X-Git-Url: http://git.onelab.eu/?a=blobdiff_plain;f=procprotect.c;h=1ceea461ff81088d9b1d5721e5e9c9d97217584c;hb=5d8a946ffbc555ecdb555fe16ffc1efa0bb8ff31;hp=b8b339e6cc347dc5b8145cdf24c3b4fb8f1c8b87;hpb=9b30d70a7d9e6ab78dcba7a21366215a984ae6fa;p=procprotect.git diff --git a/procprotect.c b/procprotect.c index b8b339e..1ceea46 100644 --- a/procprotect.c +++ b/procprotect.c @@ -33,7 +33,7 @@ #error "This code does not support your architecture" #endif -static char *aclpath __devinitdata = "procprotect"; +static char *aclpath = "procprotect"; static struct qstr aclqpath; module_param(aclpath, charp, 0); @@ -46,6 +46,8 @@ MODULE_VERSION(VERSION_STR); struct procprotect_ctx { struct inode **inode; + struct qstr *q; + struct path *path; int flags; }; @@ -60,12 +62,25 @@ struct hlist_head procprotect_hash[HASH_SIZE]; struct proc_dir_entry *proc_entry; +static int run_acl(unsigned long ino) { + struct hlist_node *n; + struct acl_entry *entry; + hlist_for_each_entry_rcu(entry, + n, &procprotect_hash[ino & (HASH_SIZE-1)], + hlist) { + if (entry->ino==ino) { + return 0; + } + } + return 1; +} + /* Entry point of intercepted call. We need to do two things here: - Decide if we need the heavier return hook to be called - Save the first argument, which is in a register, for consideration in the return hook */ -static int do_lookup_entry(struct kretprobe_instance *ri, struct pt_regs *regs) { +static int lookup_fast_entry(struct kretprobe_instance *ri, struct pt_regs *regs) { int ret = -1; struct procprotect_ctx *ctx; struct nameidata *nd = (struct nameidata *) regs->di; @@ -84,34 +99,71 @@ static int do_lookup_entry(struct kretprobe_instance *ri, struct pt_regs *regs) return ret; } -static int run_acl(unsigned long ino) { - struct hlist_node *n; - struct acl_entry *entry; - hlist_for_each_entry_rcu(entry, - n, &procprotect_hash[ino & (HASH_SIZE-1)], - hlist) { - if (entry->ino==ino) { - return 0; +/* The entry hook ensures that the return hook is only called for + accesses to /proc */ + +int printed=0; + +static int lookup_fast_ret(struct kretprobe_instance *ri, struct pt_regs *regs) +{ + struct procprotect_ctx *ctx = (struct procprotect_ctx *) ri->data; + int ret = regs->ax; + + if (ret==0) { + /* The kernel is going to honor the request. Here's where we step in */ + struct inode *inode = *(ctx->inode); + if (!run_acl(inode->i_ino)) { + regs->ax = -EPERM; } } - return 1; + + + return 0; +} + +static int lookup_slow_entry(struct kretprobe_instance *ri, struct pt_regs *regs) { + int ret = -1; + struct procprotect_ctx *ctx; + struct nameidata *nd = (struct nameidata *) regs->di; + struct qstr *q = (struct qstr *) regs->si; + struct path *p = (struct path *) regs->dx; + + struct dentry *parent = nd->path.dentry; + struct inode *pinode = parent->d_inode; + + + + if (pinode->i_sb->s_magic == PROC_SUPER_MAGIC + && current->nsproxy->mnt_ns!=init_task.nsproxy->mnt_ns) { + + ctx = (struct procprotect_ctx *) ri->data; + ctx->q = q; + ctx->flags = nd->flags; + ctx->path = p; + ret = 0; + } + + return ret; } /* The entry hook ensures that the return hook is only called for accesses to /proc */ -static int do_lookup_ret(struct kretprobe_instance *ri, struct pt_regs *regs) +static int lookup_slow_ret(struct kretprobe_instance *ri, struct pt_regs *regs) { struct procprotect_ctx *ctx = (struct procprotect_ctx *) ri->data; int ret = regs->ax; if (ret==0) { /* The kernel is going to honor the request. Here's where we step in */ - struct inode *inode = *(ctx->inode); + /*struct qstr *q = ctx->q; + if (!strncmp(q->name,"sysrq-trigger",13)) { + printk(KERN_CRIT "lookup_slow sysrqtrigger"); + }*/ + struct path *p = ctx->path; + struct inode *inode = p->dentry->d_inode; if (!run_acl(inode->i_ino)) { - if (current->nsproxy->mnt_ns!=init_task.nsproxy->mnt_ns) { - regs->ax = -EPERM; - } + regs->ax = -EPERM; } } @@ -125,12 +177,17 @@ struct open_flags { int intent; }; -static struct file *do_last_probe(struct nameidata *nd, struct path *path, +static struct file *do_last_probe(struct nameidata *nd, struct path *path, struct file *file, struct open_flags *op, const char *pathname) { struct dentry *parent = nd->path.dentry; struct inode *pinode = parent->d_inode; + struct qstr *q = &nd->last; + if (pinode->i_sb->s_magic == PROC_SUPER_MAGIC && current->nsproxy->mnt_ns!=init_task.nsproxy->mnt_ns) { + /*if (!strncmp(q->name,"sysrq-trigger",13)) { + printk(KERN_CRIT "do_last sysrqtrigger: %d",op->open_flag); + }*/ op->open_flag &= ~O_CREAT; } jprobe_return(); @@ -140,9 +197,16 @@ static struct jprobe dolast_probe = { .entry = (kprobe_opcode_t *) do_last_probe }; -static struct kretprobe proc_probe = { - .entry_handler = (kprobe_opcode_t *) do_lookup_entry, - .handler = (kprobe_opcode_t *) do_lookup_ret, +static struct kretprobe fast_probe = { + .entry_handler = (kprobe_opcode_t *) lookup_fast_entry, + .handler = (kprobe_opcode_t *) lookup_fast_ret, + .maxactive = 20, + .data_size = sizeof(struct procprotect_ctx) +}; + +static struct kretprobe slow_probe = { + .entry_handler = (kprobe_opcode_t *) lookup_slow_entry, + .handler = (kprobe_opcode_t *) lookup_slow_ret, .maxactive = 20, .data_size = sizeof(struct procprotect_ctx) }; @@ -176,7 +240,8 @@ static void add_entry(char *pathname) { static void __exit procprotect_exit(void) { - unregister_kretprobe(&proc_probe); + unregister_kretprobe(&fast_probe); + unregister_kretprobe(&slow_probe); unregister_jprobe(&dolast_probe); struct hlist_node *n; struct acl_entry *entry; @@ -210,6 +275,7 @@ int procfile_write(struct file *file, const char *buffer, unsigned long count, v } else pathname[count]='\0'; + add_entry(pathname); printk(KERN_CRIT "Length of buffer=%d",strlen(pathname)); return count; @@ -229,13 +295,6 @@ static int __init procprotect_init(void) aclqpath.name = aclpath; aclqpath.len = strnlen(aclpath, PATH_MAX); - proc_probe.kp.addr = - (kprobe_opcode_t *) kallsyms_lookup_name("lookup_fast"); - if (!proc_probe.kp.addr) { - printk("Couldn't find %s to plant kretprobe\n", "lookup_fast"); - return -1; - } - dolast_probe.kp.addr = (kprobe_opcode_t *) kallsyms_lookup_name("do_last"); @@ -248,13 +307,36 @@ static int __init procprotect_init(void) printk("register_jprobe failed, returned %u\n", ret); return -1; } + fast_probe.kp.addr = + (kprobe_opcode_t *) kallsyms_lookup_name("lookup_fast"); + if (!fast_probe.kp.addr) { + printk("Couldn't find %s to plant kretprobe\n", "lookup_fast"); + return -1; + } + + slow_probe.kp.addr = + (kprobe_opcode_t *) kallsyms_lookup_name("lookup_slow"); + if (!slow_probe.kp.addr) { + printk("Couldn't find %s to plant kretprobe\n", "lookup_slow"); + return -1; + } + + + + if ((ret = register_kretprobe(&fast_probe)) <0) { + printk("register_kretprobe failed, returned %d\n", ret); + return -1; + } + + printk("Planted kretprobe at %p, handler addr %p\n", + fast_probe.kp.addr, fast_probe.handler); - if ((ret = register_kretprobe(&proc_probe)) <0) { + if ((ret = register_kretprobe(&slow_probe)) <0) { printk("register_kretprobe failed, returned %d\n", ret); return -1; } printk("Planted kretprobe at %p, handler addr %p\n", - proc_probe.kp.addr, proc_probe.handler); + slow_probe.kp.addr, slow_probe.handler); proc_entry = create_proc_entry("procprotect", 0644, NULL); proc_entry->write_proc = procfile_write;