Context Navigation

source: trunk/src/samhain_hide.c@ 328

Last change on this file since 328 was 327, checked in by katerina, 14 years ago
First step for ticket #243: samhain_hide.c compiles now on Ubuntu 10.04
File size: 21.6 KB

Line
1	/***************************************************************************
2	*
3	* Purpose:
4	* -------
5	* (1) Hide files with the string MAGIC_HIDE in filename,
6	* where MAGIC_HIDE is defined below.
7	* By default, MAGIC_HIDE is defined as "samhain".
8	*
9	* (2) Hide all processes, if the executable has the string MAGIC_HIDE
10	* in its name.
11	*
12	*
13	* Configuration:
14	* -------------
15	* If not building within the samhain system, you may remove the
16	* line '#include "config.h"' and in the line
17	* '#define MAGIC_HIDE SH_MAGIC_HIDE', replace SH_MAGIC_HIDE with
18	* "someString" (in quotes !).
19	*/
20
21	/* #define _(string) string */
22	#include "config.h"
23
24	#undef _
25	#define _(string) string
26
27	/* define if this is a 2.6 kernel */
28	/* #define LINUX26 */
29
30	#define MAGIC_HIDE SH_MAGIC_HIDE
31
32	/* #define MAGIC_HIDE "someString" */
33
34	/* define this if you have a modversioned kernel */
35	/* #define MODVERSIONS */
36
37	/* the address of the sys_call_table (not exported in 2.5 kernels) */
38	#define MAGIC_ADDRESS SH_SYSCALLTABLE
39
40	/*
41	* Install:
42	* -------
43	* gcc -Wall -O2 -c samhain_hide.c
44	* mv samhain_hide.o /lib/modules/KERNEL_VERSION/misc/
45	*
46	* (Replace KERNEL_VERSION with your kernel's version.)
47	*
48	* Usage:
49	* -----
50	* To load the module:
51	* insmod samhain_hide (for improved safety: 'sync && insmod samhain_hide')
52	*
53	* Self-hiding can be switched off by passing the option
54	* 'removeme=0' to the module:
55	* insmod ./samhain_hide.ko removeme=0
56	*
57	* To unload the module (only possible if not hidden):
58	* rmmod samhain_hide (for improved safety: 'sync && rmmod samhain_hide')
59	*
60	*
61	* Details:
62	* -------
63	* The following kernel syscalls are replaced:
64	* sys_getdents [hide files/directories/processes (/proc/PID)]
65	*
66	* Tested on:
67	* ---------
68	* Linux 2.2, 2.4, 2.6
69	*
70	* Copyright:
71	* ---------
72	* Copyright (C) 2001, 2002 Rainer Wichmann (http://la-samhna.de)
73	*
74	* License:
75	* -------
76	* This program is free software; you can redistribute it and/or modify
77	* it under the terms of the GNU General Public License, version 2, as
78	* published by the Free Software Foundation.
79	*
80	* This program is distributed in the hope that it will be useful,
81	* but WITHOUT ANY WARRANTY; without even the implied warranty of
82	* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
83	* GNU General Public License for more details.
84	*
85	* You should have received a copy of the GNU General Public License
86	* along with this program; if not, write to the Free Software
87	* Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
88	*
89	***************************************************************************/
90
91
92
93	/*****************************************************
94	*
95	* The defines:
96	*
97	*****************************************************/
98
99	/* This is a Linux Loadable Kernel Module.
100	*/
101
102	#ifndef LINUX26
103	#define __KERNEL__
104	#define MODULE
105	#endif
106	#define LINUX
107
108	/* Define for debugging.
109	*/
110	/* #define HIDE_DEBUG / / query_module */
111	/* #define FILE_DEBUG / / getdents */
112	/* #define READ_DEBUG / / read */
113	/* #define PROC_DEBUG / / procfs */
114
115	/*****************************************************
116	*
117	* The include files:
118	*
119	*****************************************************/
120
121
122	/* The configure options (#defines) for the Kernel
123	*/
124	#define KERNEL_VERSION(a,b,c) (((a) << 16) + ((b) << 8) + (c))
125	/* 2.6.19 (((2) << 16) + ((6) << 8) + (19)) */
126	#define SH_KERNEL_MIN 132627
127
128	#if SH_KERNEL_NUMERIC >= KERNEL_VERSION(2,6,33)
129	#include <linux/generated/autoconf.h>
130	#else
131	#if SH_KERNEL_NUMERIC >= KERNEL_VERSION(2,6,19)
132	#include <linux/autoconf.h>
133	#else
134	#include <linux/config.h>
135	#endif
136	#endif
137
138	#ifndef LINUX26
139	#ifdef CONFIG_MODVERSIONS
140	#include <linux/modversions.h>
141	#endif
142	#endif
143
144
145	#ifdef LINUX26
146	#include <linux/init.h>
147	#endif
148
149	#include <linux/module.h>
150
151	/* File tables structures. If directory caching is used,
152	* <linux/dcache.h> will be included here, and __LINUX_DCACHE_H
153	* will thus be defined.
154	*/
155	#include <linux/fs.h>
156	#include <linux/proc_fs.h>
157
158	/* Include the SYS_syscall defines.
159	*/
160	#ifndef LINUX26
161	#include <sys/syscall.h>
162	#else
163	#define SYS_getdents 141
164	#define SYS_getdents64 220
165	#endif
166
167
168	/* Includes for 'getdents' per the manpage.
169	*/
170	#include <linux/types.h>
171	#include <linux/dirent.h>
172	#include <linux/unistd.h>
173
174	/* To access userspace memory.
175	*/
176	#include <asm/uaccess.h>
177
178	/* Include for lock_kernel().
179	*/
180	#include <linux/smp_lock.h>
181
182	#if SH_KERNEL_NUMERIC >= SH_KERNEL_MIN
183	#include <linux/mutex.h>
184	#endif
185
186	/* Include for fget().
187	*/
188	#include <linux/file.h>
189	#if SH_KERNEL_NUMERIC >= KERNEL_VERSION(2,6,26)
190	#include <linux/fdtable.h>
191	#endif
192
193	/*****************************************************
194	*
195	* The global variables:
196	*
197	*****************************************************/
198
199	/* The kernel syscall table. Not exported anymore in 2.5 ff., and also
200	* not in the RedHat 2.4 kernel.
201	*/
202
203	#if 0
204	extern void * sys_call_table[];
205	#define sh_sys_call_table sys_call_table
206	#endif
207
208	unsigned long * sh_sys_call_table = (unsigned long *) MAGIC_ADDRESS;
209
210	/* The old address of the sys_getdents syscall.
211	*/
212	#if SH_KERNEL_NUMERIC < KERNEL_VERSION(2,6,27)
213	int (old_getdents)(unsigned int, struct dirent , unsigned int);
214	#else
215
216	struct linux_dirent {
217	unsigned long d_ino;
218	unsigned long d_off;
219	unsigned short d_reclen;
220	char d_name[1];
221	};
222
223	int (old_getdents)(unsigned int, struct linux_dirent , unsigned int);
224	#endif
225
226	#ifdef __NR_getdents64
227	#if SH_KERNEL_NUMERIC >= 132628
228	/*
229	* 'asmlinkage' is __required__ to get this to work.
230	*/
231	asmlinkage long (old_getdents64)(unsigned int, struct linux_dirent64 __user , unsigned int);
232	#else
233	long (old_getdents64)(unsigned int, struct dirent64 , unsigned int);
234	#endif
235	#endif
236
237	char hidden[] = MAGIC_HIDE;
238
239
240	/*****************************************************
241	*
242	* The functions:
243	*
244	*****************************************************/
245
246
247	MODULE_AUTHOR("Rainer Wichmann");
248	MODULE_DESCRIPTION("Hide files/processes/modules with MAGIC_HIDE in name.");
249	#if defined(MODULE_LICENSE) \|\| defined(LINUX26)
250	MODULE_LICENSE("GPL");
251	#endif
252
253	#ifdef LINUX26
254	/* Default is to hide ourselves.
255	*/
256	static int removeme = 1;
257
258	#ifdef MODULE_PARM
259	MODULE_PARM (removeme, "i");
260	#else
261	module_param(removeme, int, 0444);
262	#endif
263
264	#ifdef MODULE_PARM_DESC
265	MODULE_PARM_DESC(removeme, "Choose zero for not hiding.");
266	#endif
267
268	/* LINUX26 */
269	#endif
270
271
272	/*
273	* struct task_struct is defined in linux/sched.h
274	*
275	* as of 2.4.20, the vanilla kernel holds (among others):
276	* struct task_struct next_task, prev_task;
277	*
278	* Redhat kernel seems to have a different scheduler.
279	* use:
280	* struct task_struct * find_task_by_pid (int pid);
281	*/
282
283	#if defined(SH_VANILLA_KERNEL) && !defined(LINUX26)
284	/*
285	* Fetch the task struct for a given PID.
286	*/
287	struct task_struct * fetch_task_struct (int pid)
288	{
289	struct task_struct * task_ptr;
290
291	#ifdef PROC_DEBUG
292	printk("FETCH TASK %d\n", pid);
293	#endif
294
295	task_ptr = current;
296
297	do
298	{
299	if (task_ptr->pid == (pid_t) pid )
300	return (task_ptr);
301	task_ptr = task_ptr->next_task;
302	}
303	while (task_ptr != current);
304
305	#ifdef PROC_DEBUG
306	printk("FETCH TASK: NOT FOUND !!!\n");
307	#endif
308
309	return (NULL);
310	}
311
312	#else
313	#if SH_KERNEL_NUMERIC < KERNEL_VERSION(2,6,25)
314	struct task_struct * fetch_task_struct (int pid)
315	{
316	struct task_struct * task_ptr = NULL;
317	task_ptr = find_task_by_pid (pid);
318	return (task_ptr);
319	}
320	#else
321	struct task_struct * fetch_task_struct (int pid)
322	{
323	struct task_struct * task_ptr = NULL;
324	struct pid * task_pid = find_vpid(pid);
325	if (task_pid)
326	{
327	task_ptr = pid_task (task_pid, PIDTYPE_PID);
328	}
329	return (task_ptr);
330	}
331	#endif
332	#endif
333
334	/* Convert a string to an int.
335	* Does not recognize integers with a sign (+/-) in front.
336	*/
337	int my_atoi(char * in_str)
338	{
339	int i = 0;
340	int retval = 0;
341	int conv = 0;
342
343	if (in_str == NULL)
344	return (-1);
345
346	while(in_str[i] != '\0')
347	{
348	/* Break if not numeric.
349	*/
350	if (in_str[i] < '0' \|\| in_str[i] > '9')
351	break;
352
353	++conv;
354
355	/* Leading zeroes (should not happen in /proc)
356	*/
357	if (retval == 0 && in_str[i] == '0')
358	retval = retval;
359	else
360	retval = retval * 10;
361
362	retval = retval + (in_str[i] - '0');
363
364	i++;
365	}
366
367	if (conv == 0)
368	return (-1);
369	else
370	return (retval);
371	}
372
373	/* Purpose:
374	*
375	* Hide all files/dirs that include the string MAGIC_HIDE in their
376	* name.
377	*/
378	#if SH_KERNEL_NUMERIC < KERNEL_VERSION(2,6,27)
379	int new_getdents (unsigned int fd, struct dirent *dirp, unsigned int count)
380	#else
381	int new_getdents (unsigned int fd, struct linux_dirent *dirp, unsigned int count)
382	#endif
383	{
384	int status = 0; /* Return value from original getdents */
385	struct inode * dir_inode;
386	struct file * fd_file;
387	int dir_is_proc = 0;
388
389	#if SH_KERNEL_NUMERIC < KERNEL_VERSION(2,6,27)
390	struct dirent * dirp_prev;
391	struct dirent * dirp_new;
392	struct dirent * dirp_current;
393	#else
394	struct linux_dirent * dirp_prev;
395	struct linux_dirent * dirp_new;
396	struct linux_dirent * dirp_current;
397	#endif
398
399	int dir_table_bytes;
400	int forward_bytes;
401	struct task_struct * task_ptr;
402	int hide_it = 0;
403	long dirp_offset;
404
405	unsigned long dummy;
406
407	lock_kernel();
408
409	status = (*old_getdents)(fd, dirp, count);
410
411	#ifdef FILE_DEBUG
412	printk("STATUS %d\n", status);
413	#endif
414
415	/* 0: end of directory.
416	* -1: some error
417	*/
418	if (status <= 0)
419	{
420	unlock_kernel();
421	return (status);
422	}
423
424	/* Handle directory caching. dir_inode is the inode of the directory.
425	*/
426	#if defined(files_fdtable)
427	{
428	struct fdtable *fdt = files_fdtable(current->files);
429	fd_file = rcu_dereference(fdt->fd[fd]);
430	}
431	#else
432	{
433	fd_file = current->files->fd[fd];
434	}
435	#endif
436
437	#if defined(__LINUX_DCACHE_H)
438	dir_inode = fd_file->f_dentry->d_inode;
439	#else
440	dir_inode = fd_file->f_inode;
441	#endif
442
443	/* Check for the /proc directory
444	*/
445	if (dir_inode->i_ino == PROC_ROOT_INO
446	#ifndef LINUX26
447	&& !MAJOR(dir_inode->i_dev) &&
448	MINOR(dir_inode->i_dev) == 1
449	#endif
450	)
451	dir_is_proc = 1;
452
453	/* Allocate space for new dirent table. Can't use GFP_KERNEL
454	* (kernel oops)
455	*/
456	#if SH_KERNEL_NUMERIC < KERNEL_VERSION(2,6,27)
457	dirp_new = (struct dirent *) kmalloc (status, GFP_ATOMIC);
458	#else
459	dirp_new = (struct linux_dirent *) kmalloc (status, GFP_ATOMIC);
460	#endif
461
462	if (dirp_new == NULL)
463	{
464	unlock_kernel();
465	return (status);
466	}
467
468	/* Copy the dirp table to kernel space.
469	*/
470	dummy = (unsigned long) copy_from_user(dirp_new, dirp, status);
471
472	#ifdef FILE_DEBUG
473	printk("COPY to kernel: %ld\n", dummy);
474	#endif
475
476	/* Loop over the dirp table to find entries to hide.
477	*/
478	dir_table_bytes = status;
479	dirp_current = dirp_new;
480	dirp_prev = NULL;
481
482	while (dir_table_bytes > 0)
483	{
484	hide_it = 0;
485
486	if (dirp_current->d_reclen == 0)
487	break;
488
489	dirp_offset = dirp_current->d_off;
490
491	#ifdef FILE_DEBUG
492	printk("DIRENT %d %d %ld\n",
493	dir_table_bytes,
494	dirp_current->d_reclen,
495	dirp_current->d_off);
496	#endif
497
498	dir_table_bytes -= dirp_current->d_reclen;
499	forward_bytes = dirp_current->d_reclen;
500
501	#ifdef FILE_DEBUG
502	printk("ENTRY %s\n", dirp_current->d_name);
503	#endif
504
505	/* If /proc is scanned (e.g. by 'ps'), hide the entry for
506	* any process where the executable has MAGIC_HIDE in its name.
507	*/
508	if (dir_is_proc == 1)
509	{
510	task_ptr = fetch_task_struct(my_atoi(dirp_current->d_name));
511	if (task_ptr != NULL)
512	{
513	if (strstr(task_ptr->comm, hidden) != NULL)
514	hide_it = 1;
515	}
516	}
517	/* If it is a regular directory, hide any entry with
518	* MAGIC_HIDE in its name.
519	*/
520	else
521	{
522	if (strstr (dirp_current->d_name, hidden) != NULL)
523	hide_it = 1;
524	}
525
526	if (hide_it == 1)
527	{
528	#ifdef FILE_DEBUG
529	printk(" -->HIDDEN %s\n", dirp_current->d_name);
530	#endif
531	if (dir_table_bytes > 0)
532	{
533	status -= dirp_current->d_reclen;
534	memmove (dirp_current,
535	(char *) dirp_current + dirp_current->d_reclen,
536	dir_table_bytes);
537
538	/* Set forward_bytes to 0, because now dirp_current is the
539	* (previously) next entry in the dirp table.
540	*/
541	forward_bytes = 0;
542	dirp_prev = dirp_current;
543	}
544	else
545	{
546	status -= dirp_current->d_reclen;
547	if (dirp_prev != NULL)
548	dirp_prev->d_off = dirp_offset;
549	}
550
551	}
552	else
553	{
554	dirp_prev = dirp_current;
555	if (dir_table_bytes == 0 && dirp_prev != NULL)
556	dirp_prev->d_off = dirp_offset;
557	}
558
559	/* Next entry in dirp table.
560	*/
561	#if SH_KERNEL_NUMERIC < KERNEL_VERSION(2,6,27)
562	if (dir_table_bytes > 0)
563	dirp_current = (struct dirent ) ( (char ) dirp_current +
564	forward_bytes);
565	#else
566	if (dir_table_bytes > 0)
567	dirp_current = (struct linux_dirent ) ( (char ) dirp_current +
568	forward_bytes);
569	#endif
570	}
571
572	/* Copy our modified dirp table back to user space.
573	*/
574	dummy = (unsigned long) copy_to_user(dirp, dirp_new, status);
575	#ifdef FILE_DEBUG
576	printk("COPY to user: %ld\n", dummy);
577	#endif
578
579	kfree (dirp_new);
580	#ifdef FILE_DEBUG
581	printk("KFREE\n");
582	#endif
583
584	unlock_kernel();
585	return (status);
586	}
587
588
589
590	/* For 2.4 kernel
591	*/
592	#ifdef __NR_getdents64
593
594	#if SH_KERNEL_NUMERIC >= 132628
595	/*
596	* 'asmlinkage' is __required__ to get this to work.
597	*/
598	asmlinkage long new_getdents64 (unsigned int fd, struct linux_dirent64 __user *dirp,
599	unsigned int count)
600	#else
601	long new_getdents64 (unsigned int fd, struct dirent64 *dirp, unsigned int count)
602	#endif
603	{
604	long status = 0; /* Return value from original getdents */
605	struct inode * dir_inode;
606	struct file * fd_file;
607	int dir_is_proc = 0;
608
609	#if SH_KERNEL_NUMERIC < KERNEL_VERSION(2,6,27)
610	struct dirent64 * dirp_prev;
611	struct dirent64 * dirp_new;
612	struct dirent64 * dirp_current;
613	#else
614	struct linux_dirent64 * dirp_prev;
615	struct linux_dirent64 * dirp_new;
616	struct linux_dirent64 * dirp_current;
617	#endif
618
619	int dir_table_bytes;
620	int forward_bytes;
621	struct task_struct * task_ptr;
622	int hide_it = 0;
623	__s64 dirp_offset;
624
625	unsigned long dummy;
626
627	#ifdef FILE_DEBUG
628	printk("FD64 %d\n", fd);
629	#endif
630
631	lock_kernel();
632
633	#ifdef FILE_DEBUG
634	if (!access_ok(VERIFY_WRITE, dirp, count))
635	printk("ACCESS64_BAD\n");
636	else
637	printk("ACCESS64_OK\n");
638	#endif
639
640	#if SH_KERNEL_NUMERIC >= 132628
641	status = (*old_getdents64)(fd, dirp, count);
642	/* status = my_real_getdents64(fd, dirp, count); */
643	#else
644	status = (*old_getdents64)(fd, dirp, count);
645	#endif
646
647	#ifdef FILE_DEBUG
648	printk("STATUS64 %ld\n", status);
649	#endif
650
651	/* 0: end of directory.
652	* -1: some error
653	*/
654	if (status <= 0)
655	{
656	unlock_kernel();
657	return (status);
658	}
659
660	/* Handle directory caching. dir_inode is the inode of the directory.
661	*/
662	#if defined(files_fdtable)
663	{
664	struct fdtable *fdt = files_fdtable(current->files);
665	fd_file = rcu_dereference(fdt->fd[fd]);
666	}
667	#else
668	{
669	fd_file = current->files->fd[fd];
670	}
671	#endif
672
673	#if defined(__LINUX_DCACHE_H)
674
675	/* 2.6.20 (((2) << 16) + ((6) << 8) + (20)) */
676	#if SH_KERNEL_NUMERIC >= 132628
677	dir_inode = fd_file->f_path.dentry->d_inode;
678	#else
679	dir_inode = fd_file->f_dentry->d_inode;
680	#endif
681
682	#else
683	dir_inode = fd_file->f_inode;
684	#endif
685
686	#ifdef FILE_DEBUG
687	printk("INODE64\n");
688	#endif
689
690	/* Check for the /proc directory
691	*/
692	if (dir_inode->i_ino == PROC_ROOT_INO
693	#ifndef LINUX26
694	&& !MAJOR(dir_inode->i_dev) /* &&
695	MINOR(dir_inode->i_dev) == 1 */
696	/* MINOR commented out because of problems with 2.4.17 */
697	#endif
698	)
699	{
700	dir_is_proc = 1;
701
702	#ifdef PROC_DEBUG
703	printk("PROC_CHECK64\n");
704	#endif
705	}
706
707	/* Allocate space for new dirent table. Can't use GFP_KERNEL
708	* (kernel oops)
709	*/
710	dirp_new = kmalloc ((size_t)status, GFP_ATOMIC);
711
712	#ifdef FILE_DEBUG
713	printk("KMALLOC64_0\n");
714	#endif
715
716	if (dirp_new == NULL)
717	{
718	unlock_kernel();
719	return (status);
720	}
721
722	#ifdef FILE_DEBUG
723	printk("KMALLOC64\n");
724	#endif
725
726	/* Copy the dirp table to kernel space.
727	*/
728	dummy = (unsigned long) copy_from_user(dirp_new, dirp, status);
729
730	#ifdef FILE_DEBUG
731	printk("COPY64 to kernel: %ld\n", dummy);
732	#endif
733
734	/* Loop over the dirp table to find entries to hide.
735	*/
736	dir_table_bytes = status;
737	dirp_current = dirp_new;
738	dirp_prev = NULL;
739
740	while (dir_table_bytes > 0)
741	{
742	hide_it = 0;
743
744	if (dirp_current->d_reclen == 0)
745	break;
746
747	dirp_offset = dirp_current->d_off;
748
749	#ifdef FILE_DEBUG
750	printk("DIRENT %d %d %lld\n",
751	dir_table_bytes,
752	dirp_current->d_reclen,
753	dirp_current->d_off);
754	#endif
755
756	dir_table_bytes -= dirp_current->d_reclen;
757	forward_bytes = dirp_current->d_reclen;
758
759	#ifdef FILE_DEBUG
760	printk("ENTRY %s\n", dirp_current->d_name);
761	#endif
762
763	/* If /proc is scanned (e.g. by 'ps'), hide the entry for
764	* any process where the executable has MAGIC_HIDE in its name.
765	*/
766	if (dir_is_proc == 1)
767	{
768	#ifdef PROC_DEBUG
769	printk("PROC %s\n", dirp_current->d_name);
770	#endif
771	task_ptr = fetch_task_struct(my_atoi(dirp_current->d_name));
772	if (task_ptr != NULL)
773	{
774	#ifdef PROC_DEBUG
775	printk("PROC %s <> %s\n", task_ptr->comm, hidden);
776	#endif
777	if (strstr(task_ptr->comm, hidden) != NULL)
778	hide_it = 1;
779	}
780	}
781	/* If it is a regular directory, hide any entry with
782	* MAGIC_HIDE in its name.
783	*/
784	else
785	{
786	if (strstr (dirp_current->d_name, hidden) != NULL)
787	hide_it = 1;
788	}
789
790	if (hide_it == 1)
791	{
792	#ifdef FILE_DEBUG
793	printk(" -->HIDDEN %s\n", dirp_current->d_name);
794	#endif
795	if (dir_table_bytes > 0)
796	{
797	status -= dirp_current->d_reclen;
798	memmove (dirp_current,
799	(char *) dirp_current + dirp_current->d_reclen,
800	dir_table_bytes);
801
802	/* Set forward_bytes to 0, because now dirp_current is the
803	* (previously) next entry in the dirp table.
804	*/
805	forward_bytes = 0;
806	dirp_prev = dirp_current;
807	}
808	else
809	{
810	status -= dirp_current->d_reclen;
811	if (dirp_prev != NULL)
812	dirp_prev->d_off = dirp_offset;
813	}
814
815	}
816	else
817	{
818	dirp_prev = dirp_current;
819	if (dir_table_bytes == 0 && dirp_prev != NULL)
820	dirp_prev->d_off = dirp_offset;
821	}
822
823	/* Next entry in dirp table.
824	*/
825	#if SH_KERNEL_NUMERIC < KERNEL_VERSION(2,6,27)
826	if (dir_table_bytes > 0)
827	dirp_current = (struct dirent64 ) ( (char ) dirp_current +
828	forward_bytes);
829	#else
830	if (dir_table_bytes > 0)
831	dirp_current = (struct linux_dirent64 ) ( (char ) dirp_current +
832	forward_bytes);
833	#endif
834	}
835
836	/* Copy our modified dirp table back to user space.
837	*/
838	#ifdef FILE_DEBUG
839	printk("STATUS64 AT END %ld\n", status);
840	#endif
841	dummy = (unsigned long) copy_to_user(dirp, dirp_new, status);
842	#ifdef FILE_DEBUG
843	printk("COPY64 to user: %ld\n", dummy);
844	#endif
845
846	kfree (dirp_new);
847	unlock_kernel();
848	return (status);
849	}
850	#endif
851
852	#ifdef LINUX26
853	static struct module sh_find_module(const char name)
854	{
855	struct module *mod;
856	struct list_head * modules = (struct list_head *) SH_LIST_MODULES;
857
858	list_for_each_entry(mod, modules, list) {
859	if (strcmp(mod->name, name) == 0)
860	return mod;
861	}
862	return NULL;
863	}
864	#endif
865
866	/* The initialisation function. Automatically called when module is inserted
867	* via the 'insmod' command.
868	*/
869	#ifdef LINUX26
870	static int __init samhain_hide_init(void)
871	#else
872	int init_module(void)
873	#endif
874	{
875
876	lock_kernel();
877
878	/* Unfortunately this does not fully prevent the module from appearing
879	* in /proc/ksyms.
880	*/
881	#ifndef LINUX26
882	EXPORT_NO_SYMBOLS;
883	#endif
884
885	/* Replace the 'sys_getdents' syscall with the new version.
886	*/
887	old_getdents = (void*) sh_sys_call_table[SYS_getdents];
888	sh_sys_call_table[SYS_getdents] = (unsigned long) new_getdents;
889
890	#ifdef __NR_getdents64
891	old_getdents64 = (void*) sh_sys_call_table[SYS_getdents64];
892	sh_sys_call_table[SYS_getdents64] = (unsigned long) new_getdents64;
893	#endif
894
895	#ifdef LINUX26
896	{
897	#if defined(SH_MODLIST_LOCK)
898	spinlock_t * modlist_lock = (spinlock_t * ) SH_MODLIST_LOCK;
899	#endif
900	#if SH_KERNEL_NUMERIC >= KERNEL_VERSION(2,6,30)
901	struct mutex * sh_module_mutex = &module_mutex;
902	#else
903	#if (SH_KERNEL_NUMERIC >= SH_KERNEL_MIN)
904	struct mutex * sh_module_mutex = (struct mutex *) SH_MODLIST_MUTEX;
905	#endif
906	#endif
907
908	struct module *mod;
909
910	#if SH_KERNEL_NUMERIC >= SH_KERNEL_MIN
911	mutex_lock(sh_module_mutex);
912	#endif
913
914	mod = sh_find_module(SH_INSTALL_NAME"_hide");
915	if (mod) {
916	/* Delete from various lists */
917	#if defined(SH_MODLIST_LOCK)
918	spin_lock_irq(modlist_lock);
919	#endif
920	if (removeme == 1)
921	{
922	list_del(&mod->list);
923	}
924	#if defined(SH_MODLIST_LOCK)
925	spin_unlock_irq(modlist_lock);
926	#endif
927	}
928	#if SH_KERNEL_NUMERIC >= SH_KERNEL_MIN
929	mutex_unlock(sh_module_mutex);
930	#endif
931	}
932	#endif
933
934	unlock_kernel();
935	return (0);
936	}
937
938	/* The cleanup function. Automatically called when module is removed
939	* via the 'rmmod' command.
940	*/
941	#ifdef LINUX26
942	static void __exit samhain_hide_cleanup(void)
943	#else
944	void cleanup_module(void)
945	#endif
946	{
947	lock_kernel();
948
949	/* Restore the new syscalls to the original version.
950	*/
951	sh_sys_call_table[SYS_getdents] = (unsigned long) old_getdents;
952
953	#ifdef __NR_getdents64
954	sh_sys_call_table[SYS_getdents64] = (unsigned long) old_getdents64;
955	#endif
956
957	unlock_kernel();
958	}
959
960	#ifdef LINUX26
961	module_init(samhain_hide_init);
962	module_exit(samhain_hide_cleanup);
963	#endif
964
965

Note: See TracBrowser for help on using the repository browser.

Download in other formats: