patchDazuko - Patches: patch #4952, Syscall hooks for Linux 2.6

 
 

You are not allowed to post comments on this tracker with your current authentication level.

patch #4952: Syscall hooks for Linux 2.6

Submitter:  Sami Tikka <sti>
Submitted:  Sat 04 Mar 2006 08:01:11 PM UTC
   
 
Assigned to:  ogman Open/Closed:  Closed

Jump to the original submission

Sat 16 Sep 2006 05:45:04 AM UTC, comment #30: 

Oh, and what's the rationale for requiring --sct-readonly to be given explicitly? Forgetting it will completely lock up the system. I know there is a warning, but is there some reason the information in System.map cannot be trusted?

Kevin Kofler <kevinkofler>
Sat 16 Sep 2006 05:04:25 AM UTC, comment #29: 

I just looked at the 2.3.1-pre3 code and xp_sys_unhook has this:
#ifdef SYSCALL_TABLE_READONLY
/* protect the syscall table */
change_page_attr(virt_to_page(sys_call_table), 1, PAGE_KERNEL);
global_flush_tlb();
#endif
This should be PAGE_KERNEL_RO (as this code is supposed to turn the write protection on the syscall table back on). xp_sys_hook has the correct code:
#ifdef SYSCALL_TABLE_READONLY
/* protect the syscall table */
change_page_attr(virt_to_page(sys_call_table), 1, PAGE_KERNEL_RO);
global_flush_tlb();
#endif

Kevin Kofler <kevinkofler>
Fri 30 Jun 2006 04:09:17 PM UTC, comment #28: 

Hi,

Here is the final patch that patches 2.2.2-pre1 to 2.3.0. Some last changes were made to fix compiler warnings for SMP kernels.

John Ogness <ogman>
Group administrator
Fri 30 Jun 2006 12:55:09 PM UTC, comment #27: 

LSM is planned for termination (will most likely be replaced by selinux). But this will unlikely happen within a year. There are several large investments in LSM (AppArmor, Capabilities) that won't disappear overnight.

It is true that LSM does not offer the types of hooks that we want. However, hooking the system call table is not the answer. DazukoFS is the correct way to intercept file system events.

I am convinced that DazukoFS will be ready before LSM disappears.

John Ogness <ogman>
Group administrator
Fri 30 Jun 2006 11:12:02 AM UTC, comment #26: 

But isn't LSM going away really soon now? As far as I can tell, this has been discussed on LKML and mentioned on dazuko-devel. When it comes to Dazuko, LSM support also has other shortcomings, such as not being able to intercept all events, and not working with capabilities support built-in (the latter being the show-stopper for Fedora kernels).

Kevin Kofler <kevinkofler>
Fri 30 Jun 2006 11:06:42 AM UTC, comment #25: 

Here is a new comprehensive patch. It fixes a compiler warning. It also uses different attributes when settings the syscall_table to read-write and read-only. The previous patches did not do work for SuSE 10.1. Looking at the code, I believe the incorrect flags were being used. The new version seems to work well.


Kevin Kofler wrote:

> Why no default locations? :-(


System call hooking in Linux 2.6 is not the default. LSM is still to recommended approach. System call hooking is also only a temporary work-around until Dazuko 3.0 (with DazukoFS) is released.

I don't like the idea of guessing which System.map file is correct. This can have dangerous side effects. Since many people build kernel modules for kernels other than the one currently running, it is not good to assume System.map-`uname -r` is correct. If someone is willing to switch to syscalls for Linux 2.6, then they need to take responsibility and specify the correct mapfile.

John Ogness <ogman>
Group administrator
Thu 29 Jun 2006 11:33:13 PM UTC, comment #24: 

Current CVS with the latest patch (#10270) compiles and works fine on Fedora Core 5. Configured with:
./configure --enable-syscalls --mapfile=/boot/System.map-`uname -r`

Kevin Kofler <kevinkofler>
Thu 29 Jun 2006 11:30:47 PM UTC, comment #23: 

Hmmm...

> checking for System.map file... failed
> error: no System.map file specified,
>        please use --mapfile

Why no default locations? :-( Sami Tikka's patch had them:
MAPFILES="/boot/System.map-$UNAME_R /lib/modules/$UNAME_R/System.map /usr/src/linux/System.map"

The /boot/System.map-`uname -r` location works for me (Fedora Core 5).

Kevin Kofler <kevinkofler>
Thu 29 Jun 2006 11:20:58 PM UTC, comment #22: 

Another note: The following pieces of documentation:
http://www.dazuko.org/tgen.shtml#FEDORA
http://www.dazuko.org/files/dazuko-HOWTO-fedoracore_3.txt
are pretty much obsolete if this goes in, users should be told about the easier method (no kernel recompile needed with --enable-syscalls) there.

Kevin Kofler <kevinkofler>
Thu 29 Jun 2006 03:35:14 PM UTC, comment #21: 

I forgot to mention that I also added a simple check for the syscall address to make sure it is sane. Can someone verify that this works ok for kernels that try to hide everything? I don't know if sys_close is still exported everywhere.

John Ogness <ogman>
Group administrator
Thu 29 Jun 2006 03:32:29 PM UTC, comment #20: 

Hi,

I have posted a new comprehensive patch (rev3).

- fixed compiling under 2.4 by moving device header to 2.6-only
- fixed kernel version check (typo) for resolving filenames
- fixed usage of KERN_INFO for xp_print()

There have also been some other minor changes in CVS. The most recent patch is based on CVS HEAD.

$ env CVS_RSH=ssh cvs -z3 \
-d:pserver:anonymous@cvs.savannah.nongnu.org:/sources/dazuko \
co dazuko

John Ogness <ogman>
Group administrator
Wed 28 Jun 2006 04:24:45 PM UTC, comment #19: 

Sorry, you are right. I have re-included the check for READONLY. I also fixed a few issues for newer kernels. This new patchset is based on CVS head (because there are already several changes in CVS as well).

$ env CVS_RSH=ssh cvs -z3 \
-d:pserver:anonymous@cvs.savannah.nongnu.org:/sources/dazuko \
co dazuko

John Ogness <ogman>
Group administrator
Tue 27 Jun 2006 06:58:04 PM UTC, comment #18: 

I see you're defining SYSCALL_TABLE_READONLY unconditionally. I had a check in there if it actually is read-only (it can be read from System.map) and I think that is needed. If the syscall table is read-write and you define SYSCALL_TABLE_READONLY, then you're write-protecting a page which should be read-write (during the reprotection after the syscall hooking), and this can really break things. Sadly, it seems to be hard to get the original attributes of the section at runtime, so checking at compile time whether we're supposed to unprotect/reprotect the page is easiest.

Kevin Kofler <kevinkofler>
Tue 27 Jun 2006 04:49:15 PM UTC, comment #17: 

OK! I have gone through all the patches, and integrated them into a single patch. I have tested it on several systems, but there should definately be more testing.

$ ./configure --enable-syscalls --mapfile=/boot/System.map

The main difference with the new patch is that the changes were all done in dazuko_linux.[h|c]. As pointed out by Kevin, this seemed to make the most sense.

It also means that the behaviour of the Linux 2.6 syscalls is exactly the same as the existing Linux 2.4 syscalls (which means less new code).

I will be posting this as 2.3.0-pre1 later this week.

John Ogness <ogman>
Group administrator
Fri 09 Jun 2006 11:55:18 PM UTC, comment #16: 

The patches still apply cleanly to Dazuko 2.2.1, however the attached patch is needed to adjust them to the dazuko_get_filename_length->dazuko_strlen name change.

Kevin Kofler <kevinkofler>
Thu 13 Apr 2006 03:38:22 AM UTC, comment #15: 

I dropped the __d_path change because of the rationale in comment #14. Patches #9774 and #9775 replace #9760 and #9761 (i.e. FC5 users need to apply #9648, #9751, #9774 and #9775 to get a working Dazuko for the distro kernel).

I'm sorry I didn't test it on a distribution actually not exporting __d_path in the first place (which would have shown that it doesn't help), but all I have to test with here at home is this FC5 machine (which I used for the testing) and an old Pentium II laptop running FC2 (with a kernel I rebuilt from a recent FC4 SRPM for reasons unrelated to Dazuko, so it probably exports __d_path too). I'm not employed by an AV vendor, I did these patches in my spare time, so I don't have access to a lot of hard- and software.

I can't prune my patches even more without making them useless, so the "a lot more than just add support syscall hooking under Linux 2.6" is down to the 4 points mentioned by Sami Tikka.

Kevin Kofler <kevinkofler>
Thu 13 Apr 2006 02:48:28 AM UTC, comment #14: 

Note that looking up __d_path from System.map probably isn't going to work either if the function is static, so maybe that particular change isn't all that useful anyway. (But it won't hurt either, it will just fall back to the local implementation.)

The FC5 kernel exports __d_path, so of course it also shows up in System.map.

Kevin Kofler <kevinkofler>
Wed 12 Apr 2006 09:28:39 PM UTC, comment #13: 

As for my followup patches, the only part I can remove is looking up __d_path from System.map as well if it isn't exported. I put that in because if we are already looking up 2 addresses in System.map, why not look up a third too? There are almost no code changes going with it.

Everything else, i.e. the compile fixes for newer kernels, looking up sys_call_table from System.map and changing the page protections on sys_call_table if it is read-only, are:

  • patches specific to syscall hooking on Linux 2.6, they specifically change dazuko_linux26_syscall.c,
  • necessary to make syscall hooking work with the Fedora Core 5 kernel.
Kevin Kofler <kevinkofler>
Wed 12 Apr 2006 08:22:34 PM UTC, comment #12: 

John, could you be more specific in what you mean when you say these patches do a lot more than just add support for syscall hooking. Specifically, are you referring to the 4 items I mentioned in my mail to dazuko-devel list?

---- clip ----

1) sys_dup is no longer hooked. I did not see the point. It was generating extra DAZUKO_ON_OPEN events when no file was actually being opened. At least from an anti-virus scanner point-of-view it does not make sense to rescan a file while it has already been opened by the same process.

2) sys_dup2 also no longer generates DAZUKO_ON_OPEN events, but still generates DAZUKO_ON_CLOSE events when the new file descriptor is closed.

3) sys_creat is hooked because it opens a new file.

4) internals of sys_open was changed. Originally dazuko asked permission from daemons before calling original sys_open. This resulted made it difficult to lookup the filename for new files because the file did not yet exist. Also, the inode information for the new file was not available. Now original sys_open is called first, then daemons are consulted and if daemons want to deny file access, original sys_close is called.

---- clip ----

If I remove the above changes, does it meet the criteria you set for "isolating the syscall part of the patches"? I can do that.

I may need help in removing item 4 because I had some trouble with trying to lookup the inode of a file that does not yet exist.

Are you against the changes 1-4 or do you just want to see clean patches?

Sami Tikka <sti>
Group Member
Wed 12 Apr 2006 09:03:07 AM UTC, comment #11: 

Isn't dazuko_linux26_syscall.c closer to dazuko_linux.c than dazuko_linux26.c? Intuitively, I'd think so, and the diff -U 0 file1 file2 | wc -l test confirms my intuition.

Kevin Kofler <kevinkofler>
Wed 12 Apr 2006 08:58:04 AM UTC, comment #10: 

I looked over the patches last night. Unfortunately these patches do a lot more than just add support syscall hooking under Linux 2.6. I will need to sort them out and isolate the syscall hooking part.

I am also not happy about having 2 different C-files for the main Linux 2.6 implementation (dazuko_linux26.c and dazuko_linux26_syscall.c), most of which are copies of one another. This makes future maintenance complicated.

I am interested in bringing these features to the release branch, but it will take some time because:
1. I must isolate the syscall part of the patches.
2. I must integrate dazuko_linux26_syscall.c into dazuko_linux26.c.

Any help with these 2 tasks would be greatly appreciated (and help speed things up).

John Ogness <ogman>
Group administrator
Wed 12 Apr 2006 08:35:15 AM UTC, comment #9: 

Any chance we can get these patches (all 4 of them) merged into an official Dazuko release?

Kevin Kofler <kevinkofler>
Tue 11 Apr 2006 01:07:47 AM UTC, comment #8: 

These patches fix Dazuko for FC5.
I also made __d_path looked up from System.map while I was at it, this isn't needed on FC5 because __d_path is exported, but it makes Dazuko SMP-safe on other systems (I have changed it only in the syscall version though).

Kevin Kofler <kevinkofler>
Mon 10 Apr 2006 07:31:44 PM UTC, comment #7: 

Sorry for having doubted about your testing in comment #4. I realized only later (#5) why it can't work on FC5.

Unfortunately, I think there will probably be more distros with a read-only syscall table soon, maybe even the official Linus kernel will have that patch. It's probably intended to protect against rootkits.

Kevin Kofler <kevinkofler>
Mon 10 Apr 2006 07:19:23 PM UTC, comment #6: 

The patch has been tested on the following Linux distributions:
            Novell Linux Desktop 9
            SUSE Linux 9.3
            SUSE Linux 9.2
            SUSE Linux 9.1
            SUSE Linux 9.0
            SUSE Linux Enterprise Server 9
            SUSE Linux Enterprise Server 8
            Red Hat Enterprise Linux 4
            Red Hat Enterprise Linux 3
            Red Hat Enterprise Linux 2.1 AS
            Mandrake 10.1
            Debian 3.1
(plus a few others)

Sorry it did not work on FC5. I specifically created this patch because Red Hat compiles capabilities into the kernel and refuses to make it a module. If they have now made the syscall table read-only, that probably means that Red Hat customers have to compile their own kernel if they want to run Dazuko. :(

Red Hat has been somewhat uncooperative about getting Dazuko to work with their kernel. Their suggestion is to use LSM but they refuse to fix capabilities or compile it as a module.

It is becoming very difficult to provide Dazuko for Red Hat customers. If Dazuko is important to them, they should perhaps tell Red Hat what they think and/or consider other distributions.

Sami Tikka <sti>
Group Member
Mon 10 Apr 2006 05:41:31 PM UTC, comment #5: 

To conclude this, sys_call_table is read-only in FC5, so we can forget about system call hooking. LSM doesn't work either because capabilities are built in, so you'll have to think up something else.

Kevin Kofler <kevinkofler>
Mon 10 Apr 2006 05:32:27 PM UTC, comment #4: 

I tried using this:

#ifdef HIDDEN_SCT
static void** dazuko_get_sct(void)
{
#ifdef SYS_CALL_TABLE_ADDR
return (void**)SYS_CALL_TABLE_ADDR;
#else
...

with SYS_CALL_TABLE_ADDR looked up the same way DO_EXECV_ADDR is. This just locked up my system. Has this patch even been tested beyond "it compiles"? Or am I doing something wrong?

Kevin Kofler <kevinkofler>
Mon 10 Apr 2006 05:02:51 PM UTC, comment #3: 

It's dazuko_get_sct which just plain can't work.
c02e04a0 R sys_call_table
c033f388 D loops_per_jiffy
c039fd00 D boot_cpu_data
It's simply not in the searched interval.

IMHO, sys_call_table and __d_path should be looked up in System.map too just like do_execve.

Kevin Kofler <kevinkofler>
Mon 10 Apr 2006 04:29:54 AM UTC, comment #2: 

It doesn't work though. :-( It seems no events are emitted at all. (I can get neither the example program nor clamd to work, clamd lets me put the EICAR test file into watched directory without doing anything, and the example program reports no accesses whatsoever in the watched directory.)

Anonymous
Mon 10 Apr 2006 04:14:58 AM UTC, comment #1: 

With Sami Tikka's patch and the compile fix I just added, I can compile Dazuko 2.2.0 with an unmodified FC5 kernel.
        Kevin Kofler

Anonymous
Sat 04 Mar 2006 08:01:11 PM UTC, original submission:  

Dazuko on Linux 2.6 kernels has used LSM callbacks. This is problematic for some distributions where the kernel is built in such a way that new LSM modules cannot be added. Also there are no DAZUKO_ON_CLOSE events available because there is no LSM callback associated with closing of a file.

This patch adds the possibility of using syscall hooking on 2.6 kernels, identical to how dazuko works on 2.4 kernels.

To turn it on, run dazuko's configure with --enable--syscalls.

Sami Tikka <sti>
Group Member

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attached Files
file #10285:  dazuko_linux26_syscall_full_support_final.diff added by ogman (47KiB - text/plain - final complete patch - based on 2.2.2-pre1)
file #10283:  dazuko_linux26_syscall_full_support_rev4.diff added by ogman (45KiB - text/plain - rev4 of complete patch - replaces all previous patches)
file #10270:  dazuko_linux26_syscall_full_support_rev3.diff added by ogman (45KiB - text/plain - rev3 of complete patch - replaces all previous patches)
file #10264:  dazuko_linux26_syscall_full_support_rev2.diff added by ogman (45KiB - text/plain - rev2 of complete patch - replaces all previous patches)
file #10253:  dazuko_linux26_syscall_full_support.diff added by ogman (45KiB - text/plain - complete patch for Linux 2.6+syscall support (replaces all previous patches))
file #10152:  dazuko_linux26_syscall-dazuko2.2.1-fix.diff added by kevinkofler (2KiB - text/x-diff - Compile fix for Dazuko 2.2.1)
file #9775:  dazuko_linux26_syscall-unprotect-rev2.diff added by kevinkofler (2KiB - text/x-diff - Patch to unprotect syscall table on FC5 (supercedes file #9761))
file #9774:  dazuko-configure-unprotect-rev2.diff added by kevinkofler (432B - text/x-diff - Configure patch to support Dazuko on FC5 (supercedes file #9760))
file #9761:  dazuko_linux26_syscall-unprotect.diff added by kevinkofler (2KiB - text/x-diff - Patch to unprotect syscall table on FC5)
file #9760:  dazuko-configure-unprotect.diff added by kevinkofler (583B - text/x-diff - Configure patches to support Dazuko on FC5)
file #9751:  dazuko_linux26_syscall-fc5-fix.diff added by None (1KiB - text/x-diff - Compile fix for kernels >=2.6.14 by Kevin Kofler)
file #9648:  linux26_syscall_hook.patch added by sti (66KiB - text/x-patch - Syscall hooking patch for Linux 2.6)

 

Depends on the following items: None found

Items that depend on this one: None found

 

CC list is empty

 

Follow 14 latest changes.

Date Changed by Updated Field Previous Value => Replaced by
2006-06-30 ogman Assigned toNone ogman
    Open/ClosedOpen Closed
    Attached File- Added dazuko_linux26_syscall_full_support_final.diff, #10285
2006-06-30 ogman Attached File- Added dazuko_linux26_syscall_full_support_rev4.diff, #10283
2006-06-29 ogman Attached File- Added dazuko_linux26_syscall_full_support_rev3.diff, #10270
2006-06-28 ogman Attached File- Added dazuko_linux26_syscall_full_support_rev2.diff, #10264
2006-06-27 ogman Attached File- Added dazuko_linux26_syscall_full_support.diff, #10253
2006-06-09 kevinkofler Attached File- Added dazuko_linux26_syscall-dazuko2.2.1-fix.diff, #10152
2006-04-13 kevinkofler Attached File- Added dazuko_linux26_syscall-unprotect-rev2.diff, #9775
2006-04-13 kevinkofler Attached File- Added dazuko-configure-unprotect-rev2.diff, #9774
2006-04-11 kevinkofler Attached File- Added dazuko_linux26_syscall-unprotect.diff, #9761
2006-04-11 kevinkofler Attached File- Added dazuko-configure-unprotect.diff, #9760
2006-04-10 None Attached File- Added dazuko_linux26_syscall-fc5-fix.diff, #9751
2006-03-04 sti Attached File- Added linux26_syscall_hook.patch, #6012

Back to the top

Powered by Savane 3.13-758e.
Corresponding source code