For some security purpose, I use ptrace to get the syscall number, and if it’s a dangerous call (like 10 for unlink), I want to cancel this syscall.
Here’s the source code for the test program del.c. Compile with gcc -o del del.c.
#include <stdio.h>
#include <stdlib.h>
int main()
{
remove("/root/abc.out");
return 0;
}
Here’s the security manager source code test.c. Compile with gcc -o test test.c.
#include <signal.h>
#include <syscall.h>
#include <sys/ptrace.h>
#include <sys/types.h>
#include <sys/wait.h>
#include <unistd.h>
#include <errno.h>
#include <sys/user.h>
#include <sys/reg.h>
#include <sys/syscall.h>
int main()
{
int i;
pid_t child;
int status;
long orig_eax;
child = fork();
if(child == 0) {
ptrace(PTRACE_TRACEME, 0, NULL, NULL);
execl("/root/del", "del", NULL);
}
else {
i = 0;
while(1){
wait(&status);
if (WIFEXITED(status) || WIFSIGNALED(status) )break;
orig_eax = ptrace(PTRACE_PEEKUSER,
child, 4 * ORIG_EAX,
NULL);
if (orig_eax == 10){
fprintf(stderr, "Got it\n");
kill(child, SIGKILL);
}
printf("%d time,"
"system call %ld\n", i++, orig_eax);
ptrace(PTRACE_SYSCALL, child, NULL, NULL);
}
}
return 0;
}
Create the abc.out file, then run the test program:
cd /root
touch abc.out
./test
The file /root/abc.out should still exist.
How do I implement this requirement?
Well it seems that sometimes
PTRACE_KILLdoes not work very well, you can usekillinstead:EDIT : I test on my machine (Ubuntu kernel 3.4) with this program and all is ok:
UPDATE : The problem is that you are using
10for tracking system call instead of11(because you are executingexecvecommand), this code will work with yourrmcommand:EDIT : I try this code and all wroks fine (the file
abc.outstill exist after the execution ofCALL_REMOVE)We got this output: