| Server IP : 62.109.13.187 / Your IP : 216.73.216.11 [ Web Server : Apache/2.4.6 (CentOS) mpm-itk/2.4.7-04 OpenSSL/1.0.2k-fips PHP/8.2.28 System : Linux robothost.ru 3.10.0-1160.119.1.el7.x86_64 #1 SMP Tue Jun 4 14:43:51 UTC 2024 x86_64 User : mosrembit ( 6064) PHP Version : 8.2.28 Disable Function : NONE Domains : 0 Domains MySQL : OFF | cURL : ON | WGET : ON | Perl : ON | Python : ON | Sudo : ON | Pkexec : ON Directory : /usr/src/file_protector-1.1-234/syscall_hooks/ |
Upload File : |
/**
@file
@brief Common functions and variables for system call hooks
@details Copyright (c) 2017-2022 Acronis International GmbH
@author Mikhail Molchanov (Mikhail.Molchanov@acronis.com)
@since $Id: $
*/
#include "syscall_common.h"
#include "compat.h"
#include "debug.h"
#include "fs_syscall_hooks.h"
#include <asm/ia32_unistd.h> // for ia32_sys_call_table '__NR_ia32_*' system call function indices
#include <linux/delay.h> // loops_per_jiffy
#include <linux/kallsyms.h>
#include <linux/syscalls.h> // sys_close
#include <linux/types.h> // bool, size_t, [u]int(8|16|32|64)_t
#include <linux/unistd.h> // for sys_call_table '__NR_*' system call function indices
static void **p_sys_call_table = NULL;
static void **p_ia32_sys_call_table = NULL;
static bool hooks_attached = false;
struct hook_desc hook_table[] = {
DEFINE_HOOK_DESC(sys, creat, true),
DEFINE_HOOK_DESC(sys, open, true),
DEFINE_HOOK_DESC(sys, openat, true),
DEFINE_HOOK_DESC(sys, write, true),
DEFINE_HOOK_DESC(sys, pwrite64, true),
DEFINE_HOOK_DESC(sys, writev, true),
DEFINE_HOOK_DESC(sys, pwritev, true),
DEFINE_HOOK_DESC(sys, pwritev2, PWRITEV2_ENABLED),
DEFINE_HOOK_DESC(sys, rename, true),
DEFINE_HOOK_DESC(sys, renameat, true),
DEFINE_HOOK_DESC(sys, renameat2, RENAMEAT2_ENABLED),
DEFINE_HOOK_DESC(sys, unlink, true),
DEFINE_HOOK_DESC(sys, unlinkat, true)
};
struct hook_desc ia32_hook_table[] = {
DEFINE_IA32_HOOK_DESC(ia32_sys, creat, true),
DEFINE_IA32_HOOK_DESC(ia32_sys, open, true),
DEFINE_IA32_HOOK_DESC(ia32_sys, openat, true),
DEFINE_IA32_HOOK_DESC(ia32_sys, write, true),
DEFINE_COMPAT_HOOK_DESC(compat_sys, pwrite64, true),
DEFINE_COMPAT_HOOK_DESC(compat_sys, writev, true),
DEFINE_COMPAT_HOOK_DESC(compat_sys, pwritev, true),
DEFINE_COMPAT_HOOK_DESC(compat_sys, pwritev2, PWRITEV2_ENABLED),
DEFINE_IA32_HOOK_DESC(ia32_sys, rename, true),
DEFINE_IA32_HOOK_DESC(ia32_sys, renameat, true),
DEFINE_IA32_HOOK_DESC(ia32_sys, renameat2, RENAMEAT2_ENABLED),
DEFINE_IA32_HOOK_DESC(ia32_sys, unlink, true),
DEFINE_IA32_HOOK_DESC(ia32_sys, unlinkat, true)
};
static inline unsigned long disable_write_protect(void)
{
unsigned long cr0 = read_cr0();
DPRINTF("cr0=%lX WP=%lX", cr0, (unsigned long)X86_CR0_WP);
if (cr0 & X86_CR0_WP) {
write_cr0(cr0 & ~X86_CR0_WP);
}
return cr0;
}
static inline void restore_write_protect(unsigned long saved_cr0)
{
unsigned long cr0 = read_cr0();
DPRINTF("cr0=%lX WP=%lX", cr0, (unsigned long)X86_CR0_WP);
// restore WP-bit of cr0 to pre-disable state
write_cr0((cr0 & ~X86_CR0_WP) | (saved_cr0 & X86_CR0_WP));
}
static int attach_hooks(void)
{
unsigned long flags;
unsigned long cr0;
size_t i;
IPRINTF("attaching syscall hooks...");
local_irq_save(flags);
cr0 = disable_write_protect();
for (i = 0; i < TOTAL_HOOKS_COUNT; i++) {
if (hook_table[i].enabled) {
hook_table[i].syscall_orig = (void *)p_sys_call_table[hook_table[i].syscall_nr];
DPRINTF("'%s_orig()' = %p", hook_table[i].syscall_name, hook_table[i].syscall_orig);
p_sys_call_table[hook_table[i].syscall_nr] = hook_table[i].syscall_hook;
DPRINTF("'%s_hook()' = %p was planted!", hook_table[i].syscall_name, hook_table[i].syscall_hook);
} else {
DPRINTF("planting '%s_hook()' was skipped because it isn't enabled on current distro", hook_table[i].syscall_name);
}
}
for (i = 0; i < TOTAL_IA32_HOOKS_COUNT; i++) {
if (ia32_hook_table[i].enabled) {
ia32_hook_table[i].syscall_orig = (void *)p_ia32_sys_call_table[ia32_hook_table[i].syscall_nr];
DPRINTF("'%s_orig()' = %p", ia32_hook_table[i].syscall_name, ia32_hook_table[i].syscall_orig);
p_ia32_sys_call_table[ia32_hook_table[i].syscall_nr] = ia32_hook_table[i].syscall_hook;
DPRINTF("'%s_hook()' = %p was planted!", ia32_hook_table[i].syscall_name, ia32_hook_table[i].syscall_hook);
} else {
DPRINTF("planting '%s_hook()' was skipped because it isn't enabled on current distro", ia32_hook_table[i].syscall_name);
}
}
restore_write_protect(cr0);
hooks_attached = true;
local_irq_restore(flags);
IPRINTF("syscall hooks attached");
return 0;
}
// FIXME: 'detach' may fail if pointers in syscall tables pointing to our
// hooks were overwritten by someone else
static int detach_hooks(void)
{
unsigned long flags;
unsigned long cr0;
size_t i;
IPRINTF("detaching syscall hooks...");
local_irq_save(flags);
cr0 = disable_write_protect();
for (i = 0; i < TOTAL_HOOKS_COUNT; i++) {
if (hook_table[i].enabled) {
if (likely(hook_table[i].syscall_hook == (void *)p_sys_call_table[hook_table[i].syscall_nr])) {
p_sys_call_table[hook_table[i].syscall_nr] = hook_table[i].syscall_orig;
DPRINTF("%s_orig = %p was planted!", hook_table[i].syscall_name, hook_table[i].syscall_orig);
} else {
EPRINTF("sys_call_table pointer to '%s()' differs from expected, "
"not replacing it with the original one", hook_table[i].syscall_name);
}
} else {
DPRINTF("planting '%s_orig()' was skipped because corresponding hook isn't enabled on current distro", hook_table[i].syscall_name);
}
}
for (i = 0; i < TOTAL_IA32_HOOKS_COUNT; i++) {
if (ia32_hook_table[i].enabled) {
if (likely(ia32_hook_table[i].syscall_hook == (void *)p_ia32_sys_call_table[ia32_hook_table[i].syscall_nr])) {
p_ia32_sys_call_table[ia32_hook_table[i].syscall_nr] = ia32_hook_table[i].syscall_orig;
DPRINTF("%s_orig = %p was planted!", ia32_hook_table[i].syscall_name, ia32_hook_table[i].syscall_orig);
} else {
EPRINTF("ia32_sys_call_table pointer to '%s()' differs from expected, "
"not replacing it with the original one", ia32_hook_table[i].syscall_name);
}
} else {
DPRINTF("planting '%s_orig()' was skipped because corresponding hook isn't enabled on current distro", ia32_hook_table[i].syscall_name);
}
}
restore_write_protect(cr0);
hooks_attached = false;
local_irq_restore(flags);
IPRINTF("syscall hooks detached");
return 0;
}
// FIXME: protect from repeated calls
int syscall_hooks_attach(void)
{
if (hooks_attached) {
EPRINTF("syscall hooks are already attached");
return -EINVAL;
}
if (!p_sys_call_table) {
EPRINTF("'%s' syscall table is unavailable", "x86_64");
return -ENOSYS;
}
if (!p_ia32_sys_call_table) {
EPRINTF("'%s' syscall table is unavailable", "ia32");
return -ENOSYS;
}
IPRINTF("module_refcount()=%lu", module_refcount_compat(THIS_MODULE));
return attach_hooks();
}
// FIXME: protect from repeated calls
int syscall_hooks_detach(void)
{
int r = detach_hooks();
IPRINTF("module_refcount()=%lu", module_refcount_compat(THIS_MODULE));
return r;
}
/*
In the easyest case 'syscall table' is 'exported' and is directly
accessible by its name.
Debian (since at least Debian 8, kernel v3.16) does not export
'sys_call_table' nor 'ia32_sys_call_table'.
Probably 'sys_call_table' symbol was unexported in 2.5.41
In intermediate case 'syscall table' is 'not exported' but can be
found by 'kallsyms_lookup_name()' or via 'kallsyms_on_each_symbol()'
if 'kallsyms_lookup_name()' itself is not exported (for example on
CentOS 6.x).
'kallsyms_lookup_name()' was exported since 'stable/v2.6.33' but
unexported since 'stable/v5.7'.
In worst case 'syscall table' can be found by some 'heuristic'.
Heuristic must check if (while searching for 'sys_call_table') we
just found our variable 'p_sys_call_table' instead of real
'sys_call_table' (it was actually the case, when our variable was
named 'sys_call_table').
Some collected facts:
CentOS 6.0 2.6.32-71.el6.x86_64 LINUX_VERSION_CODE=2.6.32 RHEL_RELEASE_CODE=6.0
CentOS 6.5 2.6.32-431.el6.x86_64 LINUX_VERSION_CODE=2.6.32 RHEL_RELEASE_CODE=6.5
CentOS 6.10 2.6.32-754.el6.x86_64 LINUX_VERSION_CODE=2.6.32 RHEL_RELEASE_CODE=6.9
'kallsyms_lookup_name' is not exported
'kallsyms_on_each_symbol' is exported
CentOS 7.0 3.10.0-123.el7.x86_64 LINUX_VERSION_CODE=3.10.0 RHEL_RELEASE_CODE=7.0
CentOS 7.9 3.10.0-1160.el7.x86_64 LINUX_VERSION_CODE=3.10.0 RHEL_RELEASE_CODE=7.9
Debian 9.5 4.9.0-7-amd64 LINUX_VERSION_CODE=4.9.110
Debian 10.4 4.19.0-9-amd64 LINUX_VERSION_CODE=4.19.118
Ubuntu 16.04 4.4.0-31-generic LINUX_VERSION_CODE=4.4.13
Both 'kallsyms_lookup_name' and 'compat_kallsyms_lookup_name'
return address of 'sys_call_table' and 'ia32_sys_call_table'
Debian 8.0 3.16.0-4-amd64 LINUX_VERSION_CODE=3.16.7
Both 'kallsyms_lookup_name' and 'kallsyms_on_each_symbol' do not
return address of 'sys_call_table' nor 'ia32_sys_call_table'.
It is the case when syscall table search heuristic is necessary.
*/
#if defined USE_FIND_SYSCALL_TABLE_HEURISTIC
#define LOOKUP(nr, name) \
name = (unsigned long) compat_kallsyms_lookup_name(#name); \
if (!name) { \
EPRINTF("%s(%s) failure", "kallsyms_lookup_name", #name); \
return 0; \
} else { \
DPRINTF("%s=0x%X %s=0x%p", #nr, nr, #name, (void *)name); \
}
static unsigned long * __init heuristic_find_sys_call_table(void)
{
unsigned long *p;
unsigned long sys_write;
unsigned long sys_writev;
LOOKUP(__NR_write , sys_write)
LOOKUP(__NR_writev, sys_writev)
for (p = (unsigned long *) sys_close;
p < (unsigned long *) &loops_per_jiffy;
++p)
{
if ((unsigned long) sys_close == p[__NR_close]
&& sys_write == p[__NR_write]
&& sys_writev == p[__NR_writev])
{
if ((unsigned long *)&p_sys_call_table == p) {
WPRINTF("p==&%s", "p_sys_call_table");
} else {
IPRINTF("heuristic: %s=0x%p", "sys_call_table", p);
return p;
}
}
}
EPRINTF("%s not found", "sys_call_table");
return 0;
}
static unsigned long * __init heuristic_find_ia32_sys_call_table(void)
{
unsigned long *p;
unsigned long compat_sys_readv;
unsigned long compat_sys_pwritev;
unsigned long compat_sys_writev;
LOOKUP(__NR_ia32_readv , compat_sys_readv)
LOOKUP(__NR_ia32_pwritev, compat_sys_pwritev)
LOOKUP(__NR_ia32_writev , compat_sys_writev)
for (p = (unsigned long *) sys_close;
p < (unsigned long *) &loops_per_jiffy;
++p)
{
if (compat_sys_readv == p[__NR_ia32_readv]
&& compat_sys_pwritev == p[__NR_ia32_pwritev]
&& compat_sys_writev == p[__NR_ia32_writev])
{
if ((unsigned long *)&p_ia32_sys_call_table == p) {
WPRINTF("p==&%s", "p_ia32_sys_call_table");
} else {
IPRINTF("heuristic: %s=0x%p", "ia32_sys_call_table", p);
return p;
}
}
}
EPRINTF("%s not found", "ia32_sys_call_table");
return 0;
}
#undef LOOKUP
#endif
static unsigned long * __init find_sys_call_table(void)
{
unsigned long *p = (unsigned long *) compat_kallsyms_lookup_name("sys_call_table");
#if defined USE_FIND_SYSCALL_TABLE_HEURISTIC
if (!p) {
p = heuristic_find_sys_call_table();
}
#endif
return p;
}
static unsigned long * __init find_ia32_sys_call_table(void)
{
unsigned long *p = (unsigned long *) compat_kallsyms_lookup_name("ia32_sys_call_table");
#if defined USE_FIND_SYSCALL_TABLE_HEURISTIC
if (!p) {
p = heuristic_find_ia32_sys_call_table();
}
#endif
return p;
}
int __init syscall_hooks_init(void)
{
BUILD_BUG_ON(TOTAL_HOOKS_COUNT != ARRAY_SIZE(hook_table));
BUILD_BUG_ON(TOTAL_IA32_HOOKS_COUNT != ARRAY_SIZE(ia32_hook_table));
p_sys_call_table = (void **)find_sys_call_table();
if (!p_sys_call_table) {
EPRINTF("'%s' syscall table is unavailable", "x86_64");
return -ENOSYS;
}
IPRINTF("'%s' syscall table is at %p", "x86_64", p_sys_call_table);
p_ia32_sys_call_table = (void **)find_ia32_sys_call_table();
if (!p_ia32_sys_call_table) {
EPRINTF("'%s' syscall table is unavailable", "ia32");
return -ENOSYS;
}
IPRINTF("'%s' syscall table is at %p", "ia32", p_ia32_sys_call_table);
return 0;
}
void syscall_hooks_exit(void)
{
DPRINTF("");
}