suspicious-fs (SuS-FS) Discussion thread | @Kartatz

[itsHanibee]

The previous discussion was taking place @ PRs #1 #2 #3, they are not appropriate for discussions. Visit these for the full history regarding this patch.

[itsHanibee]

The people most involved with this series of patches are @Kartatz @backslashxx @simonpunk @itsHanibee, you are encouraged to discuss patchsets and any changes moving forward right here.

[itsHanibee]

Important snippets or discussion;

@backslashxx;

@itsHanibee @Kartatz

might be interesting backslashxx/mojito_krenol@2a35a43

==========================================

sweet, thanks for the heads up I'll look into it. I've noticed you added guarding too.

this might be easier though tiann/KernelSU#1494

==========================================

thanks to simonpunk he extended susfs and now it is controllable with a module and now with cool shit added. this is real cool

SuSFS v2 / XT / whatever Heres full implementation, make sure to read as it also ships with a module to control it! https://gitlab.com/simonpunk/susfs4ksu Mirror: https://github.com/backslashxx/susfs4ksu

here is msm-4.14 sample implementation with fixes included Kernel side: https://github.com/backslashxx/mojito_krenol/commits/susfs-xt-impl/ KernelSU side: https://github.com/backslashxx/KernelSU/commits/11758-susfs/

Basic requirements are

* full path_umount backport with definition on internal.h

* KernelSU

a few fixes and some new features. at first glance, heres whats new, kstat spoofing, extendable umounts and uname spoofing (like arter97 's kernel/sys.c change?)

thanks a fuckton for this @simonpunk

before: (w/ kartatz's initial version) after:

[simonpunk]

@itsHanibee Thanks for having me here. Just a wrap up:
The code rely on KernelSU and some syscall / kernel functions differ on other kernel versions as well, it's still hard to address for other kernel versions. I don't have time to test it all, I think we should just let other interested dev to fork it and make their own patches?

Extra kernel features I have added since from original commit by @Kartatz:

1. better deal with error code returned from some syscall functions. (maybe still more to be done)
2. spoof getdents/getdents64 syscall for hiding the suspicious file/dir
3. kstat spoofing file/dir that are bind mounted or overlayed from maps and syscalls (like you don't want to umount it for target process and keep the changes, but still want to avoid being detected for the changed ino, dev, and change time.)
4. spoof uname syscall.

Thoughts on other improvements:

1. Use hashed list head instead of linked list?
2. How to better secure the prctl called by malicious process? maybe add a token check at arg4? like use a script to let user to change it in patches and ksu_susfs tool.
3. Are there still better ways to hide in maps? Author of shamiko once mentioned that he can hide the trace better in kernel side than in userspace module. Clearly the current spoof logic is not enough to hide better in maps, advises and suggestions will be much appreciated.