[BUILD IS FAILING] Added file system hooks and other improvements. Uploading because of needing to backup

This commit is contained in:
h3xduck
2022-01-04 20:09:59 -05:00
parent 74873dbca5
commit f8774ac9cf
15 changed files with 1132 additions and 988 deletions

View File

@@ -0,0 +1,51 @@
#ifndef __MOD_FS_H
#define __MOD_FS_H
#include <linux/bpf.h>
#include <bpf/bpf.h>
#include <bpf/libbpf.h>
#include "common.h"
#include "xdp_filter.skel.h"
//Connections
int attach_kprobe__64_compat_sys_read(struct xdp_filter_bpf *skel){
skel->links.kprobe__64_compat_sys_read = bpf_program__attach(skel->progs.kprobe__64_compat_sys_read);
return libbpf_get_error(skel->links.kprobe__64_compat_sys_read);
}
int attach_kprobe__64_sys_read(struct xdp_filter_bpf *skel){
skel->links.kprobe__64_sys_read = bpf_program__attach(skel->progs.kprobe__64_sys_read);
return libbpf_get_error(skel->links.kprobe__64_sys_read);
}
int attach_fs_all(struct xdp_filter_bpf *skel){
return attach_kprobe__64_compat_sys_read(skel) |
attach_kprobe__64_sys_read(skel);
}
//Disconnections
int detach_kprobe__64_compat_sys_read(struct xdp_filter_bpf *skel){
int err = detach_link_generic(skel->links.kprobe__64_compat_sys_read);
if(err<0){
fprintf(stderr, "Failed to detach fs link\n");
return -1;
}
return 0;
}
int detach_kprobe__64_sys_read(struct xdp_filter_bpf *skel){
int err = detach_link_generic(skel->links.kprobe__64_sys_read);
if(err<0){
fprintf(stderr, "Failed to detach fs link\n");
return -1;
}
return 0;
}
int detach_fs_all(struct xdp_filter_bpf *skel){
return detach_kprobe__64_compat_sys_read(skel) ||
detach_kprobe__64_sys_read(skel);
}
#endif

View File

@@ -1,6 +1,7 @@
#include "module_manager.h"
#include "xdp.h"
#include "sched.h"
#include "fs.h"
module_config_t module_config = {
.xdp_module = {
@@ -10,7 +11,13 @@ module_config_t module_config = {
.sched_module = {
.all = ON,
.handle_sched_process_exec = OFF
},
.fs_module = {
.all = ON,
.kprobe__64_compat_sys_read = OFF,
.kprobe__64_sys_read = OFF
}
};
module_config_attr_t module_config_attr = {
@@ -45,6 +52,15 @@ int setup_all_modules(){
}
if(ret!=0) return -1;
//FS (File system)
if(config.fs_module.all == ON){
ret = attach_fs_all(attr.skel);
}else{
if(config.fs_module.kprobe__64_compat_sys_read == ON) ret = attach_kprobe__64_compat_sys_read(attr.skel);
if(config.fs_module.kprobe__64_sys_read == ON) ret = attach_kprobe__64_sys_read(attr.skel);
}
if(ret!=0) return -1;
return 0;
}

View File

@@ -23,6 +23,12 @@ typedef struct module_config_t{
char handle_sched_process_exec;
}sched_module;
struct fs_module {
char all;
char kprobe__64_compat_sys_read;
char kprobe__64_sys_read;
}fs_module;
} module_config_t;
//Configuration struct. Used by the module manager to
@@ -38,6 +44,10 @@ typedef struct module_config_attr_t{
void* __empty;
}sched_module;
struct fs_module_attr {
void* __empty;
}fs_module;
} module_config_attr_t;
//An unique module configutation struct and attr

View File

@@ -7,10 +7,6 @@
#include "common.h"
#include "xdp_filter.skel.h"
//TODO RESOLVE THE FACT THAT THESE ARE NOT COMPILED WITH REFERENCE TO XDP_FILTER_BPF
//COMPLETE CONFIG
//CHECK EVERYTHING STILL WORKS
//Connections
int attach_handle_sched_process_exec(struct xdp_filter_bpf *skel){
skel->links.handle_sched_process_exec = bpf_program__attach(skel->progs.handle_sched_process_exec);