source: trunk/src/samhain_hide.c@ 90

Last change on this file since 90 was 90, checked in by rainer, 18 years ago

Fix for ticket #50 (samhain_hide not compiling on 2.6.19).
File size: 18.4 KB
Line 
1/***************************************************************************
2 *
3 * Purpose:
4 * -------
5 * (1) Hide files with the string MAGIC_HIDE in filename,
6 * where MAGIC_HIDE is defined below.
7 * By default, MAGIC_HIDE is defined as "samhain".
8 *
9 * (2) Hide all processes, if the executable has the string MAGIC_HIDE
10 * in its name.
11 *
12 *
13 * Configuration:
14 * -------------
15 * If not building within the samhain system, you may remove the
16 * line '#include "config.h"' and in the line
17 * '#define MAGIC_HIDE SH_MAGIC_HIDE', replace SH_MAGIC_HIDE with
18 * "someString" (in quotes !).
19 */
20
21/* #define _(string) string */
22#include "config.h"
23
24#undef _
25#define _(string) string
26
27/* define if this is a 2.6 kernel */
28/* #define LINUX26 */
29
30#define MAGIC_HIDE SH_MAGIC_HIDE
31
32/* #define MAGIC_HIDE "someString" */
33
34/* define this if you have a modversioned kernel */
35/* #define MODVERSIONS */
36
37/* the address of the sys_call_table (not exported in 2.5 kernels) */
38#define MAGIC_ADDRESS SH_SYSCALLTABLE
39
40/*
41 * Install:
42 * -------
43 * gcc -Wall -O2 -c samhain_hide.c
44 * mv samhain_hide.o /lib/modules/KERNEL_VERSION/misc/
45 *
46 * (Replace KERNEL_VERSION with your kernel's version.)
47 *
48 * Usage:
49 * -----
50 * To load the module:
51 * insmod samhain_hide (for improved safety: 'sync && insmod samhain_hide')
52 *
53 * To unload the module
54 * rmmod samhain_hide (for improved safety: 'sync && rmmod samhain_hide')
55 *
56 *
57 * Details:
58 * -------
59 * The following kernel syscalls are replaced:
60 * sys_getdents [hide files/directories/processes (/proc/PID)]
61 *
62 * Tested on:
63 * ---------
64 * Linux 2.2, 2.4, 2.6
65 *
66 * Copyright:
67 * ---------
68 * Copyright (C) 2001, 2002 Rainer Wichmann (http://la-samhna.de)
69 *
70 * License:
71 * -------
72 * This program is free software; you can redistribute it and/or modify
73 * it under the terms of the GNU General Public License, version 2, as
74 * published by the Free Software Foundation.
75 *
76 * This program is distributed in the hope that it will be useful,
77 * but WITHOUT ANY WARRANTY; without even the implied warranty of
78 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
79 * GNU General Public License for more details.
80 *
81 * You should have received a copy of the GNU General Public License
82 * along with this program; if not, write to the Free Software
83 * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
84 *
85 ***************************************************************************/
86
87
88
89/*****************************************************
90 *
91 * The defines:
92 *
93 *****************************************************/
94
95/* This is a Linux Loadable Kernel Module.
96 */
97
98#ifndef LINUX26
99#define __KERNEL__
100#define MODULE
101#endif
102#define LINUX
103
104/* Define for debugging.
105 */
106/* #define HIDE_DEBUG */ /* query_module */
107/* #define FILE_DEBUG */ /* getdents */
108/* #define READ_DEBUG */ /* read */
109/* #define PROC_DEBUG */ /* procfs */
110
111
112/*****************************************************
113 *
114 * The include files:
115 *
116 *****************************************************/
117
118
119/* The configure options (#defines) for the Kernel
120 */
121#if SH_KERNEL_NUMERIC >= 206019
122#include <linux/autoconf.h>
123#else
124#include <linux/config.h>
125#endif
126
127#ifndef LINUX26
128#ifdef CONFIG_MODVERSIONS
129#include <linux/modversions.h>
130#endif
131#endif
132
133
134#ifdef LINUX26
135#include <linux/init.h>
136#endif
137
138#include <linux/module.h>
139
140/* File tables structures. If directory caching is used,
141 * <linux/dcache.h> will be included here, and __LINUX_DCACHE_H
142 * will thus be defined.
143 */
144#include <linux/fs.h>
145#include <linux/proc_fs.h>
146
147/* Include the SYS_syscall defines.
148 */
149#ifndef LINUX26
150#include <sys/syscall.h>
151#else
152#define SYS_getdents 141
153#define SYS_getdents64 220
154#endif
155
156
157/* Includes for 'getdents' per the manpage.
158 */
159#include <linux/types.h>
160#include <linux/dirent.h>
161#include <linux/unistd.h>
162
163/* To access userspace memory.
164 */
165#include <asm/uaccess.h>
166
167/* Include for lock_kernel().
168 */
169#include <linux/smp_lock.h>
170
171#if SH_KERNEL_NUMERIC >= 206019
172#include <linux/mutex.h>
173#endif
174
175/* Include for fget().
176 */
177#include <linux/file.h>
178
179/*****************************************************
180 *
181 * The global variables:
182 *
183 *****************************************************/
184
185/* The kernel syscall table. Not exported anymore in 2.5 ff., and also
186 * not in the RedHat 2.4 kernel.
187 */
188
189#if 0
190extern void * sys_call_table[];
191#define sh_sys_call_table sys_call_table
192#endif
193
194unsigned long * sh_sys_call_table = (unsigned long *) MAGIC_ADDRESS;
195
196/* The old address of the sys_getdents syscall.
197 */
198int (*old_getdents)(unsigned int, struct dirent *, unsigned int);
199#ifdef __NR_getdents64
200long (*old_getdents64)(unsigned int, struct dirent64 *, unsigned int);
201#endif
202
203char hidden[] = MAGIC_HIDE;
204
205
206/*****************************************************
207 *
208 * The functions:
209 *
210 *****************************************************/
211
212
213MODULE_AUTHOR("Rainer Wichmann");
214MODULE_DESCRIPTION("Hide files/processes/modules with MAGIC_HIDE in name.");
215#if defined(MODULE_LICENSE) || defined(LINUX26)
216MODULE_LICENSE("GPL");
217#endif
218
219#ifdef LINUX26
220/* Default is to hide ourselves.
221 */
222static int removeme = 1;
223
224#ifdef MODULE_PARM
225MODULE_PARM (removeme, "i");
226#else
227module_param(removeme, int, 0444);
228#endif
229
230#ifdef MODULE_PARM_DESC
231MODULE_PARM_DESC(removeme, "Choose zero for not hiding.");
232#endif
233
234/* LINUX26 */
235#endif
236
237
238/*
239 * struct task_struct is defined in linux/sched.h
240 *
241 * as of 2.4.20, the vanilla kernel holds (among others):
242 * struct task_struct *next_task, *prev_task;
243 *
244 * Redhat kernel seems to have a different scheduler.
245 * use:
246 * struct task_struct * find_task_by_pid (int pid);
247 */
248
249#if defined(SH_VANILLA_KERNEL) && !defined(LINUX26)
250/*
251 * Fetch the task struct for a given PID.
252 */
253struct task_struct * fetch_task_struct (int pid)
254{
255 struct task_struct * task_ptr;
256
257#ifdef PROC_DEBUG
258 printk("FETCH TASK %d\n", pid);
259#endif
260
261 task_ptr = current;
262
263 do
264 {
265 if (task_ptr->pid == (pid_t) pid )
266 return (task_ptr);
267 task_ptr = task_ptr->next_task;
268 }
269 while (task_ptr != current);
270
271#ifdef PROC_DEBUG
272 printk("FETCH TASK: NOT FOUND !!!\n");
273#endif
274
275 return (NULL);
276}
277
278#else
279/*
280 * RedHat 2.4.20 kernel
281 */
282struct task_struct * fetch_task_struct (int pid)
283{
284 struct task_struct * task_ptr = NULL;
285 task_ptr = find_task_by_pid (pid);
286 return (task_ptr);
287}
288#endif
289
290/* Convert a string to an int.
291 * Does not recognize integers with a sign (+/-) in front.
292 */
293int my_atoi(char * in_str)
294{
295 int i = 0;
296 int retval = 0;
297 int conv = 0;
298
299 if (in_str == NULL)
300 return (-1);
301
302 while(in_str[i] != '\0')
303 {
304 /* Break if not numeric.
305 */
306 if (in_str[i] < '0' || in_str[i] > '9')
307 break;
308
309 ++conv;
310
311 /* Leading zeroes (should not happen in /proc)
312 */
313 if (retval == 0 && in_str[i] == '0')
314 retval = retval;
315 else
316 retval = retval * 10;
317
318 retval = retval + (in_str[i] - '0');
319
320 i++;
321 }
322
323 if (conv == 0)
324 return (-1);
325 else
326 return (retval);
327}
328
329/* Purpose:
330 *
331 * Hide all files/dirs that include the string MAGIC_HIDE in their
332 * name.
333 */
334int new_getdents (unsigned int fd, struct dirent *dirp, unsigned int count)
335{
336 int status = 0; /* Return value from original getdents */
337 struct inode * dir_inode;
338 struct file * fd_file;
339 int dir_is_proc = 0;
340
341 struct dirent * dirp_prev;
342 struct dirent * dirp_new;
343 struct dirent * dirp_current;
344
345 int dir_table_bytes;
346 int forward_bytes;
347 struct task_struct * task_ptr;
348 int hide_it = 0;
349 long dirp_offset;
350
351 unsigned long dummy;
352
353 lock_kernel();
354
355 status = (*old_getdents)(fd, dirp, count);
356
357#ifdef FILE_DEBUG
358 printk("STATUS %d\n", status);
359#endif
360
361 /* 0: end of directory.
362 * -1: some error
363 */
364 if (status <= 0)
365 {
366 unlock_kernel();
367 return (status);
368 }
369
370 /* Handle directory caching. dir_inode is the inode of the directory.
371 */
372#if defined(files_fdtable)
373 {
374 struct fdtable *fdt = files_fdtable(current->files);
375 fd_file = rcu_dereference(fdt->fd[fd]);
376 }
377#else
378 {
379 fd_file = current->files->fd[fd];
380 }
381#endif
382
383#if defined(__LINUX_DCACHE_H)
384 dir_inode = fd_file->f_dentry->d_inode;
385#else
386 dir_inode = fd_file->f_inode;
387#endif
388
389 /* Check for the /proc directory
390 */
391 if (dir_inode->i_ino == PROC_ROOT_INO
392#ifndef LINUX26
393 && !MAJOR(dir_inode->i_dev) &&
394 MINOR(dir_inode->i_dev) == 1
395#endif
396 )
397 dir_is_proc = 1;
398
399 /* Allocate space for new dirent table. Can't use GFP_KERNEL
400 * (kernel oops)
401 */
402 dirp_new = (struct dirent *) kmalloc (status, GFP_ATOMIC);
403
404 if (dirp_new == NULL)
405 {
406 unlock_kernel();
407 return (status);
408 }
409
410 /* Copy the dirp table to kernel space.
411 */
412 dummy = (unsigned long) copy_from_user(dirp_new, dirp, status);
413
414#ifdef FILE_DEBUG
415 printk("COPY to kernel\n");
416#endif
417
418 /* Loop over the dirp table to find entries to hide.
419 */
420 dir_table_bytes = status;
421 dirp_current = dirp_new;
422 dirp_prev = NULL;
423
424 while (dir_table_bytes > 0)
425 {
426 hide_it = 0;
427
428 if (dirp_current->d_reclen == 0)
429 break;
430
431 dirp_offset = dirp_current->d_off;
432
433#ifdef FILE_DEBUG
434 printk("DIRENT %d %d %ld\n",
435 dir_table_bytes,
436 dirp_current->d_reclen,
437 dirp_current->d_off);
438#endif
439
440 dir_table_bytes -= dirp_current->d_reclen;
441 forward_bytes = dirp_current->d_reclen;
442
443#ifdef FILE_DEBUG
444 printk("ENTRY %s\n", dirp_current->d_name);
445#endif
446
447 /* If /proc is scanned (e.g. by 'ps'), hide the entry for
448 * any process where the executable has MAGIC_HIDE in its name.
449 */
450 if (dir_is_proc == 1)
451 {
452 task_ptr = fetch_task_struct(my_atoi(dirp_current->d_name));
453 if (task_ptr != NULL)
454 {
455 if (strstr(task_ptr->comm, hidden) != NULL)
456 hide_it = 1;
457 }
458 }
459 /* If it is a regular directory, hide any entry with
460 * MAGIC_HIDE in its name.
461 */
462 else
463 {
464 if (strstr (dirp_current->d_name, hidden) != NULL)
465 hide_it = 1;
466 }
467
468 if (hide_it == 1)
469 {
470#ifdef FILE_DEBUG
471 printk(" -->HIDDEN %s\n", dirp_current->d_name);
472#endif
473 if (dir_table_bytes > 0)
474 {
475 status -= dirp_current->d_reclen;
476 memmove (dirp_current,
477 (char *) dirp_current + dirp_current->d_reclen,
478 dir_table_bytes);
479
480 /* Set forward_bytes to 0, because now dirp_current is the
481 * (previously) next entry in the dirp table.
482 */
483 forward_bytes = 0;
484 dirp_prev = dirp_current;
485 }
486 else
487 {
488 status -= dirp_current->d_reclen;
489 if (dirp_prev != NULL)
490 dirp_prev->d_off = dirp_offset;
491 }
492
493 }
494 else
495 {
496 dirp_prev = dirp_current;
497 if (dir_table_bytes == 0 && dirp_prev != NULL)
498 dirp_prev->d_off = dirp_offset;
499 }
500
501 /* Next entry in dirp table.
502 */
503 if (dir_table_bytes > 0)
504 dirp_current = (struct dirent *) ( (char *) dirp_current +
505 forward_bytes);
506 }
507
508 /* Copy our modified dirp table back to user space.
509 */
510 dummy = (unsigned long) copy_to_user(dirp, dirp_new, status);
511#ifdef FILE_DEBUG
512 printk("COPY to user\n");
513#endif
514
515 kfree (dirp_new);
516#ifdef FILE_DEBUG
517 printk("KFREE\n");
518#endif
519
520 unlock_kernel();
521 return (status);
522}
523
524
525/* For 2.4 kernel
526 */
527#ifdef __NR_getdents64
528long new_getdents64 (unsigned int fd, struct dirent64 *dirp,
529 unsigned int count)
530{
531 long status = 0; /* Return value from original getdents */
532 struct inode * dir_inode;
533 struct file * fd_file;
534 int dir_is_proc = 0;
535
536 struct dirent64 * dirp_prev;
537 struct dirent64 * dirp_new;
538 struct dirent64 * dirp_current;
539
540 int dir_table_bytes;
541 int forward_bytes;
542 struct task_struct * task_ptr;
543 int hide_it = 0;
544 __s64 dirp_offset;
545
546 unsigned long dummy;
547
548 lock_kernel();
549
550 status = (*old_getdents64)(fd, dirp, count);
551
552#ifdef FILE_DEBUG
553 printk("STATUS64 %ld\n", status);
554#endif
555
556 /* 0: end of directory.
557 * -1: some error
558 */
559 if (status <= 0)
560 {
561 unlock_kernel();
562 return (status);
563 }
564
565 /* Handle directory caching. dir_inode is the inode of the directory.
566 */
567#if defined(files_fdtable)
568 {
569 struct fdtable *fdt = files_fdtable(current->files);
570 fd_file = rcu_dereference(fdt->fd[fd]);
571 }
572#else
573 {
574 fd_file = current->files->fd[fd];
575 }
576#endif
577
578#if defined(__LINUX_DCACHE_H)
579 dir_inode = fd_file->f_dentry->d_inode;
580#else
581 dir_inode = fd_file->f_inode;
582#endif
583
584#ifdef FILE_DEBUG
585 printk("INODE64\n");
586#endif
587
588 /* Check for the /proc directory
589 */
590 if (dir_inode->i_ino == PROC_ROOT_INO
591#ifndef LINUX26
592 && !MAJOR(dir_inode->i_dev) /* &&
593 MINOR(dir_inode->i_dev) == 1 */
594 /* MINOR commented out because of problems with 2.4.17 */
595#endif
596 )
597 {
598 dir_is_proc = 1;
599
600#ifdef PROC_DEBUG
601 printk("PROC_CHECK64\n");
602#endif
603 }
604
605 /* Allocate space for new dirent table. Can't use GFP_KERNEL
606 * (kernel oops)
607 */
608 dirp_new = kmalloc ((size_t)status, GFP_ATOMIC);
609
610#ifdef FILE_DEBUG
611 printk("KMALLOC64_0\n");
612#endif
613
614 if (dirp_new == NULL)
615 {
616 unlock_kernel();
617 return (status);
618 }
619
620#ifdef FILE_DEBUG
621 printk("KMALLOC64\n");
622#endif
623
624 /* Copy the dirp table to kernel space.
625 */
626 dummy = (unsigned long) copy_from_user(dirp_new, dirp, status);
627
628#ifdef FILE_DEBUG
629 printk("COPY64 to kernel\n");
630#endif
631
632 /* Loop over the dirp table to find entries to hide.
633 */
634 dir_table_bytes = status;
635 dirp_current = dirp_new;
636 dirp_prev = NULL;
637
638 while (dir_table_bytes > 0)
639 {
640 hide_it = 0;
641
642 if (dirp_current->d_reclen == 0)
643 break;
644
645 dirp_offset = dirp_current->d_off;
646
647#ifdef FILE_DEBUG
648 printk("DIRENT %d %d %lld\n",
649 dir_table_bytes,
650 dirp_current->d_reclen,
651 dirp_current->d_off);
652#endif
653
654 dir_table_bytes -= dirp_current->d_reclen;
655 forward_bytes = dirp_current->d_reclen;
656
657#ifdef FILE_DEBUG
658 printk("ENTRY %s\n", dirp_current->d_name);
659#endif
660
661 /* If /proc is scanned (e.g. by 'ps'), hide the entry for
662 * any process where the executable has MAGIC_HIDE in its name.
663 */
664 if (dir_is_proc == 1)
665 {
666#ifdef PROC_DEBUG
667 printk("PROC %s\n", dirp_current->d_name);
668#endif
669 task_ptr = fetch_task_struct(my_atoi(dirp_current->d_name));
670 if (task_ptr != NULL)
671 {
672#ifdef PROC_DEBUG
673 printk("PROC %s <> %s\n", task_ptr->comm, hidden);
674#endif
675 if (strstr(task_ptr->comm, hidden) != NULL)
676 hide_it = 1;
677 }
678 }
679 /* If it is a regular directory, hide any entry with
680 * MAGIC_HIDE in its name.
681 */
682 else
683 {
684 if (strstr (dirp_current->d_name, hidden) != NULL)
685 hide_it = 1;
686 }
687
688 if (hide_it == 1)
689 {
690#ifdef FILE_DEBUG
691 printk(" -->HIDDEN %s\n", dirp_current->d_name);
692#endif
693 if (dir_table_bytes > 0)
694 {
695 status -= dirp_current->d_reclen;
696 memmove (dirp_current,
697 (char *) dirp_current + dirp_current->d_reclen,
698 dir_table_bytes);
699
700 /* Set forward_bytes to 0, because now dirp_current is the
701 * (previously) next entry in the dirp table.
702 */
703 forward_bytes = 0;
704 dirp_prev = dirp_current;
705 }
706 else
707 {
708 status -= dirp_current->d_reclen;
709 if (dirp_prev != NULL)
710 dirp_prev->d_off = dirp_offset;
711 }
712
713 }
714 else
715 {
716 dirp_prev = dirp_current;
717 if (dir_table_bytes == 0 && dirp_prev != NULL)
718 dirp_prev->d_off = dirp_offset;
719 }
720
721 /* Next entry in dirp table.
722 */
723 if (dir_table_bytes > 0)
724 dirp_current = (struct dirent64 *) ( (char *) dirp_current +
725 forward_bytes);
726 }
727
728 /* Copy our modified dirp table back to user space.
729 */
730 dummy = (unsigned long) copy_to_user(dirp, dirp_new, status);
731 kfree (dirp_new);
732 unlock_kernel();
733 return (status);
734}
735#endif
736
737#ifdef LINUX26
738static struct module *find_module(const char *name)
739{
740 struct module *mod;
741 struct list_head * modules = (struct list_head *) SH_LIST_MODULES;
742
743 list_for_each_entry(mod, modules, list) {
744 if (strcmp(mod->name, name) == 0)
745 return mod;
746 }
747 return NULL;
748}
749#endif
750
751/* The initialisation function. Automatically called when module is inserted
752 * via the 'insmod' command.
753 */
754#ifdef LINUX26
755static int __init samhain_hide_init(void)
756#else
757int init_module(void)
758#endif
759{
760
761 lock_kernel();
762
763 /* Unfortunately this does not fully prevent the module from appearing
764 * in /proc/ksyms.
765 */
766#ifndef LINUX26
767 EXPORT_NO_SYMBOLS;
768#endif
769
770 /* Replace the 'sys_getdents' syscall with the new version.
771 */
772 old_getdents = (void*) sh_sys_call_table[SYS_getdents];
773 sh_sys_call_table[SYS_getdents] = (unsigned long) new_getdents;
774
775#ifdef __NR_getdents64
776 old_getdents64 = (void*) sh_sys_call_table[SYS_getdents64];
777 sh_sys_call_table[SYS_getdents64] = (unsigned long) new_getdents64;
778#endif
779
780#ifdef LINUX26
781 {
782#if defined(SH_MODLIST_LOCK)
783 spinlock_t * modlist_lock = (spinlock_t * ) SH_MODLIST_LOCK;
784#endif
785#if SH_KERNEL_NUMERIC >= 206019
786 struct mutex * module_mutex = (struct mutex *) SH_MODLIST_MUTEX;
787#endif
788
789 struct module *mod;
790
791#if SH_KERNEL_NUMERIC >= 206019
792 mutex_lock(module_mutex);
793#endif
794
795 mod = find_module(SH_INSTALL_NAME"_hide");
796 if (mod) {
797 /* Delete from various lists */
798#if defined(SH_MODLIST_LOCK)
799 spin_lock_irq(modlist_lock);
800#endif
801 if (removeme == 1)
802 {
803 list_del(&mod->list);
804 }
805#if defined(SH_MODLIST_LOCK)
806 spin_unlock_irq(modlist_lock);
807#endif
808 }
809#if SH_KERNEL_NUMERIC >= 206019
810 mutex_unlock(module_mutex);
811#endif
812 }
813#endif
814
815 unlock_kernel();
816 return (0);
817}
818
819/* The cleanup function. Automatically called when module is removed
820 * via the 'rmmod' command.
821 */
822#ifdef LINUX26
823static void __exit samhain_hide_cleanup(void)
824#else
825void cleanup_module(void)
826#endif
827{
828 lock_kernel();
829
830 /* Restore the new syscalls to the original version.
831 */
832 sh_sys_call_table[SYS_getdents] = (unsigned long) old_getdents;
833#ifdef __NR_getdents64
834 sh_sys_call_table[SYS_getdents64] = (unsigned long) old_getdents64;
835#endif
836
837 unlock_kernel();
838}
839
840#ifdef LINUX26
841module_init(samhain_hide_init);
842module_exit(samhain_hide_cleanup);
843#endif
844
845
Note: See TracBrowser for help on using the repository browser.