Index: /trunk/configure.ac =================================================================== --- /trunk/configure.ac (revision 50) +++ /trunk/configure.ac (revision 51) @@ -13,5 +13,5 @@ dnl start dnl -AM_INIT_AUTOMAKE(samhain, 2.2.1c) +AM_INIT_AUTOMAKE(samhain, 2.2.2) AC_CANONICAL_HOST Index: /trunk/docs/Changelog =================================================================== --- /trunk/docs/Changelog (revision 50) +++ /trunk/docs/Changelog (revision 51) @@ -1,3 +1,11 @@ -2.2.1c +2.2.2 (17-07-2006) + * minor fixes for regression test scripts + * minor updates to the manual (suggested by Brian A. Seklecki) + * fix sh_kern.c, kern_head.c: kernel rootkit detection for 2.6.17+ + (problem reported by Leonhard Maylein) + * fix samhain_hide.c for 2.6.17+: use module_param() if MODULE_PARM + is not defined + +2.2.1c (11-07-2006) * fix sh_extern.c: sh_ext_add_default() cast to (void) was too early (Solaris 8 build failure reported by Jesse) Index: /trunk/src/kern_head.c =================================================================== --- /trunk/src/kern_head.c (revision 50) +++ /trunk/src/kern_head.c (revision 51) @@ -354,63 +354,9 @@ -struct inode_operations { - int (*create) (int *,int *,int); - int * (*lookup) (int *,int *); - int (*link) (int *,int *,int *); - int (*unlink) (int *,int *); - int (*symlink) (int *,int *,const char *); - int (*mkdir) (int *,int *,int); - int (*rmdir) (int *,int *); - int (*mknod) (int *,int *,int,int); - int (*rename) (int *, int *, - int *, int *); - int (*readlink) (int *, char *,int); - int (*follow_link) (int *, int *); - void (*truncate) (int *); - int (*permission) (int *, int); - int (*revalidate) (int *); - /* - int (*setattr) (int *, int *); - int (*getattr) (int *, int *); - int (*setxattr) (int *, const char *, void *, size_t, int); - ssize_t (*getxattr) (int *, const char *, void *, size_t); - ssize_t (*listxattr) (int *, char *, size_t); - int (*removexattr) (int *, const char *); - */ -}; - -struct file_operations { - int (*create) (int *,int *,int); -}; - -struct proc_dir_entry { - unsigned short low_ino; - unsigned short namelen; - const char * name; - mode_t mode; - nlink_t nlink; - uid_t uid; - gid_t gid; - unsigned long size; - struct inode_operations * proc_iops; - struct file_operations * proc_fops; - /* - get_info_t *get_info; - struct module *owner; - struct proc_dir_entry *next, *parent, *subdir; - void *data; - read_proc_t *read_proc; - write_proc_t *write_proc; - atomic_t count; - int deleted; - */ -}; - - - int main(int argc, char * argv[]) { int i, count, maxcall, qq; int which = 4; + int two_six_seventeen_plus = 0; smap_entry sh_smap[SH_MAXCALLS]; struct utsname utbuf; @@ -455,5 +401,11 @@ which = 4; else if (strncmp(p, "2.6", 3) == 0) - which = 6; + { + which = 6; + if (17 >= atoi (&p[4])) + { + two_six_seventeen_plus = 1; + } + } else { @@ -668,4 +620,8 @@ if (proc_root_iops != 0) { printf("#define PROC_ROOT_IOPS_LOC %#lx\n\n", proc_root_iops); + } + + if (two_six_seventeen_plus == 1) { + printf("#define TWO_SIX_SEVENTEEN_PLUS 1\n\n"); } Index: /trunk/src/samhain_hide.c =================================================================== --- /trunk/src/samhain_hide.c (revision 50) +++ /trunk/src/samhain_hide.c (revision 51) @@ -214,5 +214,15 @@ static int removeme = 1; +#ifdef MODULE_PARM MODULE_PARM (removeme, "i"); +#else +module_param(removeme, int, 0444); +#endif + +#ifdef MODULE_PARM_DESC +MODULE_PARM_DESC(removeme, "Choose zero for not hiding."); +#endif + +/* LINUX26 */ #endif Index: /trunk/src/sh_kern.c =================================================================== --- /trunk/src/sh_kern.c (revision 50) +++ /trunk/src/sh_kern.c (revision 51) @@ -448,4 +448,6 @@ }; +/* this one is just for dummy purposes + */ struct file_operations { int (*create) (int *,int *,int); @@ -460,5 +462,9 @@ uid_t uid; gid_t gid; - unsigned long size; +#if defined TWO_SIX_SEVENTEEN_PLUS + /* size is loff_t in 2.6.17+ kernels */ + unsigned long dummy; +#endif + unsigned long size; struct inode_operations * proc_iops; struct file_operations * proc_fops; @@ -892,6 +898,6 @@ _("proc_root_inode_operations.lookup != proc_root_lookup")); } - else if ( ( ((unsigned int) * &proc_root_dir.proc_iops) != proc_root_iops) && - (proc_root_dir.size != proc_root_iops)) + else if ( ( ((unsigned int) * &proc_root_dir.proc_iops) != proc_root_iops) + && (proc_root_dir.size != proc_root_iops)) { sh_error_handle ((-1), FIL__, __LINE__, 0, MSG_KERN_PROC, Index: /trunk/test/test.sh =================================================================== --- /trunk/test/test.sh (revision 50) +++ /trunk/test/test.sh (revision 51) @@ -398,4 +398,27 @@ } +# This looks silly, but with solaris10/i386 on vmware, +# 'sleep' occasionally does not sleep... + +one_sec_sleep () { + onesdate=`date` + onestest=0 + while [ $onestest -eq 0 ]; do + sleep 1 + twosdate=`date` + if [ "x$twosdate" = "x$onesdate" ]; then + onestest=0 + else + onestest=1 + fi + done +} + +five_sec_sleep () { + for f in 1 2 3 4 5; do + one_sec_sleep + done +} + do_cleanup () { rm -f testrc_1.dyn Index: /trunk/test/testext.sh =================================================================== --- /trunk/test/testext.sh (revision 50) +++ /trunk/test/testext.sh (revision 51) @@ -101,5 +101,5 @@ # The shell is too fast ... - sleep 1 + one_sec_sleep [ -z "$verbose" ] || { echo; Index: /trunk/test/testrun_1.sh =================================================================== --- /trunk/test/testrun_1.sh (revision 50) +++ /trunk/test/testrun_1.sh (revision 51) @@ -76,10 +76,10 @@ mod_testdata_11 () { - sleep 1 + one_sec_sleep echo "foobar" >"${BASE}/c/x"; # bad chmod 0555 "${BASE}/a/y"; # bad ORIGINAL='SetFilecheckTime=60' REPLACEMENT='FileCheckScheduleOne = 6 12 * * *' - ex $RCFILE <"${BASE}/b/x"; # ok echo "foobar" >"${BASE}/c/x"; # bad @@ -222,5 +222,5 @@ mod_testdata_7 () { - sleep 1 + one_sec_sleep echo "foobar" >"${BASE}/a/a/a/z" # ok echo "foobar" >"${BASE}/a/a/a/x" # bad @@ -275,5 +275,5 @@ mod_testdata_6 () { - sleep 1 + one_sec_sleep for ff in $TDIRS; do echo "foobar" >"${BASE}/${ff}/x" @@ -446,5 +446,5 @@ mod_testdata_4 () { - sleep 1 + one_sec_sleep echo "foobar" >> "${BASE}/a/a/x" # Attributes echo "foobar" > "${BASE}/a/a/c/foo" # new within LogFiles @@ -535,5 +535,5 @@ " mod_testdata_3 () { - sleep 1 + one_sec_sleep echo "foobar" > "${BASE}/a/b/foo" # new within Attributes chmod 0555 "${BASE}/a/b" @@ -666,5 +666,5 @@ mod_testdata_1 () { - sleep 1 + one_sec_sleep touch "${BASE}/a/a/x" chmod 0555 "${BASE}/a/a/y" Index: /trunk/test/testrun_1b.sh =================================================================== --- /trunk/test/testrun_1b.sh (revision 50) +++ /trunk/test/testrun_1b.sh (revision 51) @@ -123,5 +123,5 @@ PID=$! - sleep 5 + five_sec_sleep ./samhain -t check -p none -l info --set-prelude-severity=info --prelude --server-addr 127.0.0.1:5500 >/dev/null Index: /trunk/test/testrun_1c.sh =================================================================== --- /trunk/test/testrun_1c.sh (revision 50) +++ /trunk/test/testrun_1c.sh (revision 51) @@ -53,10 +53,10 @@ mod_suiddata_6 () { - sleep 1 + one_sec_sleep chmod 4755 "${BASE}/a/a/y" } chk_suiddata_6 () { - sleep 1 + one_sec_sleep tmp=`ls -l "${BASE}/a/a/y" 2>/dev/null | awk '{ print $1}'` if [ "x$tmp" = "x-rwsr-xr-x" ]; then @@ -91,10 +91,10 @@ mod_suiddata_5 () { - sleep 1 + one_sec_sleep chmod 4755 "${BASE}/a/a/y" } chk_suiddata_5 () { - sleep 1 + one_sec_sleep if [ -f "${BASE}/a/a/y" ]; then [ -z "$verbose" ] || log_msg_fail "${BASE}/a/a/y (not deleted)"; @@ -127,10 +127,10 @@ mod_suiddata_4 () { - sleep 1 + one_sec_sleep chmod 4755 "${BASE}/a/a/y" } chk_suiddata_4 () { - sleep 1 + one_sec_sleep tmp=`cat "${BASE}/a/a/y" 2>/dev/null | wc -c` if [ $tmp -ne 0 ]; then @@ -164,10 +164,10 @@ mod_suiddata_3 () { - sleep 1 + one_sec_sleep chmod 4755 "${BASE}/a/a/y" } chk_suiddata_3 () { - sleep 1 + one_sec_sleep tmp=`ls -l "${BASE}/a/a/y" 2>/dev/null | awk '{ print $1}'` if [ "x$tmp" = "x-rwxr-xr-x" ]; then @@ -192,10 +192,10 @@ mod_suiddata_2 () { - sleep 1 + one_sec_sleep chmod 4755 "${BASE}/a/a/y" } chk_suiddata_2 () { - sleep 1 + one_sec_sleep tmp=`cat "${BASE}/a/a/y" 2>/dev/null | wc -c` if [ $tmp -ne 0 ]; then @@ -218,10 +218,10 @@ mod_suiddata_1 () { - sleep 1 + one_sec_sleep chmod 4755 "${BASE}/a/a/y" } chk_suiddata_1 () { - sleep 1 + one_sec_sleep if [ -f "${BASE}/a/a/y" ]; then [ -z "$verbose" ] || log_msg_fail "${BASE}/a/a/y (not removed)"; Index: /trunk/test/testrun_2.sh =================================================================== --- /trunk/test/testrun_2.sh (revision 50) +++ /trunk/test/testrun_2.sh (revision 51) @@ -37,5 +37,5 @@ ${VALGRIND} ./yule.2 -l info -p none >/dev/null 2>>test_log_valgrind & PROC_Y2=$! - sleep 5 + five_sec_sleep [ -z "$verbose" ] || { @@ -48,5 +48,5 @@ --server-port=49778 >/dev/null 2>>test_log_valgrind & PROC_Y=$! - sleep 5 + five_sec_sleep [ -z "$verbose" ] || { @@ -68,5 +68,5 @@ kill $PROC_Y kill $PROC_Y2 - sleep 5 + five_sec_sleep # cp ${LOGFILE} triple_test @@ -137,5 +137,5 @@ ORIGINAL="UseSeparateLogs=no" REPLACEMENT="UseSeparateLogs=yes" - ex $RCFILE </dev/null 2>>test_log_valgrind & PROC_Y=$! - sleep 5 + five_sec_sleep [ -z "$verbose" ] || { @@ -172,5 +172,5 @@ kill $PROC_Y - sleep 5 + five_sec_sleep if [ -f ${LOGFILE}.${SH_LOCALHOST} ]; then @@ -242,5 +242,5 @@ ORIGINAL_5="dir=1" REPLACEMENT_5="#dir=1" - ex $RCFILE </dev/null 2>>test_log_valgrind & PROC_Y=$! - sleep 5 + five_sec_sleep [ -z "$verbose" ] || { @@ -276,5 +276,5 @@ # echo "PID is ${PROC_S}" [ -z "$verbose" ] || log_msg_ok "samhain.new -t check"; - sleep 5 + five_sec_sleep # Redirect the shells (un-)helpful job monitoring messages. # The 'disown' buildin is not portable. @@ -293,5 +293,5 @@ kill $PROC_Y - sleep 5 + five_sec_sleep egrep "START(>|\").*Yule(>|\")" $LOGFILE >/dev/null 2>&1 @@ -340,9 +340,14 @@ # 'id -u' is posix - me=`id -u` + if test -f /usr/xpg4/bin/id + then + me=`/usr/xpg4/bin/id -u` + else + me=`id -u` + fi ORIGINAL_1="SetSocketAllowUid=0" REPLACEMENT_1="SetSocketAllowUid=$me" - ex $RCFILE </dev/null 2>>test_log_valgrind & PROC_Y=$! - sleep 5 + five_sec_sleep [ -z "$verbose" ] || { @@ -444,5 +449,6 @@ kill ${PROC_Y} - sleep 2 + one_sec_sleep + one_sec_sleep kill -9 ${PROC_Y} >/dev/null 2>&1 @@ -499,5 +505,5 @@ >/dev/null 2>>test_log_valgrind & PROC_Y=$! - sleep 5 + five_sec_sleep egrep '' $HTML >/dev/null 2>&1 @@ -533,5 +539,5 @@ kill $PROC_Y - sleep 5 + five_sec_sleep # rm -f head.html; rm -f foot.html; rm -f entry.html; Index: /trunk/test/testrun_2a.sh =================================================================== --- /trunk/test/testrun_2a.sh (revision 50) +++ /trunk/test/testrun_2a.sh (revision 51) @@ -38,5 +38,5 @@ ${VALGRIND} ./yule -l info -p none >/dev/null 2>>test_log_valgrind & PROC_Y=$! - sleep 5 + five_sec_sleep [ -z "$verbose" ] || { @@ -56,5 +56,5 @@ kill $PROC_Y - sleep 5 + five_sec_sleep egrep "START(>|\").*Yule(>|\")" $LOGFILE >/dev/null 2>&1 Index: /trunk/test/testrun_2c.sh =================================================================== --- /trunk/test/testrun_2c.sh (revision 50) +++ /trunk/test/testrun_2c.sh (revision 51) @@ -91,5 +91,5 @@ ORIGINAL="DatabaseSeverity=none" REPLACEMENT="DatabaseSeverity=info" - ex $RCFILE </dev/null if [ $count -gt 12 ]; then @@ -241,5 +241,5 @@ count=0 while [ `kill -0 $PID` ]; do - sleep 1 + one_sec_sleep let "count = count + 1" >/dev/null if [ $count -gt 12 ]; then @@ -261,5 +261,5 @@ tmp2=`grep 'SUSPEND' $LOGFILE | wc -l` while [ $tmp2 -ne $2 ]; do - sleep 1 + one_sec_sleep let "count = count + 1" >/dev/null if [ $count -gt 12 ]; then @@ -275,5 +275,5 @@ tmp2=$tmp while [ $tmp2 -eq $tmp ]; do - sleep 1 + one_sec_sleep let "count = count + 1" >/dev/null if [ $count -gt 12 ]; then @@ -294,5 +294,5 @@ tmp2=$tmp while [ $tmp2 -eq $tmp ]; do - sleep 1 + one_sec_sleep let "count = count + 1" >/dev/null if [ $count -gt 12 ]; then @@ -324,5 +324,5 @@ tmp=`grep CRIT $LOGFILE | grep -v Runtime | wc -l` while [ $tmp -lt 2 ]; do - sleep 1 + one_sec_sleep if [ $count -gt 12 ]; then [ -z "$verbose" ] || log_msg_fail "policy count (after)"; @@ -336,5 +336,5 @@ tmp2=0 while [ $tmp2 -ne $2 ]; do - sleep 1 + one_sec_sleep let "count = count + 1" >/dev/null if [ $count -gt 12 ]; then @@ -353,5 +353,5 @@ count=0 while [ -f $LOGFILE.lock ]; do - sleep 1 + one_sec_sleep let "count = count + 1" >/dev/null if [ $count -gt 12 ]; then @@ -363,5 +363,5 @@ kill -TTOU $PID - sleep 4 + five_sec_sleep if [ -f $LOGFILE.lock ]; then