-
Notifications
You must be signed in to change notification settings - Fork 75
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Modify the logic how LKRG tracks the exec syscalls
Since kernel 5.8 function search_binary_handler is not exported anymore. On the aggressively optimized kernels it is possible that `search_binary_handler` can be inlined. However, GCC can splits the function to put the big part in its own function, which receives as a name the original function name plus .part + .<some number>, and inlines the rest in other functions. This is a very problematic behavior from the LKRG point of view and was reported as #41 and #45. This commit fixes the problem by replacing the 'search_binary_handler' (or 'do_execveat_common') hook with security_bprm_committing_creds and security_bprm_committed_creds. Additionally, this change is desired from the security point of view.
- Loading branch information
Showing
9 changed files
with
184 additions
and
102 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
45 changes: 45 additions & 0 deletions
45
...detection/syscalls/exec/p_security_bprm_committed_creds/p_security_bprm_committed_creds.h
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,45 @@ | ||
| /* | ||
| * pi3's Linux kernel Runtime Guard | ||
| * | ||
| * Component: | ||
| * - Intercept 'security_bprm_committed_creds' syscall | ||
| * | ||
| * Notes: | ||
| * - We are maintianing Red-Black tree of pid's for Exploit Detection feature. | ||
| * When process calls execve, we need to update RB tree. | ||
| * | ||
| * Caveats: | ||
| * - None | ||
| * | ||
| * Timeline: | ||
| * - 18.I.2021: Replace one 'search_binary_handler' hook with two | ||
| * independent one to reduce the race window while | ||
| * the process is not being verified | ||
| * - 28.XII.2020: Replace various execve syscall hooks with one hook | ||
| * of the function 'search_binary_handler' | ||
| * - Created: 18.IX.2017 | ||
| * | ||
| * Author: | ||
| * - Adam 'pi3' Zabrocki (http://pi3.com.pl) | ||
| * | ||
| */ | ||
|
|
||
| #ifndef P_LKRG_EXPLOIT_DETECTION_SECURITY_BPRM_COMMITTED_CREDS_H | ||
| #define P_LKRG_EXPLOIT_DETECTION_SECURITY_BPRM_COMMITTED_CREDS_H | ||
|
|
||
| #define P_MAX_PATH PATH_MAX + 0x20 /* For weirdos used by d_path */ | ||
|
|
||
|
|
||
| /* per-instance private data */ | ||
| struct p_security_bprm_committed_creds_data { | ||
| ktime_t entry_stamp; | ||
| }; | ||
|
|
||
|
|
||
| struct inode *p_get_inode_from_task(struct task_struct *p_arg); | ||
|
|
||
| int p_security_bprm_committed_creds_ret(struct kretprobe_instance *p_ri, struct pt_regs *p_regs); | ||
| int p_install_security_bprm_committed_creds_hook(int p_isra); | ||
| void p_uninstall_security_bprm_committed_creds_hook(void); | ||
|
|
||
| #endif |
63 changes: 63 additions & 0 deletions
63
...tection/syscalls/exec/p_security_bprm_committing_creds/p_security_bprm_committing_creds.c
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,63 @@ | ||
| /* | ||
| * pi3's Linux kernel Runtime Guard | ||
| * | ||
| * Component: | ||
| * - Intercept 'search_binary_handler' syscall | ||
| * | ||
| * Notes: | ||
| * - We are maintianing Red-Black tree of pid's for Exploit Detection feature. | ||
| * When process calls execve, we need to update RB tree. | ||
| * | ||
| * Caveats: | ||
| * - None | ||
| * | ||
| * Timeline: | ||
| * - 18.I.2021: Replace one 'search_binary_handler' hook with two | ||
| * independent one to reduce the race window while | ||
| * the process is not being verified | ||
| * - 28.XII.2020: Replace various execve syscall hooks with one hook | ||
| * of the function 'search_binary_handler' | ||
| * - Created: 18.IX.2017 | ||
| * | ||
| * Author: | ||
| * - Adam 'pi3' Zabrocki (http://pi3.com.pl) | ||
| * | ||
| */ | ||
|
|
||
| #include "../../../../../p_lkrg_main.h" | ||
|
|
||
|
|
||
| char p_security_bprm_committing_creds_kretprobe_state = 0; | ||
|
|
||
| static struct kretprobe p_security_bprm_committing_creds_kretprobe = { | ||
| .kp.symbol_name = "security_bprm_committing_creds", | ||
| .handler = NULL, | ||
| .entry_handler = p_security_bprm_committing_creds_entry, | ||
| .data_size = sizeof(struct p_security_bprm_committing_creds_data), | ||
| /* Probe up to 40 instances concurrently. */ | ||
| .maxactive = 40, | ||
| }; | ||
|
|
||
|
|
||
| notrace int p_security_bprm_committing_creds_entry(struct kretprobe_instance *p_ri, struct pt_regs *p_regs) { | ||
|
|
||
| struct p_ed_process *p_tmp; | ||
| unsigned long p_flags; | ||
|
|
||
| p_ed_enforce_validation(); | ||
|
|
||
| p_tasks_write_lock(&p_flags); | ||
| if ( (p_tmp = p_find_ed_by_pid(task_pid_nr(current))) != NULL) { | ||
| p_verify_addr_limit(p_tmp, current); | ||
| #ifdef P_LKRG_TASK_OFF_DEBUG | ||
| p_debug_off_flag_off(p_tmp, 37); | ||
| #endif | ||
| // This process is on the ED list - set temporary 'disable' flag! | ||
| p_set_ed_process_off(p_tmp); | ||
| } | ||
| p_tasks_write_unlock(&p_flags); | ||
|
|
||
| return 0; | ||
| } | ||
|
|
||
| GENERATE_INSTALL_FUNC(security_bprm_committing_creds) |
39 changes: 39 additions & 0 deletions
39
...tection/syscalls/exec/p_security_bprm_committing_creds/p_security_bprm_committing_creds.h
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,39 @@ | ||
| /* | ||
| * pi3's Linux kernel Runtime Guard | ||
| * | ||
| * Component: | ||
| * - Intercept 'security_bprm_committing_creds' syscall | ||
| * | ||
| * Notes: | ||
| * - We are maintianing Red-Black tree of pid's for Exploit Detection feature. | ||
| * When process calls execve, we need to update RB tree. | ||
| * | ||
| * Caveats: | ||
| * - None | ||
| * | ||
| * Timeline: | ||
| * - 18.I.2021: Replace one 'search_binary_handler' hook with two | ||
| * independent one to reduce the race window while | ||
| * the process is not being verified | ||
| * - 28.XII.2020: Replace various execve syscall hooks with one hook | ||
| * of the function 'search_binary_handler' | ||
| * - Created: 18.IX.2017 | ||
| * | ||
| * Author: | ||
| * - Adam 'pi3' Zabrocki (http://pi3.com.pl) | ||
| * | ||
| */ | ||
|
|
||
| #ifndef P_LKRG_EXPLOIT_DETECTION_SECURITY_BPRM_COMMITTING_CREDS_H | ||
| #define P_LKRG_EXPLOIT_DETECTION_SECURITY_BPRM_COMMITTING_CREDS_H | ||
|
|
||
| /* per-instance private data */ | ||
| struct p_security_bprm_committing_creds_data { | ||
| ktime_t entry_stamp; | ||
| }; | ||
|
|
||
| int p_security_bprm_committing_creds_entry(struct kretprobe_instance *p_ri, struct pt_regs *p_regs); | ||
| int p_install_security_bprm_committing_creds_hook(int p_isra); | ||
| void p_uninstall_security_bprm_committing_creds_hook(void); | ||
|
|
||
| #endif |
43 changes: 0 additions & 43 deletions
43
src/modules/exploit_detection/syscalls/p_search_binary_handler/p_search_binary_handler.h
This file was deleted.
Oops, something went wrong.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters