_kernel();
540 return (status);
541 }
542
543 /* Handle directory caching. dir_inode is the inode of the directory.
544 */
545#if defined(files_fdtable)
546 {
547 struct fdtable *fdt = files_fdtable(current->files);
548 fd_file = rcu_dereference(fdt->fd[fd]);
549 }
550#else
551 {
552 fd_file = current->files->fd[fd];
553 }
554#endif
555
556#if defined(__LINUX_DCACHE_H)
557 dir_inode = fd_file->f_dentry->d_inode;
558#else
559 dir_inode = fd_file->f_inode;
560#endif
561
562#ifdef FILE_DEBUG
563 printk("INODE64\n");
564#endif
565
566 /* Check for the /proc directory
567 */
568 if (dir_inode->i_ino == PROC_ROOT_INO
569#ifndef LINUX26
570 && !MAJOR(dir_inode->i_dev) /* &&
571 MINOR(dir_inode->i_dev) == 1 */
572 /* MINOR commented out because of problems with 2.4.17 */
573#endif
574 )
575 {
576 dir_is_proc = 1;
577
578#ifdef PROC_DEBUG
579 printk("PROC_CHECK64\n");
580#endif
581 }
582
583 /* Allocate space for new dirent table. Can't use GFP_KERNEL
584 * (kernel oops)
585 */
586 dirp_new = kmalloc ((size_t)status, GFP_ATOMIC);
587
588#ifdef FILE_DEBUG
589 printk("KMALLOC64_0\n");
590#endif
591
592 if (dirp_new == NULL)
593 {
594 unlock_kernel();
595 return (status);
596 }
597
598#ifdef FILE_DEBUG
599 printk("KMALLOC64\n");
600#endif
601
602 /* Copy the dirp table to kernel space.
603 */
604 copy_from_user(dirp_new, dirp, status);
605
606#ifdef FILE_DEBUG
607 printk("COPY64 to kernel\n");
608#endif
609
610 /* Loop over the dirp table to find entries to hide.
611 */
612 dir_table_bytes = status;
613 dirp_current = dirp_new;
614 dirp_prev = NULL;
615
616 while (dir_table_bytes > 0)
617 {
618 hide_it = 0;
619
620 if (dirp_current->d_reclen == 0)
621 break;
622
623 dirp_offset = dirp_current->d_off;
624
625#ifdef FILE_DEBUG
626 printk("DIRENT %d %d %lld\n",
627 dir_table_bytes,
628 dirp_current->d_reclen,
629 dirp_current->d_off);
630#endif
631
632 dir_table_bytes -= dirp_current->d_reclen;
633 forward_bytes = dirp_current->d_reclen;
634
635#ifdef FILE_DEBUG
636 printk("ENTRY %s\n", dirp_current->d_name);
637#endif
638
639 /* If /proc is scanned (e.g. by 'ps'), hide the entry for
640 * any process where the executable has MAGIC_HIDE in its name.
641 */
642 if (dir_is_proc == 1)
643 {
644#ifdef PROC_DEBUG
645 printk("PROC %s\n", dirp_current->d_name);
646#endif
647 task_ptr = fetch_task_struct(my_atoi(dirp_current->d_name));
648 if (task_ptr != NULL)
649 {
650#ifdef PROC_DEBUG
651 printk("PROC %s <> %s\n", task_ptr->comm, hidden);
652#endif
653 if (strstr(task_ptr->comm, hidden) != NULL)
654 hide_it = 1;
655 }
656 }
657 /* If it is a regular directory, hide any entry with
658 * MAGIC_HIDE in its name.
659 */
660 else
661 {
662 if (strstr (dirp_current->d_name, hidden) != NULL)
663 hide_it = 1;
664 }
665
666 if (hide_it == 1)
667 {
668#ifdef FILE_DEBUG
669 printk(" -->HIDDEN %s\n", dirp_current->d_name);
670#endif
671 if (dir_table_bytes > 0)
672 {
673 status -= dirp_current->d_reclen;
674 memmove (dirp_current,
675 (char *) dirp_current + dirp_current->d_reclen,
676 dir_table_bytes);
677
678 /* Set forward_bytes to 0, because now dirp_current is the
679 * (previously) next entry in the dirp table.
680 */
681 forward_bytes = 0;
682 dirp_prev = dirp_current;
683 }
684 else
685 {
686 status -= dirp_current->d_reclen;
687 if (dirp_prev != NULL)
688 dirp_prev->d_off = dirp_offset;
689 }
690
691 }
692 else
693 {
694 dirp_prev = dirp_current;
695 if (dir_table_bytes == 0 && dirp_prev != NULL)
696 dirp_prev->d_off = dirp_offset;
697 }
698
699 /* Next entry in dirp table.
700 */
701 if (dir_table_bytes > 0)
702 dirp_current = (struct dirent64 *) ( (char *) dirp_current +
703 forward_bytes);
704 }
705
706 /* Copy our modified dirp table back to user space.
707 */
708 copy_to_user(dirp, dirp_new, status);
709 kfree (dirp_new);
710 unlock_kernel();
711 return (status);
712}
713#endif
714
715#ifdef LINUX26
716static struct module *find_module(const char *name)
717{
718 struct module *mod;
719 struct list_head * modules = (struct list_head *) SH_LIST_MODULES;
720
721 list_for_each_entry(mod, modules, list) {
722 if (strcmp(mod->name, name) == 0)
723 return mod;
724 }
725 return NULL;
726}
727#endif
728
729/* The initialisation function. Automatically called when module is inserted
730 * via the 'insmod' command.
731 */
732#ifdef LINUX26
733static int __init samhain_hide_init(void)
734#else
735int init_module(void)
736#endif
737{
738
739 lock_kernel();
740
741 /* Unfortunately this does not fully prevent the module from appearing
742 * in /proc/ksyms.
743 */
744#ifndef LINUX26
745 EXPORT_NO_SYMBOLS;
746#endif
747
748 /* Replace the 'sys_getdents' syscall with the new version.
749 */
750 old_getdents = (void*) sh_sys_call_table[SYS_getdents];
751 sh_sys_call_table[SYS_getdents] = (unsigned long) new_getdents;
752
753#ifdef __NR_getdents64
754 old_getdents64 = (void*) sh_sys_call_table[SYS_getdents64];
755 sh_sys_call_table[SYS_getdents64] = (unsigned long) new_getdents64;
756#endif
757
758#ifdef LINUX26
759 {
760 spinlock_t * modlist_lock = (spinlock_t * ) SH_MODLIST_LOCK;
761 struct module *mod = find_module(SH_INSTALL_NAME"_hide");
762 if (mod) {
763 /* Delete from various lists */
764 spin_lock_irq(modlist_lock);
765 if (removeme == 1)
766 {
767 list_del(&mod->list);
768 }
769 spin_unlock_irq(modlist_lock);
770 }
771 }
772#endif
773
774 unlock_kernel();
775 return (0);
776}
777
778/* The cleanup function. Automatically called when module is removed
779 * via the 'rmmod' command.
780 */
781#ifdef LINUX26
782static void __exit samhain_hide_cleanup(void)
783#else
784void cleanup_module(void)
785#endif
786{
787 lock_kernel();
788
789 /* Restore the new syscalls to the original version.
790 */
791 sh_sys_call_table[SYS_getdents] = (unsigned long) old_getdents;
792#ifdef __NR_getdents64
793 sh_sys_call_table[SYS_getdents64] = (unsigned long) old_getdents64;
794#endif
795
796 unlock_kernel();
797}
798
799#ifdef LINUX26
800module_init(samhain_hide_init);
801module_exit(samhain_hide_cleanup);
802#endif
803
804
Note: See TracBrowser for help on using the repository browser.