source: trunk/src/samhain_hide.c@ 107

Last change on this file since 107 was 96, checked in by rainer, 18 years ago

Fix for ticket #54 (samhain_hide module does not work under kernel 2.6.20).
File size: 19.7 KB
Line 
1/***************************************************************************
2 *
3 * Purpose:
4 * -------
5 * (1) Hide files with the string MAGIC_HIDE in filename,
6 * where MAGIC_HIDE is defined below.
7 * By default, MAGIC_HIDE is defined as "samhain".
8 *
9 * (2) Hide all processes, if the executable has the string MAGIC_HIDE
10 * in its name.
11 *
12 *
13 * Configuration:
14 * -------------
15 * If not building within the samhain system, you may remove the
16 * line '#include "config.h"' and in the line
17 * '#define MAGIC_HIDE SH_MAGIC_HIDE', replace SH_MAGIC_HIDE with
18 * "someString" (in quotes !).
19 */
20
21/* #define _(string) string */
22#include "config.h"
23
24#undef _
25#define _(string) string
26
27/* define if this is a 2.6 kernel */
28/* #define LINUX26 */
29
30#define MAGIC_HIDE SH_MAGIC_HIDE
31
32/* #define MAGIC_HIDE "someString" */
33
34/* define this if you have a modversioned kernel */
35/* #define MODVERSIONS */
36
37/* the address of the sys_call_table (not exported in 2.5 kernels) */
38#define MAGIC_ADDRESS SH_SYSCALLTABLE
39
40/*
41 * Install:
42 * -------
43 * gcc -Wall -O2 -c samhain_hide.c
44 * mv samhain_hide.o /lib/modules/KERNEL_VERSION/misc/
45 *
46 * (Replace KERNEL_VERSION with your kernel's version.)
47 *
48 * Usage:
49 * -----
50 * To load the module:
51 * insmod samhain_hide (for improved safety: 'sync && insmod samhain_hide')
52 *
53 * Self-hiding can be switched off by passing the option
54 * 'removeme=0' to the module:
55 * insmod ./samhain_hide.ko removeme=0
56 *
57 * To unload the module (only possible if not hidden):
58 * rmmod samhain_hide (for improved safety: 'sync && rmmod samhain_hide')
59 *
60 *
61 * Details:
62 * -------
63 * The following kernel syscalls are replaced:
64 * sys_getdents [hide files/directories/processes (/proc/PID)]
65 *
66 * Tested on:
67 * ---------
68 * Linux 2.2, 2.4, 2.6
69 *
70 * Copyright:
71 * ---------
72 * Copyright (C) 2001, 2002 Rainer Wichmann (http://la-samhna.de)
73 *
74 * License:
75 * -------
76 * This program is free software; you can redistribute it and/or modify
77 * it under the terms of the GNU General Public License, version 2, as
78 * published by the Free Software Foundation.
79 *
80 * This program is distributed in the hope that it will be useful,
81 * but WITHOUT ANY WARRANTY; without even the implied warranty of
82 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
83 * GNU General Public License for more details.
84 *
85 * You should have received a copy of the GNU General Public License
86 * along with this program; if not, write to the Free Software
87 * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
88 *
89 ***************************************************************************/
90
91
92
93/*****************************************************
94 *
95 * The defines:
96 *
97 *****************************************************/
98
99/* This is a Linux Loadable Kernel Module.
100 */
101
102#ifndef LINUX26
103#define __KERNEL__
104#define MODULE
105#endif
106#define LINUX
107
108/* Define for debugging.
109 */
110/* #define HIDE_DEBUG */ /* query_module */
111/* #define FILE_DEBUG */ /* getdents */
112/* #define READ_DEBUG */ /* read */
113/* #define PROC_DEBUG */ /* procfs */
114
115/*****************************************************
116 *
117 * The include files:
118 *
119 *****************************************************/
120
121
122/* The configure options (#defines) for the Kernel
123 */
124/* 2.6.19 (((2) << 16) + ((6) << 8) + (19)) */
125#define SH_KERNEL_MIN 132627
126
127#if SH_KERNEL_NUMERIC >= SH_KERNEL_MIN
128#include <linux/autoconf.h>
129#else
130#include <linux/config.h>
131#endif
132
133#ifndef LINUX26
134#ifdef CONFIG_MODVERSIONS
135#include <linux/modversions.h>
136#endif
137#endif
138
139
140#ifdef LINUX26
141#include <linux/init.h>
142#endif
143
144#include <linux/module.h>
145
146/* File tables structures. If directory caching is used,
147 * <linux/dcache.h> will be included here, and __LINUX_DCACHE_H
148 * will thus be defined.
149 */
150#include <linux/fs.h>
151#include <linux/proc_fs.h>
152
153/* Include the SYS_syscall defines.
154 */
155#ifndef LINUX26
156#include <sys/syscall.h>
157#else
158#define SYS_getdents 141
159#define SYS_getdents64 220
160#endif
161
162
163/* Includes for 'getdents' per the manpage.
164 */
165#include <linux/types.h>
166#include <linux/dirent.h>
167#include <linux/unistd.h>
168
169/* To access userspace memory.
170 */
171#include <asm/uaccess.h>
172
173/* Include for lock_kernel().
174 */
175#include <linux/smp_lock.h>
176
177#if SH_KERNEL_NUMERIC >= SH_KERNEL_MIN
178#include <linux/mutex.h>
179#endif
180
181/* Include for fget().
182 */
183#include <linux/file.h>
184
185/*****************************************************
186 *
187 * The global variables:
188 *
189 *****************************************************/
190
191/* The kernel syscall table. Not exported anymore in 2.5 ff., and also
192 * not in the RedHat 2.4 kernel.
193 */
194
195#if 0
196extern void * sys_call_table[];
197#define sh_sys_call_table sys_call_table
198#endif
199
200unsigned long * sh_sys_call_table = (unsigned long *) MAGIC_ADDRESS;
201
202/* The old address of the sys_getdents syscall.
203 */
204int (*old_getdents)(unsigned int, struct dirent *, unsigned int);
205#ifdef __NR_getdents64
206#if SH_KERNEL_NUMERIC >= 132628
207/*
208 * 'asmlinkage' is __required__ to get this to work.
209 */
210asmlinkage long (*old_getdents64)(unsigned int, struct linux_dirent64 __user *, unsigned int);
211#else
212long (*old_getdents64)(unsigned int, struct dirent64 *, unsigned int);
213#endif
214#endif
215
216char hidden[] = MAGIC_HIDE;
217
218
219/*****************************************************
220 *
221 * The functions:
222 *
223 *****************************************************/
224
225
226MODULE_AUTHOR("Rainer Wichmann");
227MODULE_DESCRIPTION("Hide files/processes/modules with MAGIC_HIDE in name.");
228#if defined(MODULE_LICENSE) || defined(LINUX26)
229MODULE_LICENSE("GPL");
230#endif
231
232#ifdef LINUX26
233/* Default is to hide ourselves.
234 */
235static int removeme = 1;
236
237#ifdef MODULE_PARM
238MODULE_PARM (removeme, "i");
239#else
240module_param(removeme, int, 0444);
241#endif
242
243#ifdef MODULE_PARM_DESC
244MODULE_PARM_DESC(removeme, "Choose zero for not hiding.");
245#endif
246
247/* LINUX26 */
248#endif
249
250
251/*
252 * struct task_struct is defined in linux/sched.h
253 *
254 * as of 2.4.20, the vanilla kernel holds (among others):
255 * struct task_struct *next_task, *prev_task;
256 *
257 * Redhat kernel seems to have a different scheduler.
258 * use:
259 * struct task_struct * find_task_by_pid (int pid);
260 */
261
262#if defined(SH_VANILLA_KERNEL) && !defined(LINUX26)
263/*
264 * Fetch the task struct for a given PID.
265 */
266struct task_struct * fetch_task_struct (int pid)
267{
268 struct task_struct * task_ptr;
269
270#ifdef PROC_DEBUG
271 printk("FETCH TASK %d\n", pid);
272#endif
273
274 task_ptr = current;
275
276 do
277 {
278 if (task_ptr->pid == (pid_t) pid )
279 return (task_ptr);
280 task_ptr = task_ptr->next_task;
281 }
282 while (task_ptr != current);
283
284#ifdef PROC_DEBUG
285 printk("FETCH TASK: NOT FOUND !!!\n");
286#endif
287
288 return (NULL);
289}
290
291#else
292/*
293 * RedHat 2.4.20 kernel
294 */
295struct task_struct * fetch_task_struct (int pid)
296{
297 struct task_struct * task_ptr = NULL;
298 task_ptr = find_task_by_pid (pid);
299 return (task_ptr);
300}
301#endif
302
303/* Convert a string to an int.
304 * Does not recognize integers with a sign (+/-) in front.
305 */
306int my_atoi(char * in_str)
307{
308 int i = 0;
309 int retval = 0;
310 int conv = 0;
311
312 if (in_str == NULL)
313 return (-1);
314
315 while(in_str[i] != '\0')
316 {
317 /* Break if not numeric.
318 */
319 if (in_str[i] < '0' || in_str[i] > '9')
320 break;
321
322 ++conv;
323
324 /* Leading zeroes (should not happen in /proc)
325 */
326 if (retval == 0 && in_str[i] == '0')
327 retval = retval;
328 else
329 retval = retval * 10;
330
331 retval = retval + (in_str[i] - '0');
332
333 i++;
334 }
335
336 if (conv == 0)
337 return (-1);
338 else
339 return (retval);
340}
341
342/* Purpose:
343 *
344 * Hide all files/dirs that include the string MAGIC_HIDE in their
345 * name.
346 */
347int new_getdents (unsigned int fd, struct dirent *dirp, unsigned int count)
348{
349 int status = 0; /* Return value from original getdents */
350 struct inode * dir_inode;
351 struct file * fd_file;
352 int dir_is_proc = 0;
353
354 struct dirent * dirp_prev;
355 struct dirent * dirp_new;
356 struct dirent * dirp_current;
357
358 int dir_table_bytes;
359 int forward_bytes;
360 struct task_struct * task_ptr;
361 int hide_it = 0;
362 long dirp_offset;
363
364 unsigned long dummy;
365
366 lock_kernel();
367
368 status = (*old_getdents)(fd, dirp, count);
369
370#ifdef FILE_DEBUG
371 printk("STATUS %d\n", status);
372#endif
373
374 /* 0: end of directory.
375 * -1: some error
376 */
377 if (status <= 0)
378 {
379 unlock_kernel();
380 return (status);
381 }
382
383 /* Handle directory caching. dir_inode is the inode of the directory.
384 */
385#if defined(files_fdtable)
386 {
387 struct fdtable *fdt = files_fdtable(current->files);
388 fd_file = rcu_dereference(fdt->fd[fd]);
389 }
390#else
391 {
392 fd_file = current->files->fd[fd];
393 }
394#endif
395
396#if defined(__LINUX_DCACHE_H)
397 dir_inode = fd_file->f_dentry->d_inode;
398#else
399 dir_inode = fd_file->f_inode;
400#endif
401
402 /* Check for the /proc directory
403 */
404 if (dir_inode->i_ino == PROC_ROOT_INO
405#ifndef LINUX26
406 && !MAJOR(dir_inode->i_dev) &&
407 MINOR(dir_inode->i_dev) == 1
408#endif
409 )
410 dir_is_proc = 1;
411
412 /* Allocate space for new dirent table. Can't use GFP_KERNEL
413 * (kernel oops)
414 */
415 dirp_new = (struct dirent *) kmalloc (status, GFP_ATOMIC);
416
417 if (dirp_new == NULL)
418 {
419 unlock_kernel();
420 return (status);
421 }
422
423 /* Copy the dirp table to kernel space.
424 */
425 dummy = (unsigned long) copy_from_user(dirp_new, dirp, status);
426
427#ifdef FILE_DEBUG
428 printk("COPY to kernel: %ld\n", dummy);
429#endif
430
431 /* Loop over the dirp table to find entries to hide.
432 */
433 dir_table_bytes = status;
434 dirp_current = dirp_new;
435 dirp_prev = NULL;
436
437 while (dir_table_bytes > 0)
438 {
439 hide_it = 0;
440
441 if (dirp_current->d_reclen == 0)
442 break;
443
444 dirp_offset = dirp_current->d_off;
445
446#ifdef FILE_DEBUG
447 printk("DIRENT %d %d %ld\n",
448 dir_table_bytes,
449 dirp_current->d_reclen,
450 dirp_current->d_off);
451#endif
452
453 dir_table_bytes -= dirp_current->d_reclen;
454 forward_bytes = dirp_current->d_reclen;
455
456#ifdef FILE_DEBUG
457 printk("ENTRY %s\n", dirp_current->d_name);
458#endif
459
460 /* If /proc is scanned (e.g. by 'ps'), hide the entry for
461 * any process where the executable has MAGIC_HIDE in its name.
462 */
463 if (dir_is_proc == 1)
464 {
465 task_ptr = fetch_task_struct(my_atoi(dirp_current->d_name));
466 if (task_ptr != NULL)
467 {
468 if (strstr(task_ptr->comm, hidden) != NULL)
469 hide_it = 1;
470 }
471 }
472 /* If it is a regular directory, hide any entry with
473 * MAGIC_HIDE in its name.
474 */
475 else
476 {
477 if (strstr (dirp_current->d_name, hidden) != NULL)
478 hide_it = 1;
479 }
480
481 if (hide_it == 1)
482 {
483#ifdef FILE_DEBUG
484 printk(" -->HIDDEN %s\n", dirp_current->d_name);
485#endif
486 if (dir_table_bytes > 0)
487 {
488 status -= dirp_current->d_reclen;
489 memmove (dirp_current,
490 (char *) dirp_current + dirp_current->d_reclen,
491 dir_table_bytes);
492
493 /* Set forward_bytes to 0, because now dirp_current is the
494 * (previously) next entry in the dirp table.
495 */
496 forward_bytes = 0;
497 dirp_prev = dirp_current;
498 }
499 else
500 {
501 status -= dirp_current->d_reclen;
502 if (dirp_prev != NULL)
503 dirp_prev->d_off = dirp_offset;
504 }
505
506 }
507 else
508 {
509 dirp_prev = dirp_current;
510 if (dir_table_bytes == 0 && dirp_prev != NULL)
511 dirp_prev->d_off = dirp_offset;
512 }
513
514 /* Next entry in dirp table.
515 */
516 if (dir_table_bytes > 0)
517 dirp_current = (struct dirent *) ( (char *) dirp_current +
518 forward_bytes);
519 }
520
521 /* Copy our modified dirp table back to user space.
522 */
523 dummy = (unsigned long) copy_to_user(dirp, dirp_new, status);
524#ifdef FILE_DEBUG
525 printk("COPY to user: %ld\n", dummy);
526#endif
527
528 kfree (dirp_new);
529#ifdef FILE_DEBUG
530 printk("KFREE\n");
531#endif
532
533 unlock_kernel();
534 return (status);
535}
536
537/* For 2.4 kernel
538 */
539#ifdef __NR_getdents64
540
541#if SH_KERNEL_NUMERIC >= 132628
542/*
543 * 'asmlinkage' is __required__ to get this to work.
544 */
545asmlinkage long new_getdents64 (unsigned int fd, struct linux_dirent64 __user *dirp,
546 unsigned int count)
547#else
548long new_getdents64 (unsigned int fd, struct dirent64 *dirp, unsigned int count)
549#endif
550{
551 long status = 0; /* Return value from original getdents */
552 struct inode * dir_inode;
553 struct file * fd_file;
554 int dir_is_proc = 0;
555
556 struct dirent64 * dirp_prev;
557 struct dirent64 * dirp_new;
558 struct dirent64 * dirp_current;
559
560 int dir_table_bytes;
561 int forward_bytes;
562 struct task_struct * task_ptr;
563 int hide_it = 0;
564 __s64 dirp_offset;
565
566 unsigned long dummy;
567
568#ifdef FILE_DEBUG
569 printk("FD64 %d\n", fd);
570#endif
571
572 lock_kernel();
573
574#ifdef FILE_DEBUG
575 if (!access_ok(VERIFY_WRITE, dirp, count))
576 printk("ACCESS64_BAD\n");
577 else
578 printk("ACCESS64_OK\n");
579#endif
580
581#if SH_KERNEL_NUMERIC >= 132628
582 status = (*old_getdents64)(fd, dirp, count);
583 // status = my_real_getdents64(fd, dirp, count);
584#else
585 status = (*old_getdents64)(fd, dirp, count);
586#endif
587
588#ifdef FILE_DEBUG
589 printk("STATUS64 %ld\n", status);
590#endif
591
592 /* 0: end of directory.
593 * -1: some error
594 */
595 if (status <= 0)
596 {
597 unlock_kernel();
598 return (status);
599 }
600
601 /* Handle directory caching. dir_inode is the inode of the directory.
602 */
603#if defined(files_fdtable)
604 {
605 struct fdtable *fdt = files_fdtable(current->files);
606 fd_file = rcu_dereference(fdt->fd[fd]);
607 }
608#else
609 {
610 fd_file = current->files->fd[fd];
611 }
612#endif
613
614#if defined(__LINUX_DCACHE_H)
615
616/* 2.6.20 (((2) << 16) + ((6) << 8) + (20)) */
617#if SH_KERNEL_NUMERIC >= 132628
618 dir_inode = fd_file->f_path.dentry->d_inode;
619#else
620 dir_inode = fd_file->f_dentry->d_inode;
621#endif
622
623#else
624 dir_inode = fd_file->f_inode;
625#endif
626
627#ifdef FILE_DEBUG
628 printk("INODE64\n");
629#endif
630
631 /* Check for the /proc directory
632 */
633 if (dir_inode->i_ino == PROC_ROOT_INO
634#ifndef LINUX26
635 && !MAJOR(dir_inode->i_dev) /* &&
636 MINOR(dir_inode->i_dev) == 1 */
637 /* MINOR commented out because of problems with 2.4.17 */
638#endif
639 )
640 {
641 dir_is_proc = 1;
642
643#ifdef PROC_DEBUG
644 printk("PROC_CHECK64\n");
645#endif
646 }
647
648 /* Allocate space for new dirent table. Can't use GFP_KERNEL
649 * (kernel oops)
650 */
651 dirp_new = kmalloc ((size_t)status, GFP_ATOMIC);
652
653#ifdef FILE_DEBUG
654 printk("KMALLOC64_0\n");
655#endif
656
657 if (dirp_new == NULL)
658 {
659 unlock_kernel();
660 return (status);
661 }
662
663#ifdef FILE_DEBUG
664 printk("KMALLOC64\n");
665#endif
666
667 /* Copy the dirp table to kernel space.
668 */
669 dummy = (unsigned long) copy_from_user(dirp_new, dirp, status);
670
671#ifdef FILE_DEBUG
672 printk("COPY64 to kernel: %ld\n", dummy);
673#endif
674
675 /* Loop over the dirp table to find entries to hide.
676 */
677 dir_table_bytes = status;
678 dirp_current = dirp_new;
679 dirp_prev = NULL;
680
681 while (dir_table_bytes > 0)
682 {
683 hide_it = 0;
684
685 if (dirp_current->d_reclen == 0)
686 break;
687
688 dirp_offset = dirp_current->d_off;
689
690#ifdef FILE_DEBUG
691 printk("DIRENT %d %d %lld\n",
692 dir_table_bytes,
693 dirp_current->d_reclen,
694 dirp_current->d_off);
695#endif
696
697 dir_table_bytes -= dirp_current->d_reclen;
698 forward_bytes = dirp_current->d_reclen;
699
700#ifdef FILE_DEBUG
701 printk("ENTRY %s\n", dirp_current->d_name);
702#endif
703
704 /* If /proc is scanned (e.g. by 'ps'), hide the entry for
705 * any process where the executable has MAGIC_HIDE in its name.
706 */
707 if (dir_is_proc == 1)
708 {
709#ifdef PROC_DEBUG
710 printk("PROC %s\n", dirp_current->d_name);
711#endif
712 task_ptr = fetch_task_struct(my_atoi(dirp_current->d_name));
713 if (task_ptr != NULL)
714 {
715#ifdef PROC_DEBUG
716 printk("PROC %s <> %s\n", task_ptr->comm, hidden);
717#endif
718 if (strstr(task_ptr->comm, hidden) != NULL)
719 hide_it = 1;
720 }
721 }
722 /* If it is a regular directory, hide any entry with
723 * MAGIC_HIDE in its name.
724 */
725 else
726 {
727 if (strstr (dirp_current->d_name, hidden) != NULL)
728 hide_it = 1;
729 }
730
731 if (hide_it == 1)
732 {
733#ifdef FILE_DEBUG
734 printk(" -->HIDDEN %s\n", dirp_current->d_name);
735#endif
736 if (dir_table_bytes > 0)
737 {
738 status -= dirp_current->d_reclen;
739 memmove (dirp_current,
740 (char *) dirp_current + dirp_current->d_reclen,
741 dir_table_bytes);
742
743 /* Set forward_bytes to 0, because now dirp_current is the
744 * (previously) next entry in the dirp table.
745 */
746 forward_bytes = 0;
747 dirp_prev = dirp_current;
748 }
749 else
750 {
751 status -= dirp_current->d_reclen;
752 if (dirp_prev != NULL)
753 dirp_prev->d_off = dirp_offset;
754 }
755
756 }
757 else
758 {
759 dirp_prev = dirp_current;
760 if (dir_table_bytes == 0 && dirp_prev != NULL)
761 dirp_prev->d_off = dirp_offset;
762 }
763
764 /* Next entry in dirp table.
765 */
766 if (dir_table_bytes > 0)
767 dirp_current = (struct dirent64 *) ( (char *) dirp_current +
768 forward_bytes);
769 }
770
771 /* Copy our modified dirp table back to user space.
772 */
773#ifdef FILE_DEBUG
774 printk("STATUS64 AT END %ld\n", status);
775#endif
776 dummy = (unsigned long) copy_to_user(dirp, dirp_new, status);
777#ifdef FILE_DEBUG
778 printk("COPY64 to user: %ld\n", dummy);
779#endif
780
781 kfree (dirp_new);
782 unlock_kernel();
783 return (status);
784}
785#endif
786
787#ifdef LINUX26
788static struct module *find_module(const char *name)
789{
790 struct module *mod;
791 struct list_head * modules = (struct list_head *) SH_LIST_MODULES;
792
793 list_for_each_entry(mod, modules, list) {
794 if (strcmp(mod->name, name) == 0)
795 return mod;
796 }
797 return NULL;
798}
799#endif
800
801/* The initialisation function. Automatically called when module is inserted
802 * via the 'insmod' command.
803 */
804#ifdef LINUX26
805static int __init samhain_hide_init(void)
806#else
807int init_module(void)
808#endif
809{
810
811 lock_kernel();
812
813 /* Unfortunately this does not fully prevent the module from appearing
814 * in /proc/ksyms.
815 */
816#ifndef LINUX26
817 EXPORT_NO_SYMBOLS;
818#endif
819
820 /* Replace the 'sys_getdents' syscall with the new version.
821 */
822 old_getdents = (void*) sh_sys_call_table[SYS_getdents];
823 sh_sys_call_table[SYS_getdents] = (unsigned long) new_getdents;
824
825#ifdef __NR_getdents64
826 old_getdents64 = (void*) sh_sys_call_table[SYS_getdents64];
827 sh_sys_call_table[SYS_getdents64] = (unsigned long) new_getdents64;
828#endif
829
830#ifdef LINUX26
831 {
832#if defined(SH_MODLIST_LOCK)
833 spinlock_t * modlist_lock = (spinlock_t * ) SH_MODLIST_LOCK;
834#endif
835#if SH_KERNEL_NUMERIC >= SH_KERNEL_MIN
836 struct mutex * module_mutex = (struct mutex *) SH_MODLIST_MUTEX;
837#endif
838
839 struct module *mod;
840
841#if SH_KERNEL_NUMERIC >= SH_KERNEL_MIN
842 mutex_lock(module_mutex);
843#endif
844
845 mod = find_module(SH_INSTALL_NAME"_hide");
846 if (mod) {
847 /* Delete from various lists */
848#if defined(SH_MODLIST_LOCK)
849 spin_lock_irq(modlist_lock);
850#endif
851 if (removeme == 1)
852 {
853 list_del(&mod->list);
854 }
855#if defined(SH_MODLIST_LOCK)
856 spin_unlock_irq(modlist_lock);
857#endif
858 }
859#if SH_KERNEL_NUMERIC >= SH_KERNEL_MIN
860 mutex_unlock(module_mutex);
861#endif
862 }
863#endif
864
865 unlock_kernel();
866 return (0);
867}
868
869/* The cleanup function. Automatically called when module is removed
870 * via the 'rmmod' command.
871 */
872#ifdef LINUX26
873static void __exit samhain_hide_cleanup(void)
874#else
875void cleanup_module(void)
876#endif
877{
878 lock_kernel();
879
880 /* Restore the new syscalls to the original version.
881 */
882 sh_sys_call_table[SYS_getdents] = (unsigned long) old_getdents;
883#ifdef __NR_getdents64
884 sh_sys_call_table[SYS_getdents64] = (unsigned long) old_getdents64;
885#endif
886
887 unlock_kernel();
888}
889
890#ifdef LINUX26
891module_init(samhain_hide_init);
892module_exit(samhain_hide_cleanup);
893#endif
894
895
Note: See TracBrowser for help on using the repository browser.