20
20
#include <linux/sched.h>
21
21
#include <linux/uaccess.h>
22
22
#include <linux/slab.h>
23
- /** This is what we're using here. */
24
23
#include <linux/ftrace.h>
25
24
26
25
MODULE_LICENSE ("GPL" );
27
26
28
27
#define MAX_FILENAME_SIZE 200
29
28
29
+ #undef pr_fmt
30
+ #define pr_fmt (fmt ) "[syscall-ftrace] " fmt
31
+
30
32
/* UID we want to spy on - will be filled from the command line. */
31
33
static int uid = 0 ;
32
34
module_param (uid , int , 0644 );
@@ -48,14 +50,12 @@ typedef struct ftrace_hook {
48
50
struct ftrace_ops ops ; // ftrace structure
49
51
} ftrace_hook_t ;
50
52
51
- // clang-format off
52
- #define PREPARE_HOOK (_nr , _hook , _orig ) \
53
- { \
54
- .nr = (_nr), .new = (_hook), .orig = (_orig) \
53
+ #define PREPARE_HOOK (_nr , _hook , _orig ) \
54
+ { \
55
+ .nr = (_nr), .new = (_hook), .orig = (_orig) \
55
56
}
56
57
57
- unsigned long * * sys_call_table ;
58
- // clang-format on
58
+ static unsigned long * * sys_call_table ;
59
59
60
60
/**
61
61
* For the sake of simplicity, only the kprobe method is included.
@@ -71,19 +71,19 @@ static int resolve_address(ftrace_hook_t *hook)
71
71
unregister_kprobe (& kp );
72
72
73
73
if (kallsyms_lookup_name )
74
- pr_info ("[syscall-ftrace] kallsyms_lookup_name is found at 0x%lx\n" ,
74
+ pr_info ("kallsyms_lookup_name is found at 0x%lx\n" ,
75
75
(unsigned long )kallsyms_lookup_name );
76
76
else {
77
- pr_err ("[syscall-ftrace] kallsyms_lookup_name is not found!\n" );
77
+ pr_err ("kallsyms_lookup_name is not found!\n" );
78
78
return -1 ;
79
79
}
80
80
81
81
sys_call_table = (unsigned long * * )kallsyms_lookup_name ("sys_call_table" );
82
82
if (sys_call_table )
83
- pr_info ("[syscall-ftrace] sys_call_table is found at 0x%lx\n" ,
83
+ pr_info ("sys_call_table is found at 0x%lx\n" ,
84
84
(unsigned long )sys_call_table );
85
85
else {
86
- pr_err ("[syscall-ftrace] sys_call_table is not found!\n" );
86
+ pr_err ("sys_call_table is not found!\n" );
87
87
return -1 ;
88
88
}
89
89
@@ -127,7 +127,7 @@ static void notrace ftrace_thunk(unsigned long ip, unsigned long parent_ip,
127
127
128
128
#endif /** Version >= v5.11 */
129
129
130
- int install_hook (ftrace_hook_t * hook )
130
+ static int install_hook (ftrace_hook_t * hook )
131
131
{
132
132
int err ;
133
133
err = resolve_address (hook );
@@ -141,38 +141,38 @@ int install_hook(ftrace_hook_t *hook)
141
141
/** Only sys_openat should be traced */
142
142
err = ftrace_set_filter_ip (& hook -> ops , hook -> address , 0 , 0 );
143
143
if (err ) {
144
- pr_err ("[syscall-ftrace] ftrace_set_filter_ip() failed: %d\n" , err );
144
+ pr_err ("ftrace_set_filter_ip() failed: %d\n" , err );
145
145
return err ;
146
146
}
147
147
148
148
err = register_ftrace_function (& hook -> ops );
149
149
if (err ) {
150
- pr_err ("[syscall-ftrace] register_ftrace_function() failed: %d\n" , err );
150
+ pr_err ("register_ftrace_function() failed: %d\n" , err );
151
151
return err ;
152
152
}
153
153
154
154
return 0 ;
155
155
}
156
156
157
- void remove_hook (ftrace_hook_t * hook )
157
+ static void remove_hook (ftrace_hook_t * hook )
158
158
{
159
159
int err ;
160
160
err = unregister_ftrace_function (& hook -> ops );
161
161
if (err )
162
- pr_err ("[syscall-ftrace] unregister_ftrace_function() failed: %d\n" ,
163
- err );
162
+ pr_err ("unregister_ftrace_function() failed: %d\n" , err );
164
163
165
164
/** Disable the trace by setting remove to 1 */
166
165
err = ftrace_set_filter_ip (& hook -> ops , hook -> address , 1 , 0 );
167
166
if (err )
168
- pr_err ("[syscall-ftrace] ftrace_set_filter_ip() failed: %d\n" , err );
167
+ pr_err ("ftrace_set_filter_ip() failed: %d\n" , err );
169
168
}
170
169
171
170
/** For some reason the kernel segfaults when the parameters are expanded. */
172
171
static asmlinkage long (* original_call )(struct pt_regs * regs );
173
172
static asmlinkage long our_sys_openat (struct pt_regs * regs )
174
173
{
175
174
char * kfilename ;
175
+ int errcode = 0 ;
176
176
if (current -> cred -> uid .val != uid )
177
177
return original_call (regs );
178
178
kfilename = kmalloc (GFP_KERNEL , MAX_FILENAME_SIZE * sizeof (char ));
@@ -186,14 +186,14 @@ static asmlinkage long our_sys_openat(struct pt_regs *regs)
186
186
* Change regs->si to appropriate registers
187
187
* if you are trying on different architecture.
188
188
*/
189
- // clang-format off
190
- if (copy_from_user (kfilename , (char __user * )regs -> si , MAX_FILENAME_SIZE ) < 0 ) {
189
+ errcode =
190
+ copy_from_user (kfilename , (char __user * )regs -> si , MAX_FILENAME_SIZE );
191
+ if (errcode < 0 ) {
191
192
kfree (kfilename );
192
193
return original_call (regs );
193
194
}
194
- // clang-format on
195
195
196
- pr_info ("[syscall-ftrace] File opened by UID %d: %s\n" , uid , kfilename );
196
+ pr_info ("File opened by UID %d: %s\n" , uid , kfilename );
197
197
kfree (kfilename );
198
198
199
199
return original_call (regs );
@@ -208,14 +208,14 @@ static int __init syscall_ftrace_start(void)
208
208
err = install_hook (& sys_openat_hook );
209
209
if (err )
210
210
return err ;
211
- pr_info ("[syscall-ftrace] hooked, spying on uid %d\n" , uid );
211
+ pr_info ("hooked, spying on uid %d\n" , uid );
212
212
return 0 ;
213
213
}
214
214
215
215
static void __exit syscall_ftrace_end (void )
216
216
{
217
217
remove_hook (& sys_openat_hook );
218
- pr_info ("[syscall-ftrace] removed\n" );
218
+ pr_info ("removed\n" );
219
219
}
220
220
221
221
module_init (syscall_ftrace_start );
0 commit comments