source: trunk/src/samhain_hide.c@ 94

Last change on this file since 94 was 91, checked in by rainer, 18 years ago

Slightly improved fix for samhain_hide module.
File size: 18.5 KB
Line 
1/***************************************************************************
2 *
3 * Purpose:
4 * -------
5 * (1) Hide files with the string MAGIC_HIDE in filename,
6 * where MAGIC_HIDE is defined below.
7 * By default, MAGIC_HIDE is defined as "samhain".
8 *
9 * (2) Hide all processes, if the executable has the string MAGIC_HIDE
10 * in its name.
11 *
12 *
13 * Configuration:
14 * -------------
15 * If not building within the samhain system, you may remove the
16 * line '#include "config.h"' and in the line
17 * '#define MAGIC_HIDE SH_MAGIC_HIDE', replace SH_MAGIC_HIDE with
18 * "someString" (in quotes !).
19 */
20
21/* #define _(string) string */
22#include "config.h"
23
24#undef _
25#define _(string) string
26
27/* define if this is a 2.6 kernel */
28/* #define LINUX26 */
29
30#define MAGIC_HIDE SH_MAGIC_HIDE
31
32/* #define MAGIC_HIDE "someString" */
33
34/* define this if you have a modversioned kernel */
35/* #define MODVERSIONS */
36
37/* the address of the sys_call_table (not exported in 2.5 kernels) */
38#define MAGIC_ADDRESS SH_SYSCALLTABLE
39
40/*
41 * Install:
42 * -------
43 * gcc -Wall -O2 -c samhain_hide.c
44 * mv samhain_hide.o /lib/modules/KERNEL_VERSION/misc/
45 *
46 * (Replace KERNEL_VERSION with your kernel's version.)
47 *
48 * Usage:
49 * -----
50 * To load the module:
51 * insmod samhain_hide (for improved safety: 'sync && insmod samhain_hide')
52 *
53 * To unload the module
54 * rmmod samhain_hide (for improved safety: 'sync && rmmod samhain_hide')
55 *
56 *
57 * Details:
58 * -------
59 * The following kernel syscalls are replaced:
60 * sys_getdents [hide files/directories/processes (/proc/PID)]
61 *
62 * Tested on:
63 * ---------
64 * Linux 2.2, 2.4, 2.6
65 *
66 * Copyright:
67 * ---------
68 * Copyright (C) 2001, 2002 Rainer Wichmann (http://la-samhna.de)
69 *
70 * License:
71 * -------
72 * This program is free software; you can redistribute it and/or modify
73 * it under the terms of the GNU General Public License, version 2, as
74 * published by the Free Software Foundation.
75 *
76 * This program is distributed in the hope that it will be useful,
77 * but WITHOUT ANY WARRANTY; without even the implied warranty of
78 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
79 * GNU General Public License for more details.
80 *
81 * You should have received a copy of the GNU General Public License
82 * along with this program; if not, write to the Free Software
83 * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
84 *
85 ***************************************************************************/
86
87
88
89/*****************************************************
90 *
91 * The defines:
92 *
93 *****************************************************/
94
95/* This is a Linux Loadable Kernel Module.
96 */
97
98#ifndef LINUX26
99#define __KERNEL__
100#define MODULE
101#endif
102#define LINUX
103
104/* Define for debugging.
105 */
106/* #define HIDE_DEBUG */ /* query_module */
107/* #define FILE_DEBUG */ /* getdents */
108/* #define READ_DEBUG */ /* read */
109/* #define PROC_DEBUG */ /* procfs */
110
111
112/*****************************************************
113 *
114 * The include files:
115 *
116 *****************************************************/
117
118
119/* The configure options (#defines) for the Kernel
120 */
121/* 2.6.19 (((2) << 16) + ((6) << 8) + (19)) */
122#define SH_KERNEL_MIN 132627
123
124#if SH_KERNEL_NUMERIC >= SH_KERNEL_MIN
125#include <linux/autoconf.h>
126#else
127#include <linux/config.h>
128#endif
129
130#ifndef LINUX26
131#ifdef CONFIG_MODVERSIONS
132#include <linux/modversions.h>
133#endif
134#endif
135
136
137#ifdef LINUX26
138#include <linux/init.h>
139#endif
140
141#include <linux/module.h>
142
143/* File tables structures. If directory caching is used,
144 * <linux/dcache.h> will be included here, and __LINUX_DCACHE_H
145 * will thus be defined.
146 */
147#include <linux/fs.h>
148#include <linux/proc_fs.h>
149
150/* Include the SYS_syscall defines.
151 */
152#ifndef LINUX26
153#include <sys/syscall.h>
154#else
155#define SYS_getdents 141
156#define SYS_getdents64 220
157#endif
158
159
160/* Includes for 'getdents' per the manpage.
161 */
162#include <linux/types.h>
163#include <linux/dirent.h>
164#include <linux/unistd.h>
165
166/* To access userspace memory.
167 */
168#include <asm/uaccess.h>
169
170/* Include for lock_kernel().
171 */
172#include <linux/smp_lock.h>
173
174#if SH_KERNEL_NUMERIC >= SH_KERNEL_MIN
175#include <linux/mutex.h>
176#endif
177
178/* Include for fget().
179 */
180#include <linux/file.h>
181
182/*****************************************************
183 *
184 * The global variables:
185 *
186 *****************************************************/
187
188/* The kernel syscall table. Not exported anymore in 2.5 ff., and also
189 * not in the RedHat 2.4 kernel.
190 */
191
192#if 0
193extern void * sys_call_table[];
194#define sh_sys_call_table sys_call_table
195#endif
196
197unsigned long * sh_sys_call_table = (unsigned long *) MAGIC_ADDRESS;
198
199/* The old address of the sys_getdents syscall.
200 */
201int (*old_getdents)(unsigned int, struct dirent *, unsigned int);
202#ifdef __NR_getdents64
203long (*old_getdents64)(unsigned int, struct dirent64 *, unsigned int);
204#endif
205
206char hidden[] = MAGIC_HIDE;
207
208
209/*****************************************************
210 *
211 * The functions:
212 *
213 *****************************************************/
214
215
216MODULE_AUTHOR("Rainer Wichmann");
217MODULE_DESCRIPTION("Hide files/processes/modules with MAGIC_HIDE in name.");
218#if defined(MODULE_LICENSE) || defined(LINUX26)
219MODULE_LICENSE("GPL");
220#endif
221
222#ifdef LINUX26
223/* Default is to hide ourselves.
224 */
225static int removeme = 1;
226
227#ifdef MODULE_PARM
228MODULE_PARM (removeme, "i");
229#else
230module_param(removeme, int, 0444);
231#endif
232
233#ifdef MODULE_PARM_DESC
234MODULE_PARM_DESC(removeme, "Choose zero for not hiding.");
235#endif
236
237/* LINUX26 */
238#endif
239
240
241/*
242 * struct task_struct is defined in linux/sched.h
243 *
244 * as of 2.4.20, the vanilla kernel holds (among others):
245 * struct task_struct *next_task, *prev_task;
246 *
247 * Redhat kernel seems to have a different scheduler.
248 * use:
249 * struct task_struct * find_task_by_pid (int pid);
250 */
251
252#if defined(SH_VANILLA_KERNEL) && !defined(LINUX26)
253/*
254 * Fetch the task struct for a given PID.
255 */
256struct task_struct * fetch_task_struct (int pid)
257{
258 struct task_struct * task_ptr;
259
260#ifdef PROC_DEBUG
261 printk("FETCH TASK %d\n", pid);
262#endif
263
264 task_ptr = current;
265
266 do
267 {
268 if (task_ptr->pid == (pid_t) pid )
269 return (task_ptr);
270 task_ptr = task_ptr->next_task;
271 }
272 while (task_ptr != current);
273
274#ifdef PROC_DEBUG
275 printk("FETCH TASK: NOT FOUND !!!\n");
276#endif
277
278 return (NULL);
279}
280
281#else
282/*
283 * RedHat 2.4.20 kernel
284 */
285struct task_struct * fetch_task_struct (int pid)
286{
287 struct task_struct * task_ptr = NULL;
288 task_ptr = find_task_by_pid (pid);
289 return (task_ptr);
290}
291#endif
292
293/* Convert a string to an int.
294 * Does not recognize integers with a sign (+/-) in front.
295 */
296int my_atoi(char * in_str)
297{
298 int i = 0;
299 int retval = 0;
300 int conv = 0;
301
302 if (in_str == NULL)
303 return (-1);
304
305 while(in_str[i] != '\0')
306 {
307 /* Break if not numeric.
308 */
309 if (in_str[i] < '0' || in_str[i] > '9')
310 break;
311
312 ++conv;
313
314 /* Leading zeroes (should not happen in /proc)
315 */
316 if (retval == 0 && in_str[i] == '0')
317 retval = retval;
318 else
319 retval = retval * 10;
320
321 retval = retval + (in_str[i] - '0');
322
323 i++;
324 }
325
326 if (conv == 0)
327 return (-1);
328 else
329 return (retval);
330}
331
332/* Purpose:
333 *
334 * Hide all files/dirs that include the string MAGIC_HIDE in their
335 * name.
336 */
337int new_getdents (unsigned int fd, struct dirent *dirp, unsigned int count)
338{
339 int status = 0; /* Return value from original getdents */
340 struct inode * dir_inode;
341 struct file * fd_file;
342 int dir_is_proc = 0;
343
344 struct dirent * dirp_prev;
345 struct dirent * dirp_new;
346 struct dirent * dirp_current;
347
348 int dir_table_bytes;
349 int forward_bytes;
350 struct task_struct * task_ptr;
351 int hide_it = 0;
352 long dirp_offset;
353
354 unsigned long dummy;
355
356 lock_kernel();
357
358 status = (*old_getdents)(fd, dirp, count);
359
360#ifdef FILE_DEBUG
361 printk("STATUS %d\n", status);
362#endif
363
364 /* 0: end of directory.
365 * -1: some error
366 */
367 if (status <= 0)
368 {
369 unlock_kernel();
370 return (status);
371 }
372
373 /* Handle directory caching. dir_inode is the inode of the directory.
374 */
375#if defined(files_fdtable)
376 {
377 struct fdtable *fdt = files_fdtable(current->files);
378 fd_file = rcu_dereference(fdt->fd[fd]);
379 }
380#else
381 {
382 fd_file = current->files->fd[fd];
383 }
384#endif
385
386#if defined(__LINUX_DCACHE_H)
387 dir_inode = fd_file->f_dentry->d_inode;
388#else
389 dir_inode = fd_file->f_inode;
390#endif
391
392 /* Check for the /proc directory
393 */
394 if (dir_inode->i_ino == PROC_ROOT_INO
395#ifndef LINUX26
396 && !MAJOR(dir_inode->i_dev) &&
397 MINOR(dir_inode->i_dev) == 1
398#endif
399 )
400 dir_is_proc = 1;
401
402 /* Allocate space for new dirent table. Can't use GFP_KERNEL
403 * (kernel oops)
404 */
405 dirp_new = (struct dirent *) kmalloc (status, GFP_ATOMIC);
406
407 if (dirp_new == NULL)
408 {
409 unlock_kernel();
410 return (status);
411 }
412
413 /* Copy the dirp table to kernel space.
414 */
415 dummy = (unsigned long) copy_from_user(dirp_new, dirp, status);
416
417#ifdef FILE_DEBUG
418 printk("COPY to kernel\n");
419#endif
420
421 /* Loop over the dirp table to find entries to hide.
422 */
423 dir_table_bytes = status;
424 dirp_current = dirp_new;
425 dirp_prev = NULL;
426
427 while (dir_table_bytes > 0)
428 {
429 hide_it = 0;
430
431 if (dirp_current->d_reclen == 0)
432 break;
433
434 dirp_offset = dirp_current->d_off;
435
436#ifdef FILE_DEBUG
437 printk("DIRENT %d %d %ld\n",
438 dir_table_bytes,
439 dirp_current->d_reclen,
440 dirp_current->d_off);
441#endif
442
443 dir_table_bytes -= dirp_current->d_reclen;
444 forward_bytes = dirp_current->d_reclen;
445
446#ifdef FILE_DEBUG
447 printk("ENTRY %s\n", dirp_current->d_name);
448#endif
449
450 /* If /proc is scanned (e.g. by 'ps'), hide the entry for
451 * any process where the executable has MAGIC_HIDE in its name.
452 */
453 if (dir_is_proc == 1)
454 {
455 task_ptr = fetch_task_struct(my_atoi(dirp_current->d_name));
456 if (task_ptr != NULL)
457 {
458 if (strstr(task_ptr->comm, hidden) != NULL)
459 hide_it = 1;
460 }
461 }
462 /* If it is a regular directory, hide any entry with
463 * MAGIC_HIDE in its name.
464 */
465 else
466 {
467 if (strstr (dirp_current->d_name, hidden) != NULL)
468 hide_it = 1;
469 }
470
471 if (hide_it == 1)
472 {
473#ifdef FILE_DEBUG
474 printk(" -->HIDDEN %s\n", dirp_current->d_name);
475#endif
476 if (dir_table_bytes > 0)
477 {
478 status -= dirp_current->d_reclen;
479 memmove (dirp_current,
480 (char *) dirp_current + dirp_current->d_reclen,
481 dir_table_bytes);
482
483 /* Set forward_bytes to 0, because now dirp_current is the
484 * (previously) next entry in the dirp table.
485 */
486 forward_bytes = 0;
487 dirp_prev = dirp_current;
488 }
489 else
490 {
491 status -= dirp_current->d_reclen;
492 if (dirp_prev != NULL)
493 dirp_prev->d_off = dirp_offset;
494 }
495
496 }
497 else
498 {
499 dirp_prev = dirp_current;
500 if (dir_table_bytes == 0 && dirp_prev != NULL)
501 dirp_prev->d_off = dirp_offset;
502 }
503
504 /* Next entry in dirp table.
505 */
506 if (dir_table_bytes > 0)
507 dirp_current = (struct dirent *) ( (char *) dirp_current +
508 forward_bytes);
509 }
510
511 /* Copy our modified dirp table back to user space.
512 */
513 dummy = (unsigned long) copy_to_user(dirp, dirp_new, status);
514#ifdef FILE_DEBUG
515 printk("COPY to user\n");
516#endif
517
518 kfree (dirp_new);
519#ifdef FILE_DEBUG
520 printk("KFREE\n");
521#endif
522
523 unlock_kernel();
524 return (status);
525}
526
527
528/* For 2.4 kernel
529 */
530#ifdef __NR_getdents64
531long new_getdents64 (unsigned int fd, struct dirent64 *dirp,
532 unsigned int count)
533{
534 long status = 0; /* Return value from original getdents */
535 struct inode * dir_inode;
536 struct file * fd_file;
537 int dir_is_proc = 0;
538
539 struct dirent64 * dirp_prev;
540 struct dirent64 * dirp_new;
541 struct dirent64 * dirp_current;
542
543 int dir_table_bytes;
544 int forward_bytes;
545 struct task_struct * task_ptr;
546 int hide_it = 0;
547 __s64 dirp_offset;
548
549 unsigned long dummy;
550
551 lock_kernel();
552
553 status = (*old_getdents64)(fd, dirp, count);
554
555#ifdef FILE_DEBUG
556 printk("STATUS64 %ld\n", status);
557#endif
558
559 /* 0: end of directory.
560 * -1: some error
561 */
562 if (status <= 0)
563 {
564 unlock_kernel();
565 return (status);
566 }
567
568 /* Handle directory caching. dir_inode is the inode of the directory.
569 */
570#if defined(files_fdtable)
571 {
572 struct fdtable *fdt = files_fdtable(current->files);
573 fd_file = rcu_dereference(fdt->fd[fd]);
574 }
575#else
576 {
577 fd_file = current->files->fd[fd];
578 }
579#endif
580
581#if defined(__LINUX_DCACHE_H)
582 dir_inode = fd_file->f_dentry->d_inode;
583#else
584 dir_inode = fd_file->f_inode;
585#endif
586
587#ifdef FILE_DEBUG
588 printk("INODE64\n");
589#endif
590
591 /* Check for the /proc directory
592 */
593 if (dir_inode->i_ino == PROC_ROOT_INO
594#ifndef LINUX26
595 && !MAJOR(dir_inode->i_dev) /* &&
596 MINOR(dir_inode->i_dev) == 1 */
597 /* MINOR commented out because of problems with 2.4.17 */
598#endif
599 )
600 {
601 dir_is_proc = 1;
602
603#ifdef PROC_DEBUG
604 printk("PROC_CHECK64\n");
605#endif
606 }
607
608 /* Allocate space for new dirent table. Can't use GFP_KERNEL
609 * (kernel oops)
610 */
611 dirp_new = kmalloc ((size_t)status, GFP_ATOMIC);
612
613#ifdef FILE_DEBUG
614 printk("KMALLOC64_0\n");
615#endif
616
617 if (dirp_new == NULL)
618 {
619 unlock_kernel();
620 return (status);
621 }
622
623#ifdef FILE_DEBUG
624 printk("KMALLOC64\n");
625#endif
626
627 /* Copy the dirp table to kernel space.
628 */
629 dummy = (unsigned long) copy_from_user(dirp_new, dirp, status);
630
631#ifdef FILE_DEBUG
632 printk("COPY64 to kernel\n");
633#endif
634
635 /* Loop over the dirp table to find entries to hide.
636 */
637 dir_table_bytes = status;
638 dirp_current = dirp_new;
639 dirp_prev = NULL;
640
641 while (dir_table_bytes > 0)
642 {
643 hide_it = 0;
644
645 if (dirp_current->d_reclen == 0)
646 break;
647
648 dirp_offset = dirp_current->d_off;
649
650#ifdef FILE_DEBUG
651 printk("DIRENT %d %d %lld\n",
652 dir_table_bytes,
653 dirp_current->d_reclen,
654 dirp_current->d_off);
655#endif
656
657 dir_table_bytes -= dirp_current->d_reclen;
658 forward_bytes = dirp_current->d_reclen;
659
660#ifdef FILE_DEBUG
661 printk("ENTRY %s\n", dirp_current->d_name);
662#endif
663
664 /* If /proc is scanned (e.g. by 'ps'), hide the entry for
665 * any process where the executable has MAGIC_HIDE in its name.
666 */
667 if (dir_is_proc == 1)
668 {
669#ifdef PROC_DEBUG
670 printk("PROC %s\n", dirp_current->d_name);
671#endif
672 task_ptr = fetch_task_struct(my_atoi(dirp_current->d_name));
673 if (task_ptr != NULL)
674 {
675#ifdef PROC_DEBUG
676 printk("PROC %s <> %s\n", task_ptr->comm, hidden);
677#endif
678 if (strstr(task_ptr->comm, hidden) != NULL)
679 hide_it = 1;
680 }
681 }
682 /* If it is a regular directory, hide any entry with
683 * MAGIC_HIDE in its name.
684 */
685 else
686 {
687 if (strstr (dirp_current->d_name, hidden) != NULL)
688 hide_it = 1;
689 }
690
691 if (hide_it == 1)
692 {
693#ifdef FILE_DEBUG
694 printk(" -->HIDDEN %s\n", dirp_current->d_name);
695#endif
696 if (dir_table_bytes > 0)
697 {
698 status -= dirp_current->d_reclen;
699 memmove (dirp_current,
700 (char *) dirp_current + dirp_current->d_reclen,
701 dir_table_bytes);
702
703 /* Set forward_bytes to 0, because now dirp_current is the
704 * (previously) next entry in the dirp table.
705 */
706 forward_bytes = 0;
707 dirp_prev = dirp_current;
708 }
709 else
710 {
711 status -= dirp_current->d_reclen;
712 if (dirp_prev != NULL)
713 dirp_prev->d_off = dirp_offset;
714 }
715
716 }
717 else
718 {
719 dirp_prev = dirp_current;
720 if (dir_table_bytes == 0 && dirp_prev != NULL)
721 dirp_prev->d_off = dirp_offset;
722 }
723
724 /* Next entry in dirp table.
725 */
726 if (dir_table_bytes > 0)
727 dirp_current = (struct dirent64 *) ( (char *) dirp_current +
728 forward_bytes);
729 }
730
731 /* Copy our modified dirp table back to user space.
732 */
733 dummy = (unsigned long) copy_to_user(dirp, dirp_new, status);
734 kfree (dirp_new);
735 unlock_kernel();
736 return (status);
737}
738#endif
739
740#ifdef LINUX26
741static struct module *find_module(const char *name)
742{
743 struct module *mod;
744 struct list_head * modules = (struct list_head *) SH_LIST_MODULES;
745
746 list_for_each_entry(mod, modules, list) {
747 if (strcmp(mod->name, name) == 0)
748 return mod;
749 }
750 return NULL;
751}
752#endif
753
754/* The initialisation function. Automatically called when module is inserted
755 * via the 'insmod' command.
756 */
757#ifdef LINUX26
758static int __init samhain_hide_init(void)
759#else
760int init_module(void)
761#endif
762{
763
764 lock_kernel();
765
766 /* Unfortunately this does not fully prevent the module from appearing
767 * in /proc/ksyms.
768 */
769#ifndef LINUX26
770 EXPORT_NO_SYMBOLS;
771#endif
772
773 /* Replace the 'sys_getdents' syscall with the new version.
774 */
775 old_getdents = (void*) sh_sys_call_table[SYS_getdents];
776 sh_sys_call_table[SYS_getdents] = (unsigned long) new_getdents;
777
778#ifdef __NR_getdents64
779 old_getdents64 = (void*) sh_sys_call_table[SYS_getdents64];
780 sh_sys_call_table[SYS_getdents64] = (unsigned long) new_getdents64;
781#endif
782
783#ifdef LINUX26
784 {
785#if defined(SH_MODLIST_LOCK)
786 spinlock_t * modlist_lock = (spinlock_t * ) SH_MODLIST_LOCK;
787#endif
788#if SH_KERNEL_NUMERIC >= SH_KERNEL_MIN
789 struct mutex * module_mutex = (struct mutex *) SH_MODLIST_MUTEX;
790#endif
791
792 struct module *mod;
793
794#if SH_KERNEL_NUMERIC >= SH_KERNEL_MIN
795 mutex_lock(module_mutex);
796#endif
797
798 mod = find_module(SH_INSTALL_NAME"_hide");
799 if (mod) {
800 /* Delete from various lists */
801#if defined(SH_MODLIST_LOCK)
802 spin_lock_irq(modlist_lock);
803#endif
804 if (removeme == 1)
805 {
806 list_del(&mod->list);
807 }
808#if defined(SH_MODLIST_LOCK)
809 spin_unlock_irq(modlist_lock);
810#endif
811 }
812#if SH_KERNEL_NUMERIC >= SH_KERNEL_MIN
813 mutex_unlock(module_mutex);
814#endif
815 }
816#endif
817
818 unlock_kernel();
819 return (0);
820}
821
822/* The cleanup function. Automatically called when module is removed
823 * via the 'rmmod' command.
824 */
825#ifdef LINUX26
826static void __exit samhain_hide_cleanup(void)
827#else
828void cleanup_module(void)
829#endif
830{
831 lock_kernel();
832
833 /* Restore the new syscalls to the original version.
834 */
835 sh_sys_call_table[SYS_getdents] = (unsigned long) old_getdents;
836#ifdef __NR_getdents64
837 sh_sys_call_table[SYS_getdents64] = (unsigned long) old_getdents64;
838#endif
839
840 unlock_kernel();
841}
842
843#ifdef LINUX26
844module_init(samhain_hide_init);
845module_exit(samhain_hide_cleanup);
846#endif
847
848
Note: See TracBrowser for help on using the repository browser.