Dazuko - Patches: patch #4952, Syscall hooks for Linux 2.6
You are not allowed to post comments on this tracker with your current authentication level.
patch #4952: Syscall hooks for Linux 2.6
Submitter: | Sami Tikka <sti> | ||
Submitted: | Sat 04 Mar 2006 08:01:11 PM UTC | ||
Assigned to: | ogman | Open/Closed: | Closed |
Jump to the original submission
Sat 16 Sep 2006 05:45:04 AM UTC, comment #30: |
Kevin Kofler <kevinkofler> |
Sat 16 Sep 2006 05:04:25 AM UTC, comment #29: I just looked at the 2.3.1-pre3 code and xp_sys_unhook has this:
|
Kevin Kofler <kevinkofler> |
Fri 30 Jun 2006 04:09:17 PM UTC, comment #28: Hi,
|
John Ogness <ogman> |
Fri 30 Jun 2006 12:55:09 PM UTC, comment #27: LSM is planned for termination (will most likely be replaced by selinux). But this will unlikely happen within a year. There are several large investments in LSM (AppArmor, Capabilities) that won't disappear overnight.
|
John Ogness <ogman> |
Fri 30 Jun 2006 11:12:02 AM UTC, comment #26: But isn't LSM going away really soon now? As far as I can tell, this has been discussed on LKML and mentioned on dazuko-devel. When it comes to Dazuko, LSM support also has other shortcomings, such as not being able to intercept all events, and not working with capabilities support built-in (the latter being the show-stopper for Fedora kernels). |
Kevin Kofler <kevinkofler> |
Fri 30 Jun 2006 11:06:42 AM UTC, comment #25: Here is a new comprehensive patch. It fixes a compiler warning. It also uses different attributes when settings the syscall_table to read-write and read-only. The previous patches did not do work for SuSE 10.1. Looking at the code, I believe the incorrect flags were being used. The new version seems to work well.
|
John Ogness <ogman> |
Thu 29 Jun 2006 11:33:13 PM UTC, comment #24: Current CVS with the latest patch (#10270) compiles and works fine on Fedora Core 5. Configured with:
|
Kevin Kofler <kevinkofler> |
Thu 29 Jun 2006 11:30:47 PM UTC, comment #23: Hmmm...
Why no default locations? :-( Sami Tikka's patch had them:
|
Kevin Kofler <kevinkofler> |
Thu 29 Jun 2006 11:20:58 PM UTC, comment #22: Another note: The following pieces of documentation:
|
Kevin Kofler <kevinkofler> |
Thu 29 Jun 2006 03:35:14 PM UTC, comment #21: I forgot to mention that I also added a simple check for the syscall address to make sure it is sane. Can someone verify that this works ok for kernels that try to hide everything? I don't know if sys_close is still exported everywhere. |
John Ogness <ogman> |
Thu 29 Jun 2006 03:32:29 PM UTC, comment #20: Hi,
|
John Ogness <ogman> |
Wed 28 Jun 2006 04:24:45 PM UTC, comment #19: Sorry, you are right. I have re-included the check for READONLY. I also fixed a few issues for newer kernels. This new patchset is based on CVS head (because there are already several changes in CVS as well).
|
John Ogness <ogman> |
Tue 27 Jun 2006 06:58:04 PM UTC, comment #18: I see you're defining SYSCALL_TABLE_READONLY unconditionally. I had a check in there if it actually is read-only (it can be read from System.map) and I think that is needed. If the syscall table is read-write and you define SYSCALL_TABLE_READONLY, then you're write-protecting a page which should be read-write (during the reprotection after the syscall hooking), and this can really break things. Sadly, it seems to be hard to get the original attributes of the section at runtime, so checking at compile time whether we're supposed to unprotect/reprotect the page is easiest. |
Kevin Kofler <kevinkofler> |
Tue 27 Jun 2006 04:49:15 PM UTC, comment #17: OK! I have gone through all the patches, and integrated them into a single patch. I have tested it on several systems, but there should definately be more testing.
|
John Ogness <ogman> |
Fri 09 Jun 2006 11:55:18 PM UTC, comment #16: The patches still apply cleanly to Dazuko 2.2.1, however the attached patch is needed to adjust them to the dazuko_get_filename_length->dazuko_strlen name change. |
Kevin Kofler <kevinkofler> |
Thu 13 Apr 2006 03:38:22 AM UTC, comment #15: I dropped the __d_path change because of the rationale in comment #14. Patches #9774 and #9775 replace #9760 and #9761 (i.e. FC5 users need to apply #9648, #9751, #9774 and #9775 to get a working Dazuko for the distro kernel).
|
Kevin Kofler <kevinkofler> |
Thu 13 Apr 2006 02:48:28 AM UTC, comment #14: Note that looking up __d_path from System.map probably isn't going to work either if the function is static, so maybe that particular change isn't all that useful anyway. (But it won't hurt either, it will just fall back to the local implementation.)
|
Kevin Kofler <kevinkofler> |
Wed 12 Apr 2006 09:28:39 PM UTC, comment #13: As for my followup patches, the only part I can remove is looking up __d_path from System.map as well if it isn't exported. I put that in because if we are already looking up 2 addresses in System.map, why not look up a third too? There are almost no code changes going with it.
|
Kevin Kofler <kevinkofler> |
Wed 12 Apr 2006 08:22:34 PM UTC, comment #12: John, could you be more specific in what you mean when you say these patches do a lot more than just add support for syscall hooking. Specifically, are you referring to the 4 items I mentioned in my mail to dazuko-devel list?
|
Sami Tikka <sti> |
Wed 12 Apr 2006 09:03:07 AM UTC, comment #11: Isn't dazuko_linux26_syscall.c closer to dazuko_linux.c than dazuko_linux26.c? Intuitively, I'd think so, and the diff -U 0 file1 file2 | wc -l test confirms my intuition. |
Kevin Kofler <kevinkofler> |
Wed 12 Apr 2006 08:58:04 AM UTC, comment #10: I looked over the patches last night. Unfortunately these patches do a lot more than just add support syscall hooking under Linux 2.6. I will need to sort them out and isolate the syscall hooking part.
|
John Ogness <ogman> |
Wed 12 Apr 2006 08:35:15 AM UTC, comment #9: Any chance we can get these patches (all 4 of them) merged into an official Dazuko release? |
Kevin Kofler <kevinkofler> |
Tue 11 Apr 2006 01:07:47 AM UTC, comment #8: These patches fix Dazuko for FC5.
|
Kevin Kofler <kevinkofler> |
Mon 10 Apr 2006 07:31:44 PM UTC, comment #7: Sorry for having doubted about your testing in comment #4. I realized only later (#5) why it can't work on FC5.
|
Kevin Kofler <kevinkofler> |
Mon 10 Apr 2006 07:19:23 PM UTC, comment #6: The patch has been tested on the following Linux distributions:
|
Sami Tikka <sti> |
Mon 10 Apr 2006 05:41:31 PM UTC, comment #5: To conclude this, sys_call_table is read-only in FC5, so we can forget about system call hooking. LSM doesn't work either because capabilities are built in, so you'll have to think up something else. |
Kevin Kofler <kevinkofler> |
Mon 10 Apr 2006 05:32:27 PM UTC, comment #4: I tried using this:
|
Kevin Kofler <kevinkofler> |
Mon 10 Apr 2006 05:02:51 PM UTC, comment #3: It's dazuko_get_sct which just plain can't work.
|
Kevin Kofler <kevinkofler> |
Mon 10 Apr 2006 04:29:54 AM UTC, comment #2: It doesn't work though. :-( It seems no events are emitted at all. (I can get neither the example program nor clamd to work, clamd lets me put the EICAR test file into watched directory without doing anything, and the example program reports no accesses whatsoever in the watched directory.) |
Anonymous |
Mon 10 Apr 2006 04:14:58 AM UTC, comment #1: With Sami Tikka's patch and the compile fix I just added, I can compile Dazuko 2.2.0 with an unmodified FC5 kernel. |
Anonymous |
Sat 04 Mar 2006 08:01:11 PM UTC, original submission:
Dazuko on Linux 2.6 kernels has used LSM callbacks. This is problematic for some distributions where the kernel is built in such a way that new LSM modules cannot be added. Also there are no DAZUKO_ON_CLOSE events available because there is no LSM callback associated with closing of a file.
|
Sami Tikka <sti> |
Depends on the following items: None found
Items that depend on this one: None found
Follow 14 latest changes.
Date | Changed by | Updated Field | Previous Value | => | Replaced by |
---|---|---|---|---|---|
2006-06-30 | ogman | Assigned to | None | ogman | |
Open/Closed | Open | Closed | |||
Attached File | - | Added dazuko_linux26_syscall_full_support_final.diff, #10285 | |||
2006-06-30 | ogman | Attached File | - | Added dazuko_linux26_syscall_full_support_rev4.diff, #10283 | |
2006-06-29 | ogman | Attached File | - | Added dazuko_linux26_syscall_full_support_rev3.diff, #10270 | |
2006-06-28 | ogman | Attached File | - | Added dazuko_linux26_syscall_full_support_rev2.diff, #10264 | |
2006-06-27 | ogman | Attached File | - | Added dazuko_linux26_syscall_full_support.diff, #10253 | |
2006-06-09 | kevinkofler | Attached File | - | Added dazuko_linux26_syscall-dazuko2.2.1-fix.diff, #10152 | |
2006-04-13 | kevinkofler | Attached File | - | Added dazuko_linux26_syscall-unprotect-rev2.diff, #9775 | |
2006-04-13 | kevinkofler | Attached File | - | Added dazuko-configure-unprotect-rev2.diff, #9774 | |
2006-04-11 | kevinkofler | Attached File | - | Added dazuko_linux26_syscall-unprotect.diff, #9761 | |
2006-04-11 | kevinkofler | Attached File | - | Added dazuko-configure-unprotect.diff, #9760 | |
2006-04-10 | None | Attached File | - | Added dazuko_linux26_syscall-fc5-fix.diff, #9751 | |
2006-03-04 | sti | Attached File | - | Added linux26_syscall_hook.patch, #6012 |
Powered by Savane 3.13-758e.
Corresponding source code
Oh, and what's the rationale for requiring --sct-readonly to be given explicitly? Forgetting it will completely lock up the system. I know there is a warning, but is there some reason the information in System.map cannot be trusted?