如何在较新的 Linux 内核中挂钩 sys_clone

Question

I am trying to hook sys_clone , to bypass a method used by the tool unhide http://www.unhide-forensics.info/ . The idea is to translate PIDs from real to fake, and fake to real, making the tool to see the hidden PIDs and the not hidden as continuous identifiers. I mean, this tool forks continuously and checks if in all the loops there's some PID that is busy and it's not visible. The idea es to cheat this tool by giving continuous PIDs.

The problem, is that when a program executes my hook handler for sys_clone , after returning, wait(&status) gives a signal of SEGVFAULT.

I'm following the same method that I'm using to hook all other syscalls, including sys_fork , sys_vfork and the others syscalls.

sys_vfork and sys_fork uses the same function _do_fork() to create the new process: https://elixir.bootlin.com/linux/v4.15.1/source/kernel/fork.c#L2148

https://elixir.bootlin.com/linux/v4.15.1/source/kernel/fork.c#L2111

https://elixir.bootlin.com/linux/v4.15.1/source/kernel/fork.c#L2123

EDITED : I created a minimal working example, reproducing the bug, so you can test it better, and sorry because I didn't before:

#include <linux/module.h>
#include <linux/uaccess.h>

void **sys_call_table = NULL;
asmlinkage long (*sys_read)(long a1, long a2, long a3, long a4, long a5, long a6) = NULL;
asmlinkage long (*sys_clone)(long a1, long a2, long a3, long a4, long a5, long a6) = NULL;
asmlinkage long my_clone64(long a1, long a2, long a3, long a4, long a5, long a6);

char *sct_str;

module_param(sct_str, charp, 0);

inline void disable_wp(void) {
        asm("cli\n\tmov\t%cr0, %rax\n\tand\t$0xfffffffffffeffff, %rax\n\tmov\t%rax, %cr0\n\tsti");
}

inline void enable_wp(void) {
        asm("cli\n\tmov\t%cr0, %rax\n\tor\t$0x10000, %rax\n\tmov\t%rax, %cr0\n\tsti");
}

int init_module(void) {
        int ret = 0;
        mm_segment_t old_fs;

        kstrtoul(sct_str, 16, (unsigned long *) &sys_call_table);
        printk("%lx\n", sys_call_table);

        if (!sys_call_table) {
                return -1;
        }

        sys_read = sys_call_table[__NR_read];
        sys_clone = sys_call_table[__NR_clone];

        // hook sys_clone
        printk("be\n");
        disable_wp();
        sys_call_table[__NR_clone] = my_clone64;
        enable_wp();
        printk("af\n");

        // wait user's ENTER
        old_fs = get_fs();
        set_fs(KERNEL_DS);
        sys_read(0, (long)&ret, 1, 0, 0, 0);
        set_fs(old_fs);

        // restore sys_clone
        disable_wp();
        sys_call_table[__NR_clone] = sys_clone;
        enable_wp();

        return -1;
}

void cleanup_module(void) {
}


asmlinkage long my_clone64(long a1, long a2, long a3, long a4, long a5, long a6) {
        long ret = 0;
        printk("pid = %d\n", ret);
        ret = sys_clone(a1, a2, a3, a4, a5, a6);
        return ret;
}

MODULE_LICENSE("GPL");

Use this Makefile to compile:

obj-m += so.o

KERNEL_HEADERS = /lib/modules/$(shell uname -r)/build

all:
        make V=1 -C $(KERNEL_HEADERS) M=$(PWD) modules

clean:
        make V=1 -C $(KERNEL_HEADERS) M=$(PWD) clean

Compile with make and to load do:

diwou@diwou-VirtualBox:~/arpso$ sudo grep sys_call_table /proc/kallsyms
ffffffff9de00180 R sys_call_table
ffffffff9de01540 R ia32_sys_call_table
diwou@diwou-VirtualBox:~/arpso$ sudo insmod so.ko sct_str="ffffffff9de00180"
[NOW PRESS ENTER TO UNHOOK]
insmod: ERROR: could not insert module so.ko: Operation not permitted
diwou@diwou-VirtualBox:~/arpso$

The Operattion not permitted is due to the return code I use ( -1 ) to automatically unload the module.

Here is the output from the other session, when sys_clone is hooked. And I run /bin/ls :

diwou@diwou-VirtualBox:~$ ls
Violación de segmento (`core' generado)

After unhook sys_clone (by pressing ENTER) the command ls works again.

EDIT: If you replace my_clone64 by the following code, it happens the same. But if you change call by jmp it works:

asm(
".globl my_clone64\n\t"
".type my_clone64, @function\n"
"my_clone64:\n\t"
"call sys_clone(%rip)\n\t"
// do something with %rax
"ret\n\t"
".size my_clone64, .-my_clone64\n\t"
);

That points to some kind of implementation in the Linux Kernel... am I right?

EDIT: It's interesting that when I run strace -f bash in one ssh session, and read(0, waits for my input, then I load the LKM in another session, and I write ls in the bash being traced, and it works. I can see the output of the ls command. But if I open an ssh session, I load the LKM, and write ls on the bash without being traced, just a common ssh session, the output is segmentation fault:

clone(strace: Process 3233 attached
child_stack=0, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x7fa5f68be9d0) = 3233
[...]
[pid  3233] stat("arpso", {st_mode=S_IFDIR|0775, st_size=4096, ...}) = 0
[pid  3233] open("arpso", O_RDONLY|O_NONBLOCK|O_DIRECTORY|O_CLOEXEC) = 3
[pid  3233] fstat(3, {st_mode=S_IFDIR|0775, st_size=4096, ...}) = 0
[pid  3233] getdents(3, /* 15 entries */, 32768) = 480
[pid  3233] lstat("arpso/so.c", {st_mode=S_IFREG|0664, st_size=1575, ...}) = 0
[pid  3233] lstat("arpso/so.ko", {st_mode=S_IFREG|0664, st_size=5760, ...}) = 0
[pid  3233] lstat("arpso/modules.order", {st_mode=S_IFREG|0664, st_size=31, ...}) = 0
[pid  3233] lstat("arpso/Module.symvers", {st_mode=S_IFREG|0664, st_size=0, ...}) = 0
[pid  3233] lstat("arpso/so.o", {st_mode=S_IFREG|0664, st_size=5440, ...}) = 0
[pid  3233] lstat("arpso/so.mod.o", {st_mode=S_IFREG|0664, st_size=2528, ...}) = 0
[pid  3233] lstat("arpso/so.mod.c", {st_mode=S_IFREG|0664, st_size=542, ...}) = 0
[pid  3233] lstat("arpso/Makefile", {st_mode=S_IFREG|0664, st_size=177, ...}) = 0
[pid  3233] getdents(3, /* 0 entries */, 32768) = 0
[pid  3233] close(3)                    = 0
[...]
+++ exited with 0 +++
diwou@diwou-VirtualBox:~$ ls
Violación de segmento (`core' generado)
diwou@diwou-VirtualBox:~$

Any help would be appreciated.

Thanks.

Answer 1

I found the answer.

Just the problem of common hooking (aka replace syscall handlers in syscall table) is that actually (in the kernel 4.15.1 at least), there's defined an extra symbol called ptregs_sys_clone , which makes some tricks to finally call/jmp to sys_clone . And nesting calls is not an option, since the retaddr is checked to go from one path or another... so the solution I found, is to replace the reference to sys_clone in ptregs_sys_clone .

The code as follows.

core.c

#include <linux/uaccess.h>

void **sys_call_table = NULL;
asmlinkage long (*sys_read)(long a1, long a2, long a3, long a4, long a5, long a6) = NULL;
asmlinkage long (*ptregs_sys_clone)(struct pt_regs *regs) = NULL;
asmlinkage long (*sys_clone)(long a1, long a2, long a3, long a4, long a5, long a6) = NULL;
asmlinkage long my_clone64(long a1, long a2, long a3, long a4, long a5, long a6);

extern char *sct_str;

void disable_wp(void) {
        asm("cli\n\tmov\t%cr0, %rax\n\tand\t$0xfffffffffffeffff, %rax\n\tmov\t%rax, %cr0\n\tsti");
}

void enable_wp(void) {
        asm("cli\n\tmov\t%cr0, %rax\n\tor\t$0x10000, %rax\n\tmov\t%rax, %cr0\n\tsti");
}

int patch_ptregs_syscall(void *addr, long newaddr, long *oldaddr) {
        int i = 0, ret = 0, *p = NULL;
        long vaddr = 0; // variable address

        p = addr + 3; // point to offset in: lea offset(%rip), %register
        //printk("value before patch = %lx\n", *p);
        vaddr = (long)*p + addr + 7; // offset + %rip + lea' size
        if (oldaddr) {
                *oldaddr = vaddr;
        }
        printk("address %lx, ofsset %lx\n", vaddr, *p);
        vaddr = newaddr - (long)addr - 7;
        printk("new address %lx, new offset %lx\n", newaddr, vaddr);
        disable_wp();
        ret = probe_kernel_write(p, &vaddr, sizeof(int));
        enable_wp();
        if (ret != 0) {
                return -2;
        }

        return 0;
}

int install_hooks(void) {
        int ret = 0;
        mm_segment_t old_fs;

        if (!sct_str) {
                return -2;
        }

        kstrtoul(sct_str, 16, (unsigned long *) &sys_call_table);
        printk("sct: %lx\n", sys_call_table);

        if (!sys_call_table) {
                return -2;
        }

        sys_read = sys_call_table[__NR_read];
        ptregs_sys_clone = sys_call_table[__NR_clone];

        // hook sys_clone
        patch_ptregs_syscall(ptregs_sys_clone, (long)my_clone64, (long *)&sys_clone);

        // wait user's ENTER
        old_fs = get_fs();
        set_fs(KERNEL_DS);
        sys_read(0, (long)&ret, 1, 0, 0, 0);
        set_fs(old_fs);

        // restore sys_clone
        patch_ptregs_syscall(ptregs_sys_clone, (long)sys_clone, NULL);

        return -1;
}

asmlinkage long my_clone64(long a1, long a2, long a3, long a4, long a5, long a6) {
        pid_t pid = 0;

        pid = sys_clone(a1, a2, a3, a4, a5, a6);
        printk("pid %d\n", pid);
        return pid;
}

main.c:

#include <linux/module.h>

extern int install_hooks(void);

char *sct_str;

module_param(sct_str, charp, 0);

int init_module(void) {
        return install_hooks();
}

void cleanup_module(void) {
}

MODULE_LICENSE("GPL");

Makefile

obj-m += so.o

so-objs := main.o core-asm.o

EXTRA_CFLAGS := -O0

KERNEL_HEADERS = /lib/modules/$(shell uname -r)/build

all:
        make V=1 -C $(KERNEL_HEADERS) M=$(PWD) core.s
        gcc -c core.s -o core-asm.o
        make V=1 -C $(KERNEL_HEADERS) M=$(PWD) modules

clean:
        make V=1 -C $(KERNEL_HEADERS) M=$(PWD) clean

Good luck, and thanks for all your comments & help.