0. 引言1. Linux Security Module Framework Introduction2. LSM Sourcecode Analysis3. LSMs Hook Engine：基于LSM Hook进行元数据的监控获取4. LSM编程示例

1. Kprobe: Linux提供的原生的调试机制(Debug)，允许向任意的内核函数注册Hook回调通知点，当执行到Hooked函数的时候，会触发我们注册的kprobe_handle2. LSM(Linux Security Modules): Linux提供的原生的Hook框架，本质上来说，LSM是直接串行的插入到了Linux Kernel的代码路径中，是Linux本身对外提供了一套审计机制(Hook框架)

1. SELinux2. Smack3. Tomoyo4. AppArmor5. other extensions can be built using the LSM to provide specific changes to system operation //Linux LSM是Linux下的一个框架标准，并不是一个特定的技术，类似于WINDOWS中的NDIS(Network Driver Interface Specification)概念，而SELINUX是在遵循针这一框架的基础上实现的具体Hook技术，SELINUX和LSM的关系是具体实现和框架标准的关系

1. Linux Capabilities Model 2. Security-Enhanced Linux (SELinux) Model3. Domain and Type Enforcement (DTE) Model

1. it adds opaque security fields to certain kernel data structures    1) task_struct: Task(Process)    2) linux_binprm: Program        3) super_block: Filesystem    4) inode: Pipe、File,、or Socket    5) file: Open File    6) sk_buff: Network Buffer(Packet)    7) net_device: Network Device    8) kern_ipc_perm: Semaphore、Shared Memory Segment、Message Queue    9) msg_msg: Individual Message/*The setting of these security fields and the management of the associated security data is handled by the security modules. LSM merely provides the fields and a set of calls to security hooks that can be implemented by the module to manage the security fields as desiredLSM以串行地方式插入到Linux Kernel中，在进行串行Hook的同时，同时自身也需要维护一套数据结构来保存自身的Hook信息，这也是Hook Engine的通用思路*/2. the patch inserts calls to security hook functions at various points within the kernel code LSM在Linux Kernel中插入了两种"security hooks function call"    1) LSM安全策略判断    2) lSM自身数据结构维护这些hook function 指针都保存在一个全局结构体: "security-ops"中(struct security_operations)3. the patch adds a generic security system callLSM provides a general security system call that allows security modules to implement new calls for security-aware applications4. the patch provides functions to allow kernel modules to register and unregister themselves as security modulesWhen a security module is loaded, it must register itself with the LSM framework by calling the "register-security"function. This function sets the global "security_ops table" to refer to the module’s hook function pointers(即初始状态下，"security-ops"是指向NULL的指针), causing the kernel to call into the security module for access control decisions. The "register-security" function will not overwrite a previously loaded module.Once a security module is loaded, it becomes a policy decision whether it will allow itself to be unloaded.5. the patch moves most of the capabilities logic into an optional security module,The Linux kernel currently provides support for a subset of POSIX.1e capabilities.

1. Task HooksLSM provides a set of task hooks that enable security modules to manage process security information and to control process operations2. Program Loading HooksLSM provides a set of programloading hooks that are called at critical points during the processing of an execve operation.
"linux_binprm"3. IPC HooksSecurity modules can manage security information and perform access control for System V IPC using the LSM IPC hooks.LSM inserts a hook into the existing ipcperms function so that a security module can perform a check for each existing Linux IPC permission check 4. Filesystem HooksFor file operations, three sets of hooks were defined:    1) filesystem hooks    2) inode hooks    3) file hooks5. Network HooksApplication layer access to networking is mediated using a set of socket hooks. These hooks, which include interposition of all socket system calls, provide coarse mediation coverage of all socket-based protocols.Since active user sockets have an associated inode structure, a separate security field was not added to the socket structure or to the lower-level sock structure.As the socket hooks allow general mediation of network traffic in relation to processes, LSM significantly expands the kernel’s network access control framework (which is already handled at the network layer by Netfilter)(LSM对网络的访问控制和Netfilter保持兼容). For example, the sock rcv skb hook allows an inbound packet to be mediated in terms of its destination application, prior to being queued at the associated userspace socket.6. Other HooksLSM provides two additional sets of hooks:     1) module hooks    Module hooks can be used to control the kernel operations that create, initialize, and delete kernel modules.    2) a set of top-level system hooks    System hooks can be used to control system operations, such as setting the system hostname, accessing I/O ports, and configuring process accounting. 

1. SELinuxhttp://en.wikipedia.org/wiki/Security-Enhanced_Linuxhttp://selinuxproject.org/page/NB_LSMA Linux implementation of the Flask flexible access control architecture and an example security server that supports Type Enforcement, Role-Based Access Control, and optionally MultiLevel Security.SELinux was originally implemented as a kernel patch  and was then reimplemented as a security module that uses LSM.SELinux can be used to confine processes to least privilege, to protect the integrity and confidentiality of processes and data, and to support application security needs.  2. DTE Linux An implementation of Domain and Type Enforcement developed for Linux Like SELinux, DTE Linux was originally implemented as a kernel patch and was then adapted to LSM. With this module loaded, types can be assigned to objects and domains to processes. The DTE policy restricts access between domains and from domains to types. The DTE Linux project also provided useful input into the design and implementation of LSM.3. LSM port of Openwall kernel patch4. POSIX.1e capabilities

http://lxr.free-electrons.com/source/Documentation/security/LSM.txthttps://www.usenix.org/legacy/event/sec02/wright.htmlhttp://en.wikipedia.org/wiki/Linux_Security_Moduleshttps://www.usenix.org/legacy/event/sec02/wright.htmlhttps://www.usenix.org/legacy/event/sec02/full_papers/wright/wright.pdfhttps://www.kernel.org/doc/ols/2002/ols2002-pages-604-617.pdfhttp://se7so.blogspot.com/2012/04/linux-security-modules-framework-lsm.htmlhttp://www.kroah.com/linux/talks/ols_2002_lsm_paper/lsm.pdf

...static struct security_operations *security_ops;static struct security_operations default_security_ops = {    .name   = "default",};.../*** security_init - initializes the security framework** This should be called early in the kernel initialization sequence.*/int __init security_init(void){    printk(KERN_INFO "Security Framework initialized\n");    security_fixup_ops(&default_security_ops);    security_ops = &default_security_ops;    do_security_initcalls();    return 0;}..static void __init do_security_initcalls(void){    initcall_t *call;    call = __security_initcall_start;    while (call < __security_initcall_end)     {        (*call) ();        call++;    }}

struct security_operations {    //A string that acts as a unique identifier for the LSM    char name[SECURITY_NAME_MAX + 1];    int (*ptrace_access_check) (struct task_struct *child, unsigned int mode);    int (*ptrace_traceme) (struct task_struct *parent);    int (*capget) (struct task_struct *target, kernel_cap_t *effective, kernel_cap_t *inheritable, kernel_cap_t *permitted);    int (*capset) (struct cred *new, const struct cred *old, const kernel_cap_t *effective, const kernel_cap_t *inheritable, const kernel_cap_t *permitted);    int (*capable) (const struct cred *cred, struct user_namespace *ns, int cap, int audit);    int (*quotactl) (int cmds, int type, int id, struct super_block *sb);    int (*quota_on) (struct dentry *dentry);    int (*syslog) (int type);    int (*settime) (const struct timespec *ts, const struct timezone *tz);    int (*vm_enough_memory) (struct mm_struct *mm, long pages);    /*    1. Security hooks for program execution operations    程序装载钩子，LSM(Linux Security Modules)提供了一系列程序装载钩子，用在一个execve()操作执行过程的关键点上        1) "linux_binprm"结构中的安全域允许安全模块维护程序装载过程中的安全信息        2) LSM提供了钩子用于允许安全模块在装载程序前初始化安全信息和执行访问控制        3) LSM提供了钩子允许模块在新程序成功装载后更新任务的安全信息        4) LSM提供了钩子用来控制程序执行过程中的状态继承，例如确认打开的文件描述符(不是可信启动)    */    //Save security information in the bprm->security field, typically based on information about the bprm->file, for later use by the apply_creds hook    int (*bprm_set_creds) (struct linux_binprm *bprm);    //This hook mediates the point when a search for a binary handler will begin. This hook may be called multiple times during a single execve; and in each pass set_creds is called first.    int (*bprm_check_security) (struct linux_binprm *bprm);    int (*bprm_secureexec) (struct linux_binprm *bprm);    //Prepare to install the new security attributes of a process being transformed by an execve operation, based on the old credentials pointed to by @current->cred and the information set in @bprm->cred by the bprm_set_creds hook    void (*bprm_committing_creds) (struct linux_binprm *bprm);    //Tidy up after the installation of the new security attributes of a process being transformed by an execve operation.    void (*bprm_committed_creds) (struct linux_binprm *bprm);    /*    2. Security hooks for filesystem operations.    */    //Allocate and attach a security structure to the sb->s_security field.    int (*sb_alloc_security) (struct super_block *sb);    //Deallocate and clear the sb->s_security field.    void (*sb_free_security) (struct super_block *sb);    //Allow mount option data to be copied prior to parsing by the filesystem, so that the security module can extract security-specific mount options cleanly (a filesystem may modify the data e.g. with strsep()).    int (*sb_copy_data) (char *orig, char *copy);    //Extracts security system specific mount options and verifies no changes are being made to those options.    int (*sb_remount) (struct super_block *sb, void *data);    int (*sb_kern_mount) (struct super_block *sb, int flags, void *data);    int (*sb_show_options) (struct seq_file *m, struct super_block *sb);    //Check permission before obtaining filesystem statistics for the @mnt mountpoint.    int (*sb_statfs) (struct dentry *dentry);    //Check permission before an object specified by @dev_name is mounted on the mount point named by @nd.    int (*sb_mount) (const char *dev_name, struct path *path, const char *type, unsigned long flags, void *data);    //Check permission before the @mnt file system is unmounted.    int (*sb_umount) (struct vfsmount *mnt, int flags);    //Check permission before pivoting the root filesystem.    int (*sb_pivotroot) (struct path *old_path, struct path *new_path);    //Set the security relevant mount options used for a superblock    int (*sb_set_mnt_opts) (struct super_block *sb, struct security_mnt_opts *opts, unsigned long kern_flags, unsigned long *set_kern_flags);    //Copy all security options from a given superblock to another    int (*sb_clone_mnt_opts) (const struct super_block *oldsb, struct super_block *newsb);    //Parse a string of security data filling in the opts structure    int (*sb_parse_opts_str) (char *options, struct security_mnt_opts *opts);    //Compute a context for a dentry as the inode is not yet available since NFSv4 has no label backed by an EA anyway.    int (*dentry_init_security) (struct dentry *dentry, int mode, struct qstr *name, void **ctx, u32 *ctxlen);#ifdef CONFIG_SECURITY_PATH    int (*path_unlink) (struct path *dir, struct dentry *dentry);    int (*path_mkdir) (struct path *dir, struct dentry *dentry, umode_t mode);    int (*path_rmdir) (struct path *dir, struct dentry *dentry);    int (*path_mknod) (struct path *dir, struct dentry *dentry, umode_t mode,               unsigned int dev);    int (*path_truncate) (struct path *path);    int (*path_symlink) (struct path *dir, struct dentry *dentry,                 const char *old_name);    int (*path_link) (struct dentry *old_dentry, struct path *new_dir,              struct dentry *new_dentry);    int (*path_rename) (struct path *old_dir, struct dentry *old_dentry,                struct path *new_dir, struct dentry *new_dentry);    int (*path_chmod) (struct path *path, umode_t mode);    int (*path_chown) (struct path *path, kuid_t uid, kgid_t gid);    int (*path_chroot) (struct path *path);#endif    /*    3. Security hooks for inode operations.    */    //Allocate and attach a security structure to @inode->i_security.    int (*inode_alloc_security) (struct inode *inode);    void (*inode_free_security) (struct inode *inode);    //Obtain the security attribute name suffix and value to set on a newly created inode and set up the incore security field for the new inode.    int (*inode_init_security) (struct inode *inode, struct inode *dir, const struct qstr *qstr, const char **name, void **value, size_t *len);    int (*inode_create) (struct inode *dir, struct dentry *dentry, umode_t mode);    int (*inode_link) (struct dentry *old_dentry, struct inode *dir, struct dentry *new_dentry);    int (*inode_unlink) (struct inode *dir, struct dentry *dentry);    int (*inode_symlink) (struct inode *dir, struct dentry *dentry, const char *old_name);    int (*inode_mkdir) (struct inode *dir, struct dentry *dentry, umode_t mode);    int (*inode_rmdir) (struct inode *dir, struct dentry *dentry);    int (*inode_mknod) (struct inode *dir, struct dentry *dentry, umode_t mode, dev_t dev);    int (*inode_rename) (struct inode *old_dir, struct dentry *old_dentry, struct inode *new_dir, struct dentry *new_dentry);    int (*inode_readlink) (struct dentry *dentry);    int (*inode_follow_link) (struct dentry *dentry, struct nameidata *nd);    int (*inode_permission) (struct inode *inode, int mask);    int (*inode_setattr)    (struct dentry *dentry, struct iattr *attr);    int (*inode_getattr) (struct vfsmount *mnt, struct dentry *dentry);    int (*inode_setxattr) (struct dentry *dentry, const char *name, const void *value, size_t size, int flags);    void (*inode_post_setxattr) (struct dentry *dentry, const char *name, const void *value, size_t size, int flags);    int (*inode_getxattr) (struct dentry *dentry, const char *name);    int (*inode_listxattr) (struct dentry *dentry);    int (*inode_removexattr) (struct dentry *dentry, const char *name);    int (*inode_need_killpriv) (struct dentry *dentry);    int (*inode_killpriv) (struct dentry *dentry);    int (*inode_getsecurity) (const struct inode *inode, const char *name, void **buffer, bool alloc);    int (*inode_setsecurity) (struct inode *inode, const char *name, const void *value, size_t size, int flags);    int (*inode_listsecurity) (struct inode *inode, char *buffer, size_t buffer_size);    void (*inode_getsecid) (const struct inode *inode, u32 *secid);    /*    4. Security hooks for file operations    */    //Check file permissions before accessing an open file.  This hook is called by various operations that read or write files.    int (*file_permission) (struct file *file, int mask);    //Allocate and attach a security structure to the file->f_security field    int (*file_alloc_security) (struct file *file);    //Deallocate and free any security structures stored in file->f_security.    void (*file_free_security) (struct file *file);    //Check permission for an ioctl operation on @file    int (*file_ioctl) (struct file *file, unsigned int cmd, unsigned long arg);    //Check permissions for a mmap operation at @addr.    int (*mmap_addr) (unsigned long addr);    //Check permissions for a mmap operation.    int (*mmap_file) (struct file *file, unsigned long reqprot, unsigned long prot, unsigned long flags);    //Check permissions before changing memory access permissions.    int (*file_mprotect) (struct vm_area_struct *vma, unsigned long reqprot, unsigned long prot);    //Check permission before performing file locking operations.    int (*file_lock) (struct file *file, unsigned int cmd);    //Check permission before allowing the file operation specified by @cmd from being performed on the file @file.     int (*file_fcntl) (struct file *file, unsigned int cmd, unsigned long arg);    int (*file_set_fowner) (struct file *file);    int (*file_send_sigiotask) (struct task_struct *tsk, struct fown_struct *fown, int sig);    int (*file_receive) (struct file *file);    //Save open-time permission checking state for later use upon file_permission, and recheck access if anything has changed since inode_permission    int (*file_open) (struct file *file, const struct cred *cred);    /*    5. Security hooks for task operations.    LSM(Linux Security Modules)提供了一系列的任务钩子使得安全模块可以管理进程的安全信息并且控制进程的操作        1) LSM可以使用"task_struct"结构中的安全域来维护进程安全信息        2) 任务钩子提供了控制进程间通信的钩子，例如kill()        3) LSM提供了控制对当前进程进行特权操作的钩子，例如setuid()        4) LSM提供了对资源管理操作进行细粒度控制的钩子，例如setrlimit()和nice()    */    //Check permission before creating a child process    int (*task_create) (unsigned long clone_flags);    //@task task being freed Handle release of task-related resources. (Note that this can be called from interrupt context.)    void (*task_free) (struct task_struct *task);    //Only allocate sufficient memory and attach to @cred such that cred_transfer() will not get ENOMEM.    int (*cred_alloc_blank) (struct cred *cred, gfp_t gfp);    //eallocate and clear the cred->security field in a set of credentials.    void (*cred_free) (struct cred *cred);    //Prepare a new set of credentials by copying the data from the old set.    int (*cred_prepare)(struct cred *new, const struct cred *old, gfp_t gfp);    //Transfer data from original creds to new creds    void (*cred_transfer)(struct cred *new, const struct cred *old);    //Set the credentials for a kernel service to act as (subjective context).    int (*kernel_act_as)(struct cred *new, u32 secid);    int (*kernel_create_files_as)(struct cred *new, struct inode *inode);    int (*kernel_module_request)(char *kmod_name);    int (*kernel_module_from_file)(struct file *file);    //Update the module‘s state after setting one or more of the user identity attributes of the current process.    int (*task_fix_setuid) (struct cred *new, const struct cred *old, int flags);    int (*task_setpgid) (struct task_struct *p, pid_t pgid);    int (*task_getpgid) (struct task_struct *p);    int (*task_getsid) (struct task_struct *p);    void (*task_getsecid) (struct task_struct *p, u32 *secid);    int (*task_setnice) (struct task_struct *p, int nice);    int (*task_setioprio) (struct task_struct *p, int ioprio);    int (*task_getioprio) (struct task_struct *p);    int (*task_setrlimit) (struct task_struct *p, unsigned int resource, struct rlimit *new_rlim);    int (*task_setscheduler) (struct task_struct *p);    int (*task_getscheduler) (struct task_struct *p);    int (*task_movememory) (struct task_struct *p);    int (*task_kill) (struct task_struct *p, struct siginfo *info, int sig, u32 secid);    int (*task_wait) (struct task_struct *p);    //Check permission before performing a process control operation on the current process.    int (*task_prctl) (int option, unsigned long arg2, unsigned long arg3, unsigned long arg4, unsigned long arg5);    void (*task_to_inode) (struct task_struct *p, struct inode *inode);    int (*ipc_permission) (struct kern_ipc_perm *ipcp, short flag);    void (*ipc_getsecid) (struct kern_ipc_perm *ipcp, u32 *secid);    int (*msg_msg_alloc_security) (struct msg_msg *msg);    void (*msg_msg_free_security) (struct msg_msg *msg);    int (*msg_queue_alloc_security) (struct msg_queue *msq);    void (*msg_queue_free_security) (struct msg_queue *msq);    int (*msg_queue_associate) (struct msg_queue *msq, int msqflg);    int (*msg_queue_msgctl) (struct msg_queue *msq, int cmd);    int (*msg_queue_msgsnd) (struct msg_queue *msq,                 struct msg_msg *msg, int msqflg);    int (*msg_queue_msgrcv) (struct msg_queue *msq,                 struct msg_msg *msg,                 struct task_struct *target,                 long type, int mode);    int (*shm_alloc_security) (struct shmid_kernel *shp);    void (*shm_free_security) (struct shmid_kernel *shp);    int (*shm_associate) (struct shmid_kernel *shp, int shmflg);    int (*shm_shmctl) (struct shmid_kernel *shp, int cmd);    int (*shm_shmat) (struct shmid_kernel *shp,              char __user *shmaddr, int shmflg);    int (*sem_alloc_security) (struct sem_array *sma);    void (*sem_free_security) (struct sem_array *sma);    int (*sem_associate) (struct sem_array *sma, int semflg);    int (*sem_semctl) (struct sem_array *sma, int cmd);    int (*sem_semop) (struct sem_array *sma,              struct sembuf *sops, unsigned nsops, int alter);     /*    6. Security hooks for Netlink messaging.    */    //Save security information for a netlink message so that permission checking can be performed when the message is processed.    int (*netlink_send) (struct sock *sk, struct sk_buff *skb);    void (*d_instantiate) (struct dentry *dentry, struct inode *inode);    int (*getprocattr) (struct task_struct *p, char *name, char **value);    int (*setprocattr) (struct task_struct *p, char *name, void *value, size_t size);    int (*ismaclabel) (const char *name);    int (*secid_to_secctx) (u32 secid, char **secdata, u32 *seclen);    int (*secctx_to_secid) (const char *secdata, u32 seclen, u32 *secid);    void (*release_secctx) (char *secdata, u32 seclen);    int (*inode_notifysecctx)(struct inode *inode, void *ctx, u32 ctxlen);    int (*inode_setsecctx)(struct dentry *dentry, void *ctx, u32 ctxlen);    int (*inode_getsecctx)(struct inode *inode, void **ctx, u32 *ctxlen);#ifdef CONFIG_SECURITY_NETWORK    /*    7. Security hooks for Unix domain networking.    */    //Check permissions before establishing a Unix domain stream connection between @sock and @other.    int (*unix_stream_connect) (struct sock *sock, struct sock *other, struct sock *newsk);    //Check permissions before connecting or sending datagrams from @sock to @other.    int (*unix_may_send) (struct socket *sock, struct socket *other);    int (*socket_create) (int family, int type, int protocol, int kern);    int (*socket_post_create) (struct socket *sock, int family, int type, int protocol, int kern);    int (*socket_bind) (struct socket *sock, struct sockaddr *address, int addrlen);    //Check permission before socket protocol layer connect operation attempts to connect socket @sock to a remote address,    int (*socket_connect) (struct socket *sock, struct sockaddr *address, int addrlen);    int (*socket_listen) (struct socket *sock, int backlog);    int (*socket_accept) (struct socket *sock, struct socket *newsock);    int (*socket_sendmsg) (struct socket *sock, struct msghdr *msg, int size);    int (*socket_recvmsg) (struct socket *sock, struct msghdr *msg, int size, int flags);    int (*socket_getsockname) (struct socket *sock);    int (*socket_getpeername) (struct socket *sock);    int (*socket_getsockopt) (struct socket *sock, int level, int optname);    int (*socket_setsockopt) (struct socket *sock, int level, int optname);    int (*socket_shutdown) (struct socket *sock, int how);    int (*socket_sock_rcv_skb) (struct sock *sk, struct sk_buff *skb);    int (*socket_getpeersec_stream) (struct socket *sock, char __user *optval, int __user *optlen, unsigned len);    int (*socket_getpeersec_dgram) (struct socket *sock, struct sk_buff *skb, u32 *secid);    int (*sk_alloc_security) (struct sock *sk, int family, gfp_t priority);    void (*sk_free_security) (struct sock *sk);    void (*sk_clone_security) (const struct sock *sk, struct sock *newsk);    void (*sk_getsecid) (struct sock *sk, u32 *secid);    void (*sock_graft) (struct sock *sk, struct socket *parent);    int (*inet_conn_request) (struct sock *sk, struct sk_buff *skb, struct request_sock *req);    void (*inet_csk_clone) (struct sock *newsk, const struct request_sock *req);    void (*inet_conn_established) (struct sock *sk, struct sk_buff *skb);    int (*secmark_relabel_packet) (u32 secid);    void (*secmark_refcount_inc) (void);    void (*secmark_refcount_dec) (void);    void (*req_classify_flow) (const struct request_sock *req, struct flowi *fl);    int (*tun_dev_alloc_security) (void **security);    void (*tun_dev_free_security) (void *security);    int (*tun_dev_create) (void);    int (*tun_dev_attach_queue) (void *security);    int (*tun_dev_attach) (struct sock *sk, void *security);    int (*tun_dev_open) (void *security);    void (*skb_owned_by) (struct sk_buff *skb, struct sock *sk);#endif    /* CONFIG_SECURITY_NETWORK */#ifdef CONFIG_SECURITY_NETWORK_XFRM    /*    8. Security hooks for XFRM operations.    */    int (*xfrm_policy_alloc_security) (struct xfrm_sec_ctx **ctxp, struct xfrm_user_sec_ctx *sec_ctx, gfp_t gfp);    int (*xfrm_policy_clone_security) (struct xfrm_sec_ctx *old_ctx, struct xfrm_sec_ctx **new_ctx);    void (*xfrm_policy_free_security) (struct xfrm_sec_ctx *ctx);    int (*xfrm_policy_delete_security) (struct xfrm_sec_ctx *ctx);    int (*xfrm_state_alloc) (struct xfrm_state *x, struct xfrm_user_sec_ctx *sec_ctx);    int (*xfrm_state_alloc_acquire) (struct xfrm_state *x, struct xfrm_sec_ctx *polsec, u32 secid);    void (*xfrm_state_free_security) (struct xfrm_state *x);    int (*xfrm_state_delete_security) (struct xfrm_state *x);    int (*xfrm_policy_lookup) (struct xfrm_sec_ctx *ctx, u32 fl_secid, u8 dir);    int (*xfrm_state_pol_flow_match) (struct xfrm_state *x, struct xfrm_policy *xp, const struct flowi *fl);    int (*xfrm_decode_session) (struct sk_buff *skb, u32 *secid, int ckall);#endif    /* CONFIG_SECURITY_NETWORK_XFRM */    /* key management security hooks */#ifdef CONFIG_KEYS    /*    9. Security hooks affecting all Key Management operations    */    int (*key_alloc) (struct key *key, const struct cred *cred, unsigned long flags);    void (*key_free) (struct key *key);    int (*key_permission) (key_ref_t key_ref, const struct cred *cred, key_perm_t perm);    int (*key_getsecurity)(struct key *key, char **_buffer);#endif    /* CONFIG_KEYS */#ifdef CONFIG_AUDIT    int (*audit_rule_init) (u32 field, u32 op, char *rulestr, void **lsmrule);    int (*audit_rule_known) (struct audit_krule *krule);    int (*audit_rule_match) (u32 secid, u32 field, u32 op, void *lsmrule,                 struct audit_context *actx);    void (*audit_rule_free) (void *lsmrule);#endif /* CONFIG_AUDIT */};

int security_file_mmap(    struct file *file,     unsigned long reqprot,     unsigned long prot,     unsigned long flags,     unsigned long addr,     unsigned long addr_only){    int ret;    //LSM Hook Function嵌入到了原始的内核函数的执行流程中    ret = security_ops->file_mmap(file, reqprot, prot, flags, addr, addr_only);    if (ret)        return ret;    return ima_file_mmap(file, prot);}

http://lxr.free-electrons.com/source/security/security.chttp://wenku.baidu.com/view/df89fe235901020207409c49.html

1. sys_fork2. sys_execve3. sys_connect4. sys_init_module

int sys_fork(struct pt_regs *regs){    return do_fork(SIGCHLD, regs->sp, regs, 0, NULL, NULL);}

1. retval = security_task_create(clone_flags);在copy_process中被调用int security_task_create(unsigned long clone_flags){    return security_ops->task_create(clone_flags);}

/* * sys_execve() executes a new program. */int do_execve(char * filename, char __user *__user *argv, char __user *__user *envp, struct pt_regs * regs){    //将运行可执行文件时所需的信息组织到一起    struct linux_binprm *bprm;    struct file *file;    struct files_struct *displaced;    bool clear_in_exec;    int retval;    retval = unshare_files(&displaced);    if (retval)        goto out_ret;    retval = -ENOMEM;    bprm = kzalloc(sizeof(*bprm), GFP_KERNEL);    if (!bprm)        goto out_files;    /*    1. LSM Hook Point 1:     retval = prepare_bprm_creds(bprm);    prepare_exec_creds->security_prepare_creds    int security_prepare_creds(struct cred *new, const struct cred *old, gfp_t gfp)    {        return security_ops->cred_prepare(new, old, gfp);    }    */    retval = prepare_bprm_creds(bprm);    if (retval)        goto out_free;    retval = check_unsafe_exec(bprm);    if (retval < 0)        goto out_free;    clear_in_exec = retval;    current->in_execve = 1;    //找到并打开给定的可执行程序文件，open_exec()返回file结构指针，代表着读入可执行文件的上下文    file = open_exec(filename);    //强制转换    retval = PTR_ERR(file);    //判断open_exec()返回的是否是无效指针    if (IS_ERR(file))        goto out_unmark;         sched_exec();    //要执行的文件    bprm->file = file;    //要执行的文件的名字    bprm->filename = filename;    bprm->interp = filename;    retval = bprm_mm_init(bprm);    if (retval)        goto out_file;    //统计命令汗参数的个数    bprm->argc = count(argv, MAX_ARG_STRINGS);    if ((retval = bprm->argc) < 0)        goto out;    //统计环境变量参数的个数    bprm->envc = count(envp, MAX_ARG_STRINGS);    if ((retval = bprm->envc) < 0)        goto out;        //可执行文件中读入开头的128个字节到linux_binprm结构brmp中的缓冲区，用于之后内核根据这头128字节判断应该调用哪个解析引擎来处理当前文件    retval = prepare_binprm(bprm);    if (retval < 0)        goto out;    //文件名拷贝到新分配的页面中    retval = copy_strings_kernel(1, &bprm->filename, bprm);    if (retval < 0)        goto out;    bprm->exec = bprm->p;    //将环境变量拷贝到新分配的页面中    retval = copy_strings(bprm->envc, envp, bprm);    if (retval < 0)        goto out;    //将命令行参数拷贝到新分配的页面中    retval = copy_strings(bprm->argc, argv, bprm);    if (retval < 0)        goto out;    //所有准备工作已经完成，所有必要的信息都已经搜集到了linux_binprm结构中的bprm中    current->flags &= ~PF_KTHREAD;        //调用search_binary_handler()装入并运行目标程序，根据读入数据结构linux_binprm内的二进制文件128字节头中的关键字，决定调用哪种加载函数    /*    2. LSM Hook Point 2:     retval = security_bprm_check(bprm);     int security_bprm_check(struct linux_binprm *bprm)     {         return security_ops->bprm_check_security(bprm);     }     */    retval = search_binary_handler(bprm, regs);    if (retval < 0)        goto out;    /* execve succeeded */    current->fs->in_exec = 0;    current->in_execve = 0;    acct_update_integrals(current);        free_bprm(bprm);    if (displaced)        put_files_struct(displaced);    return retval;out:    if (bprm->mm) {        acct_arg_size(bprm, 0);        mmput(bprm->mm);    }out_file:    //发生错误，返回inode，并释放资源    if (bprm->file)     {        //调用allow_write_access()防止其他进程在读入可执行文件期间通过内存映射改变它的内容        allow_write_access(bprm->file);        //递减file文件中的共享计数        fput(bprm->file);    }out_unmark:    if (clear_in_exec)        current->fs->in_exec = 0;    current->in_execve = 0;out_free:    free_bprm(bprm);out_files:    if (displaced)        reset_files_struct(displaced);out_ret:    return retval;}

1. prepare_bprm_creds：cred初始化过程的LSM Hook点2. search_binary_handler：根据待执行文件的头128字节判断对应的解析处理引擎

1. current2. argv

1. 如果在这个队列中没有找到相应的可执行文件格式，就要根据文件头部的信息来查找是否有为此种格式设计的可动态安装的模块2. 如果找到对应的可执行文件格式，就把这个模块安装进内核，并挂入formats队列，然后再重新扫描 

1. load_binaryload_binary就是具体的ELF程序装载程序，不同的可执行文件其装载函数也不同    1) a.out格式的装载函数为: load_aout_binary()    2) elf的装载函数为: load_elf_binary()2. load_shlib3. core_dump

1. file_permission(interpreter, MAY_READ)int file_permission(struct file *file, int mask){    return inode_permission(file->f_path.dentry->d_inode, mask);}2. install_exec_creds(bprm);void install_exec_creds(struct linux_binprm *bprm){    security_bprm_committing_creds(bprm);    commit_creds(bprm->cred);    bprm->cred = NULL;    /*     * cred_guard_mutex must be held at least to this point to prevent     * ptrace_attach() from altering our determination of the task‘s     * credentials; any time after this it may be unlocked.     */    security_bprm_committed_creds(bprm);    mutex_unlock(&current->cred_guard_mutex);}..void security_bprm_committed_creds(struct linux_binprm *bprm){    security_ops->bprm_committed_creds(bprm);}

retval = create_elf_tables(bprm, &loc->elf_ex, load_addr, interp_load_addr);

.....p = current->mm->arg_end = current->mm->arg_start;    while (argc-- > 0)     {        size_t len;        if (__put_user((elf_addr_t)p, argv++))        {            return -EFAULT;        }         len = strnlen_user((void __user *)p, MAX_ARG_STRLEN);        if (!len || len > MAX_ARG_STRLEN)        {            return -EINVAL;        }             p += len;    }    if (__put_user(0, argv))    {        return -EFAULT;    }     ....

/*file：表示要映射的文件addr：虚拟空间中的一个地址，表示从这个地址开始查找一个空闲的虚拟区 len：要映射的文件部分的长度prot：这个参数指定对这个虚拟区所包含页的存取权限。可能的标志有    1) PROT_READ    2) PROT_WRITE    3) PROT_EXEC    4) PROT_NONE前三个标志与标志VM_READ、VM_WRITE 及VM_EXEC的意义一样。PROT_NONE表示进程没有以上三个存取权限中的任意一个 Flag：这个参数指定虚拟区的其它标志：off：文件内的偏移量，因为我们并不是一下子全部映射一个文件，可能只是映射文件的一部分，off就表示那部分的起始位置 */static inline unsigned long do_mmap(struct file *file, unsigned long addr, unsigned long len, unsigned long prot, unsigned long flag, unsigned long offset){    unsigned long ret = -EINVAL;    if ((offset + PAGE_ALIGN(len)) < offset)        goto out;    if (!(offset & ~PAGE_MASK))        //do_mmap()函数对参数offset的合法性检查后，就调用do_mmap_pgoff()函数，该函数才是内存映射的主要函数         ret = do_mmap_pgoff(file, addr, len, prot, flag, offset >> PAGE_SHIFT);out:1    return ret;}

1. error = security_file_mmap(NULL, 0, 0, 0, addr, 1);int security_file_mmap(struct file *file, unsigned long reqprot, unsigned long prot, unsigned long flags, unsigned long addr, unsigned long addr_only){    return security_ops->file_mmap(file, reqprot, prot, flags, addr, addr_only);}

http://blog.csdn.net/edwardlulinux/article/details/7998433

1. 直接通过最靠近do_execve的LSM Hook接口：bprm_check_security进行Hook，这个时候拿到的arg和current都是不准确的2. 将Hook点下移，通过do_mmap中的LSM Hook接口：file_mmap进行Hook，参数arg和current是可以取到且也是准确的，但是这个函数的上层调用频率太高，需要ELF镜像头部进行区分，对系统运行性能影响较大

1. 将LSM Hook点尽量上移，在执行流支的尽量上游进行Hook，减少冗余调用频率，提高Hook命中率2. 因为Hook上移，不可避免带来的问题就是，原始Linux内核代码的执行在这个点还未进行，很多变量还没有赋值、或者设置好3. 我们的代码需要针对我们所需的变量，将从当前代码逻辑位置后面的和这些变量相关的内核代码拷贝过来，我们在代码中进行模拟执行，即将原本内核做的事情，我们提前做了4. 但是需要注意的是，我们模拟执行的代码不能对正常的内核函数的执行流支产生任何影响，从程序的角度来说，就是只能拷贝模拟执行那种只获取(get)，而不设置(set)的代码逻辑

1. 选取"security_ops->bprm_committed_creds"作为LSM Hook点2. "security_ops->bprm_committed_creds"在load_elf_binary的install_exec_creds中被调用，而install_exec_creds在create_elf_tables的前面，这个时候current->mm->arg_end还未被设置成命令行参数的结束位置、current->mm->arg_start已经是命令行参数的起始位置了，我们需要仿照create_elf_tables中对current->mm->arg_end的计算代码进行模拟执行，得到arg_end，要注意的是，为了保持系统状态一致性，不能去修改current->mm->arg_end3. 计算好arg_start、arg_end之后，我们继续模拟proc_pid_cmdline这个函数从arg_start、arg_end中获取到当前进程的命令行参数

retval = create_elf_tables(bprm, &loc->elf_ex, load_addr, interp_load_addr);

....p = current->mm->arg_end = current->mm->arg_start;while (argc-- > 0) {    size_t len;    if (__put_user((elf_addr_t)p, argv++))        return -EFAULT;    len = strnlen_user((void __user *)p, MAX_ARG_STRLEN);    if (!len || len > MAX_ARG_STRLEN)        return -EINVAL;    p += len;}if (__put_user(0, argv))    return -EFAULT; /*current->mm->arg_start指向的已经是当前进程命令行参数的起始地址但是未将current->mm->arg_end设置到命令行参数的终止位置(即arg_start + arg_len)*/current->mm->arg_end = current->mm->env_start = p;.....

int fake_cmdline(int argc){    char buffer[2048] = {0};    unsigned long start ,end, p;    start = current->mm->arg_start;    end = current->mm->arg_end;    p = current->mm->arg_start;    printk("argc = %d, start =%p, end=%p, p =%p\n", argc, start, end, p);        while (argc-- > 0)     {        size_t len;        len = strnlen_user((void __user *)p, MAX_ARG_STRLEN);        if (!len || len > MAX_ARG_STRLEN)            return -EINVAL;        p += len;    }    end = p;    printk("argc = %d, start =%p, end=%p, p =%p\n", argc, start, end, p);    proc_cmdline(start, end , buffer);    return 0;}

static int proc_pid_cmdline(struct task_struct *task, char * buffer){    int res = 0;    unsigned int len;    struct mm_struct *mm = get_task_mm(task);    if (!mm)        goto out;    if (!mm->arg_end)        goto out_mm;    /* Shh! No looking before we‘re done */     len = mm->arg_end - mm->arg_start;     if (len > PAGE_SIZE)        len = PAGE_SIZE;     res = access_process_vm(task, mm->arg_start, buffer, len, 0);    // If the nul at the end of args has been overwritten, then    // assume application is using setproctitle(3).    if (res > 0 && buffer[res-1] != ‘\0‘ && len < PAGE_SIZE) {        len = strnlen(buffer, res);        if (len < res) {            res = len;        } else {            len = mm->env_end - mm->env_start;            if (len > PAGE_SIZE - res)                len = PAGE_SIZE - res;            res += access_process_vm(task, mm->env_start, buffer+res, len, 0);            res = strnlen(buffer, res);        }    }out_mm:    mmput(mm);out:    return res;}

1. 尽量少的使用拷贝的源代码，而是采用系统原生提供的函数去实现功能，但是要注意的是，如果这个使用到的系统原生函数是会"改变当前系统运行状态"(例如设置全局变量、改变全局指针)，就绝对不能使用，而只能采用拷贝源代码自己实现的方式，将其中会对当前系统状态产生影响的代码去掉，而只保留那些"取值型"、"临时变量计算型"的非核心代码
2. 我们拷贝的执行代码一定要特别注意对全局变量、全局指针的操作，不能因为我们的模拟执行，而在当前LSM Hook点影响到了Linux内核的状态，否则这样往下执行系统就要处于不一致状态了 
3. Linux下进程都是通过父进程复制出来的，在bash下执行指令是通过bash复制出来的，而current值(即新进程的task_struct)是在整个sys_execve过程中不断完成初始化填充的，我们需要确认我们的hook点取到的current值已经是新进程的current值

....int (*socket_create) (int family, int type, int protocol, int kern);int (*socket_post_create) (struct socket *sock, int family, int type, int protocol, int kern);int (*socket_bind) (struct socket *sock, struct sockaddr *address, int addrlen);int (*socket_connect) (struct socket *sock, struct sockaddr *address, int addrlen);int (*socket_listen) (struct socket *sock, int backlog);int (*socket_accept) (struct socket *sock, struct socket *newsock);int (*socket_sendmsg) (struct socket *sock, struct msghdr *msg, int size);int (*socket_recvmsg) (struct socket *sock, struct msghdr *msg, int size, int flags);....

http://www.cnblogs.com/LittleHann/p/3865490.html//搜索：6. 系统网络状态相关的数据结构

1. struct socket、inet_sk((struct socket)->(struc sock))、struct sockaddr这3中结构体中，要从中筛选出准确保存当前socket连接动作的IP、PORT等信息的字段2. LSM的security_socket_connect()函数会在一次socket连接过程中被多次调用，包括从初始化到最后建立完整连接，我们需要选择相关type字段，对当前的状态进行过滤，过滤出TCP Connect完整建立的那次调用

SYSCALL_DEFINE3(connect, int, fd, struct sockaddr __user *, uservaddr, int, addrlen){
　　.../*     调用该BSD socket对应的connect调用     这里的sock是在前面的socket调用的时候就初始化的，对应于TCP的BSD socket的操作符集是inet_stream_ops    要注意的是:    网络子模块在内核初始化的时候(linux-2.6.32.63\net\ipv4\af_inet.c->inet_init()中)就注册了TCP，UDP和RAW3中协议    linux-2.6.32.63\net\ipv4\af_inet.c       const struct proto_ops inet_stream_ops =     {        .family           = PF_INET,        .owner           = THIS_MODULE,        .release       = inet_release,        .bind           = inet_bind,        .connect       = inet_stream_connect,        .socketpair       = sock_no_socketpair,        .accept           = inet_accept,        .getname       = inet_getname,        .poll           = tcp_poll,        .ioctl           = inet_ioctl,        .listen           = inet_listen,        .shutdown       = inet_shutdown,        .setsockopt       = sock_common_setsockopt,        .getsockopt       = sock_common_getsockopt,        .sendmsg       = tcp_sendmsg,        .recvmsg       = sock_common_recvmsg,        .mmap           = sock_no_mmap,        .sendpage       = tcp_sendpage,        .splice_read       = tcp_splice_read,    #ifdef CONFIG_COMPAT        .compat_setsockopt = compat_sock_common_setsockopt,        .compat_getsockopt = compat_sock_common_getsockopt,    #endif    };    从上面的结构中可以看到connect对应的函数是inet_stream_connect，我们继续分析inet_stream_connect函数    */      err = sock->ops->connect(sock, (struct sockaddr *)&address, addrlen, sock->file->f_flags);out_put:    ...}

int inet_stream_connect(struct socket *sock, struct sockaddr *uaddr, int addr_len, int flags){    struct sock *sk = sock->sk;     ...    switch (sock->state) {    default:        err = -EINVAL;        goto out;    /*     该BSD socket已连接    */      case SS_CONNECTED:        err = -EISCONN;        goto out;    /*     该BSD socket正在连接    */      case SS_CONNECTING:        err = -EALREADY;        /* Fall out of switch with err, set for this state */        break;    case SS_UNCONNECTED:        err = -EISCONN;         if (sk->sk_state != TCP_CLOSE)            goto out;         err = sk->sk_prot->connect(sk, uaddr, addr_len);        if (err < 0)            goto out;        /*         上面的调用完成后，连接并没有完成        */          sock->state = SS_CONNECTING;        /* Just entered SS_CONNECTING state; the only         * difference is that return value in non-blocking         * case is EINPROGRESS, rather than EALREADY.         */        err = -EINPROGRESS;        break;    }    ...}EXPORT_SYMBOL(inet_stream_connect);

1. struct inet_sock->is_icsk2. struct socket->state3. struct socket->type4. struct sockaddr->sa_family

http://www.cnblogs.com/LittleHann/p/4149509.html

1. socket_connect的被调用频率是很高的，需要针对TCP Connect(IPv4、IPv6)进行过滤    1) struct socket->type        1.1) case SOCK_STREAM: stream (connection) socket        1.2) case SOCK_SEQPACKET: sequential packet socket    //从所有sys_connect动作中过滤出TCP Socket之后，继续下一层过滤    2) struct socket->state        2.1) case SS_UNCONNECTED: 只有在这个状态下，内核的SOCKET代码才会调用inet_stream_connect发起TCP连接    //过滤出TCP connect连接之后，继续下一层过滤    3) struct sockaddr->sa_family        3.1) AF_INET6        3.2) AF_INET2. 从网络的角度理解，SOCKET的建立本质上一次网络状态的建立过程，它有很多次的握手交互子过程组成，每一次获取和设置的信息都似乎不同的    1) 对于kretprobe来说，它是在整个sys_socketcall调用结束之后才获得回调触发的，此时SOCKET的相关信息已经全部填充完成，是可以获取到参数的    2) 而对于LSM Hook框架来说，针对sys_connect的LSM Hook点是在函数的入口就被触发调用的，这个时候，TCP Connect的建立还未完成，有很多的元数据是拿不到的

1. 目的(对端)SOCKET信息(IP、PORT)在sys_connect传入的"struct sockaddr *uaddr"中保存，这个变量中保存的是最原始的数据，内核代码中其他的变量都是从这里开始获取的/*...struct sockaddr_in *usin = (struct sockaddr_in *)uaddr;daddr = usin->sin_addr.s_addr;dport = usin->sin_port;...*/2. 源(本端)SOCKET信息(IP、PORT)严格来说，源SOCKET信息应该是在sys_bind，即socket初始化建立的时候由用户传入配置的，这些源SOCKET信息在整个socket变量生命周期中都一直有效，所以，我们获取源SOCKET信息的来源应该是"struct sock *sk"变量/*...struct inet_sock *inet = inet_sk(sk);inet->sportinet->saddr*/

int tcp_v4_connect(struct sock *sk, struct sockaddr *uaddr, int addr_len){    ...    /* Socket identity is still unknown (sport may be zero).     * However we set state to SYN-SENT and not releasing socket     * lock select source port, enter ourselves into the hash tables and     * complete initialization after this.    */    tcp_set_state(sk, TCP_SYN_SENT);    err = inet_hash_connect(&tcp_death_row, sk);    if (err)        goto failure;    err = ip_route_newports(&rt, IPPROTO_TCP, inet->sport, inet->dport, sk);    if (err)        goto failure;    /* OK, now commit destination to socket.  */    sk->sk_gso_type = SKB_GSO_TCPV4;    sk_setup_caps(sk, &rt->u.dst);    if (!tp->write_seq)        tp->write_seq = secure_tcp_sequence_number(inet->saddr,                               inet->daddr,                               inet->sport,                               usin->sin_port);    ...

http://www.cnblogs.com/LittleHann/p/3875451.html//搜索：2. connect() API原理

1. 会改变当前socket的state状态2. 会在hash表中增加entry3. 这两个操作涉及到的内核代码很逗，且如果模拟执行后无法进行逆向回滚

int security_kernel_create_files_as(struct cred *new, struct inode *inode){    return security_ops->kernel_create_files_as(new, inode);}int security_kernel_module_request(void){    return security_ops->kernel_module_request();}

#include <linux/security.h>#include <linux/sysctl.h>#include <linux/ptrace.h>#include <linux/prctl.h>#include <linux/ratelimit.h>#include <linux/workqueue.h>#include <linux/file.h>#include <linux/fs.h>#include <linux/dcache.h>#include <linux/path.h>#include <linux/kprobes.h>#include <linux/module.h> static int (*register_security_p)(struct security_operations *ops);static int (*unregister_security_p)(struct security_operations * ops);// do nothingint kprobe_pre(struct kprobe *p, struct pt_regs *regs){        return 0;}static void* acquire_func_by_kprobe(char* func_name){    void *symbol_addr=NULL;    struct kprobe kp;    do    {       memset(&kp, 0, sizeof(kp));       kp.symbol_name = func_name;       kp.pre_handler = kprobe_pre;       if(register_kprobe(&kp) != 0)       {            symbol_addr=(void*)kp.addr;            break;       }       //this is the address of  "symbol_name"       symbol_addr = (void*)kp.addr;       //now kprobe is not used any more,so unregister it       unregister_kprobe(&kp);    }while(false);    return symbol_addr;}int execve_lsm_hook(struct linux_binprm *bprm){    struct cred *currentCred;    if (bprm->filename)    {        printk("file: %s\n", bprm->filename);        //printk("file argument: %s\n",bprm->p);    }    else    {        printk("file exec\n");    }         currentCred = current->cred;        printk(KERN_INFO "uid = %d\n", currentCred->uid);    printk(KERN_INFO "gid = %d\n", currentCred->gid);    printk(KERN_INFO "suid = %d\n", currentCred->suid);    printk(KERN_INFO "sgid = %d\n", currentCred->sgid);    printk(KERN_INFO "euid = %d\n", currentCred->euid);    printk(KERN_INFO "egid = %d\n", currentCred->egid);      printk("comm: %s\n", current->comm);    return 0;} static struct security_operations test_security_ops = {        .name = "test",        .bprm_check_security = execve_lsm_hook,};static __init int test_init(void){    int ret_val = -1;    //获取register_security的导出地址    register_security_p = acquire_func_by_kprobe("register_security");    printk("register_security:%p\n", register_security_p);       if (!register_security_p)    {        printk("get register_security error\n");    }      //获取unregister_security的导出地址    unregister_security_p = acquire_func_by_kprobe("unregister_security");    printk("unregister_security:%p\n", unregister_security_p);    if (!unregister_security_p)    {        printk("get unregister_security error\n");     }         //注册LSMsbas     //if (register_security_p && unregister_security_p)     if (register_security_p)    {        ret_val = register_security_p(&test_security_ops);         printk("register_security:%d\n", ret_val);      }         return 0;} static void test_cleanup(void){    int ret_val=-1;    //if (register_security_p && unregister_security_p)    if (unregister_security_p)    {        ret_val = register_security_p(&test_security_ops);         printk("register_security:%d\n", ret_val);      }    return;} module_init(test_init);module_exit(test_cleanup);//一定要有这个声明，否则会有unknown module symbol errorMODULE_LICENSE("GPL");

obj-m := execve_lsm_hook.oPWD       := $(shell pwd)all:    make -C /lib/modules/$(shell uname -r)/build M=$(PWD) modulesclean:    rm -rf *.o *~ core .*.cmd *.mod.c ./tmp_version *.ko modules.order  Module.symversclean_omit:    rm -rf *.o *~ core .*.cmd *.mod.c ./tmp_version modules.order  Module.symvers

http://hi.baidu.com/wzt85/item/275a9651277866aaacc857d5

#include <linux/module.h>    // included for all kernel modules#include <linux/kernel.h>    // included for KERN_INFO#include <linux/init.h>        // included for __init and __exit macros#include <linux/cred.h>#include <linux/sched.h>#include <linux/mm_types.h>#include <linux//vmalloc.h>#include <linux/cache.h>#include <asm/cacheflush.h>#include <linux/pagemap.h> static void util_get_task_name(struct task_struct* arg_task){    struct task_struct *task = arg_task;    char *name = NULL;    char *argv = NULL;            if(task != NULL)    {        name = kmalloc(PATH_MAX, GFP_ATOMIC);        argv = kmalloc(PATH_MAX, GFP_ATOMIC);        char *buffer = NULL;        struct mm_struct *mm = get_task_mm(task);        int len = 0;        unsigned long address = 0;          if(!name || !mm)            goto out;        down_read(&mm->mmap_sem);        len = mm->arg_end - mm->arg_start;        address = mm->arg_start;        buffer = name;        while(len)        {            void *maddr = NULL;            struct page *page = NULL;            struct vm_area_struct *vma = NULL;            int bytes = 0, offset = 0;                                    int ret = get_user_pages(task, mm, address, 1, 0, 1, &page, &vma);            if(ret <= 0)            {                bytes = ret;                goto next;            }                                            bytes = len;            offset = address & (PAGE_SIZE-1);                   if (bytes > PAGE_SIZE-offset)            {                bytes = PAGE_SIZE - offset;            }                         maddr = kmap(page);            copy_from_user_page(vma, page, address, buffer, maddr + offset, bytes);            kunmap(page);            page_cache_release(page);next:            len -= bytes;            address += bytes;            buffer += bytes;        }                        up_read(&mm->mmap_sem);        mmput(mm);        printk("name = %s, len = %d\n", name, len);        //这里需要调整一下参数，因为进程的参数是以空格作为分隔的，需要将以空格分隔的参数串分离出来分别打印        name += 6;        printk("arg = %s, len = %d\n", name, len);    }out:    if(name)     {        kfree(name);    }    return;} static int __init hello_init(void){     struct cred *currentCred;    currentCred = current->cred;        printk(KERN_INFO "uid = %d\n", currentCred->uid);    printk(KERN_INFO "gid = %d\n", currentCred->gid);    printk(KERN_INFO "suid = %d\n", currentCred->suid);    printk(KERN_INFO "sgid = %d\n", currentCred->sgid);    printk(KERN_INFO "euid = %d\n", currentCred->euid);    printk(KERN_INFO "egid = %d\n", currentCred->egid);      util_get_task_name(current);    printk(KERN_INFO "Hello world!\n");     return 0;    // Non-zero return means that the module couldn‘t be loaded.} static void __exit hello_cleanup(void){    printk(KERN_INFO "Cleaning up module.\n");} module_init(hello_init);module_exit(hello_cleanup);MODULE_LICENSE("GPL");

obj-m := get_arc_from_current.oKDIR := /lib/modules/$(shell uname -r)/buildPWD := $(shell pwd) all:    $(MAKE) -C $(KDIR) M=$(PWD) modules clean:    $(MAKE) -C $(KDIR) M=$(PWD) clean

http://laokaddk.blog.51cto.com/368606/694037/

#include <linux/module.h>    // included for all kernel modules#include <linux/kernel.h>    // included for KERN_INFO#include <linux/init.h>        // included for __init and __exit macros#include <linux/cred.h>#include <linux/sched.h>#include <linux/mm_types.h>#include <linux//vmalloc.h>#include <linux/cache.h>#include <asm/cacheflush.h>#include <linux/pagemap.h> #ifndef MODULE    #define MODULE#endif#ifndef __KERNEL__    #define __KERNEL__#endif   #include <linux/fs.h>#include <linux/file.h>#include <linux/kallsyms.h>#include <linux/syscalls.h>#include <asm/unistd.h> #include <linux/time.h>#include <linux/timer.h>#include <linux/kprobes.h>#include <linux/security.h>#include <linux/binfmts.h>#include <asm/current.h>#include <linux/threads.h> #include <linux/mm.h>#include <asm/page.h>  static struct security_operations sec_ops; static int (*register_security_p)(struct security_operations *ops);static int (*unregister_security_p)(struct security_operations * ops);static int (*access_process_vm_p)(struct task_struct *tsk, unsigned long addr, void *buf, int len, int write);// do nothingint kprobe_pre(struct kprobe *p, struct pt_regs *regs){    return 0;} //使用kprobe获取内核中任意函数的地址static void* acquire_func_by_kprobe(char* func_name){    void *symbol_addr = NULL;    struct kprobe kp;    do    {        memset(&kp,0,sizeof(kp));        kp.symbol_name=func_name;        kp.pre_handler=kprobe_pre;        if(register_kprobe(&kp)!=0)        {            symbol_addr=(void*)kp.addr;             break;        }         symbol_addr=(void*)kp.addr;         //now kprobe is not used any more,so unregister it        unregister_kprobe(&kp);     }while(false);    return symbol_addr;}  //根据arg_start、arg_end从内核内存地址空间中直接复制出参数字符串，模拟proc_pid_cmdline这个函数的代码逻辑static int proc_cmdline(unsigned long start, unsigned long end, char * buffer){    int res = 0, i;    unsigned int len;    struct task_struct * task = current;    struct mm_struct *mm = get_task_mm(task);    //struct mm_struct *mm = bprm->mm;    printk("proc_cmdline, mm = %p, arg_start = %d , arg_end=%d\n", mm, mm->arg_start, mm->arg_end);    if (!mm)        goto out;    if (!mm->arg_end)    {        if(end <= start)            goto out_mm;        }     len = end - start;    printk("args len = %d\n", len);    if (len > PAGE_SIZE)        len = PAGE_SIZE;     if (access_process_vm_p)    {        res = access_process_vm_p(task, mm->arg_start, buffer, len, 0);      }    //res = access_vm(task, mm->arg_start, buffer, len, 0);    // If the nul at the end of args has been overwritten, then    // assume application is using setproctitle(3).    if (res > 0 && buffer[res-1] != ‘\0‘ && len < PAGE_SIZE)     {        len = strnlen(buffer, res);        if (len < res)         {            res = len;        }         else         {            len = mm->env_end - mm->env_start;            if (len > PAGE_SIZE - res)            {                len = PAGE_SIZE - res;            }             if (access_process_vm_p)            {                res += access_process_vm_p(task, mm->env_start, buffer+res, len, 0);            }            //res += access_vm(task, mm->env_start, buffer+res, len, 0);            res = strnlen(buffer, res);        }     }    printk("arg 1 :%s\n", buffer);     //命令行参数是以空格结尾的，这里临时跳过这段空格，真正编码的时候需要针对空格作"replace"处理，才能正常打印出来    printk("arg 2 : %s\n", buffer+6);out_mm:    mmput(mm);    printk("out_mm\n");out:    printk("out\n");    return res;} void print_current(){    struct cred *currentCred;    currentCred = current->cred;        printk(KERN_INFO "uid = %d\n", currentCred->uid);    printk(KERN_INFO "gid = %d\n", currentCred->gid);    //printk(KERN_INFO "suid = %d\n", currentCred->suid);    //printk(KERN_INFO "sgid = %d\n", currentCred->sgid);    printk(KERN_INFO "euid = %d\n", currentCred->euid);    printk(KERN_INFO "egid = %d\n", currentCred->egid);      printk(KERN_INFO "tid = %d\n", task_tgid_vnr(current));      printk(KERN_INFO "sid = %d\n", task_session_vnr(current));    printk(KERN_INFO "pid = %d\n", current->pid);     printk(KERN_INFO "tgid = %d\n", current->tgid);     printk(KERN_INFO "tty name: %s\n", current->signal->tty);     printk(KERN_INFO "programe name: %s\n", current->comm);     return;   }//模拟内核代码对arg_start、arg_end的计算int fake_cmdline(int argc){    char buffer[2048] = {0};    unsigned long start ,end, p;    start = current->mm->arg_start;    end = current->mm->arg_end;    p = current->mm->arg_start;    printk("argc = %d, start =%p, end=%p, p =%p\n", argc, start, end, p);    while (argc-- > 0)     {        size_t len;        len = strnlen_user((void __user *)p, MAX_ARG_STRLEN);        if (!len || len > MAX_ARG_STRLEN)            return -EINVAL;        //将p指针指向当前进程参数的结束地址内存区        p += len;    }    end = p;    printk("argc = %d, start =%p, end=%p, p =%p\n", argc, start, end, p);    //根据arg_start、arg_end从内核内存地址空间中直接复制出参数字符串，模拟proc_pid_cmdline这个函数的代码逻辑    proc_cmdline(start, end , buffer);    //打印current信息，验证当前LSM Hook点是否已经完成了current的赋值，因为Linux中所有的进程都是父进程"复制"出来的，在新进程创建的过程中，新进程的current是逐步填充设置为新进程的相关信息    print_current();    return 0;} void security_bprm_committed_creds(struct linux_binprm *bprm){      printk("security_bprm_committed_creds\n");     do     {         if (bprm->filename)        {            printk("in committed cred pid = %d, mm:%p,  file:%s\n",current->pid, current->mm, bprm->filename);        }else        {            printk("file exec\n");        }                 //模拟内核代码对arg_start、arg_end的计算        fake_cmdline(bprm->argc);    } while (false);     return;}static int __init hello_init(void){     int ret_val = -1;    do     {        memset(&sec_ops, 0, sizeof(sec_ops));         sprintf(sec_ops.name,"aegis_lsm");        sec_ops.bprm_committed_creds = security_bprm_committed_creds;        //获取access_process_vm函数的内核地址        access_process_vm_p = acquire_func_by_kprobe("access_process_vm");         printk("access_process_vm:%p\n", access_process_vm_p);         if (!access_process_vm_p)        {            printk("get access_process_vm error\n");        }        //获取LSM注册函数register_security的内核地址        register_security_p = acquire_func_by_kprobe("register_security");         printk("register_security:%p\n", register_security_p);         if (!register_security_p)        {            printk("get register_security error\n");        }        //获取LSM注销函数unregister_security的内核地址        unregister_security_p = acquire_func_by_kprobe("unregister_security");         printk("unregister_security:%p\n", unregister_security_p);         if (!unregister_security_p)        {            printk("get unregister_security error\n");         }        //注册LSM Hook模块        if (register_security_p)        {            ret_val = register_security_p(&sec_ops);            printk("register_security successfully: %d\n", ret_val);            break;        }    }    while(false);    printk(KERN_INFO "Hello world!\n");     return ret_val;         } static void __exit hello_cleanup(void){    if (unregister_security_p)    {        unregister_security_p(&sec_ops);     }    printk(KERN_INFO "Cleaning up module.\n");} module_init(hello_init);module_exit(hello_cleanup);MODULE_LICENSE("GPL");

#ifndef MODULE#define MODULE#endif#ifndef __KERNEL__#define __KERNEL__#endif #include <linux/kernel.h>#include <linux/init.h> #include <linux/kallsyms.h>#include <linux/syscalls.h>#include <asm/unistd.h> #include <linux/time.h>#include <linux/timer.h> #include <linux/security.h> #include <asm/current.h>#include <linux/threads.h>#include <linux/sched.h> #include <asm/page.h>#include <asm/cacheflush.h>#include <linux/pagemap.h>#include <linux/inet.h>#include <linux/ipv6.h>#include <linux/skbuff.h>#include <linux/ip.h>#include <linux/tcp.h>#include <linux/string.h> #include <linux/version.h>     #include <linux/module.h>#include <linux/binfmts.h>#include <linux/kprobes.h>#include <linux/slab.h>#include <linux/tty.h>//thread header #include <linux/kthread.h> #include <linux/mm.h>//modinfo header#include <linux/vmalloc.h>   #include <net/ipv6.h>#if LINUX_VERSION_CODE < KERNEL_VERSION(3, 0, 25)        #define SADDR saddr        #define DADDR daddr        #define SPORT sport        #define DPORT dport#else        #define SADDR inet_saddr        #define DADDR inet_daddr        #define SPORT inet_sport        #define DPORT inet_dport#endif typedef void* (*look_up_symbol_t)(char*);static void* (*look_up_symbol)(char*);static struct security_operations org_sec_ops_back_up;static struct security_operations *org_sec_ops_p = NULL;static struct security_operations sec_ops; static int (*register_security_p)(struct security_operations *ops);static int (*unregister_security_p)(struct security_operations * ops);  static unsigned int wpoff_cr0_32(void){    unsigned int cr0 = 0;    unsigned int ret=0;    asm volatile ("movl %%cr0, %%eax":"=a"(cr0)); //汇编代码，用于取出CR0寄存器的值    ret = cr0;    cr0 &= 0xfffeffff;    asm volatile ("movl %%eax, %%cr0": :"a"(cr0));//汇编代码，将修改后的CR0值写入CR0寄存器    return ret;}static unsigned long int wpoff_cr0_64(void){    unsigned long int cr0 = 0;    unsigned long int ret=0;    asm volatile ("movq %%cr0, %%rax":"=a"(cr0)); //汇编代码，用于取出CR0寄存器的值    ret = cr0;    cr0 &= 0xfffffffffffeffff;    asm volatile ("movq %%rax, %%cr0": :"a"(cr0));//汇编代码，将修改后的CR0值写入CR0寄存器    return ret;}static unsigned long int wpoff_cr0(void){    if(sizeof(void*)==4)    {    return wpoff_cr0_32();    }else    {    return wpoff_cr0_64();    }}static void set_cr0_32(unsigned int val){    asm volatile ("movl %%eax, %%cr0": :"a"(val));    return;}static void set_cr0_64(unsigned long int val){    asm volatile ("movq %%rax, %%cr0": :"a"(val));    return;}static void set_cr0(unsigned long int val){    if(sizeof(void*)==4)    {    set_cr0_32((unsigned int)val);    }else    {    set_cr0_64(val);    }} static void SLEEP_MILLI_SEC(int nMilliSec){    long timeout = (nMilliSec) * HZ / 1000;    while(timeout > 0)    {    timeout = schedule_timeout(timeout);    }}// do nothingint kprobe_pre(struct kprobe *p, struct pt_regs *regs){    return 0;}  //使用kprobe获取内核中任意函数的地址static void* acquire_func_by_kprobe(char* func_name){    void *symbol_addr = NULL;    struct kprobe kp;    do    {        memset(&kp,0,sizeof(kp));        kp.symbol_name=func_name;        kp.pre_handler=kprobe_pre;        if(register_kprobe(&kp)!=0)        {            symbol_addr=(void*)kp.addr;             break;        }         symbol_addr=(void*)kp.addr;         //now kprobe is not used any more,so unregister it        unregister_kprobe(&kp);     }while(false);    return symbol_addr;}   static look_up_symbol_t init_lookup_func(void){    if (!look_up_symbol)    {        look_up_symbol = (look_up_symbol_t)acquire_func_by_kprobe("kallsyms_lookup_name");    }    return look_up_symbol;}//判断当前socket连接是否为"SS_UNCONNECTED"状态，只有在这个状态下，才是TCP Connect最初发起连接的那一次  int is_inet_stream_connect(struct socket *sock, struct sockaddr *uaddr, int addr_len, int flags){    int ret = 0;    int err = 0;    struct sock *sk = sock->sk;     const unsigned int type = sock->type;    //1. struct socket->type    switch (type)     {        case SOCK_DGRAM:        case SOCK_RAW:            ret = 0;            break;        case SOCK_STREAM:        case SOCK_SEQPACKET:            ret = 1;            //2. struct socket->state             if (uaddr->sa_family == AF_UNSPEC)             {                 goto out;            }             if (sk->sk_state == TCP_CLOSE)            {                goto sock_error;            }            switch (sock->state)             {                  case SS_CONNECTED:                    ret = 0;                    break;                 case SS_CONNECTING:                    ret = 0;                    break;                 //我们真正需要捕获的TCP Conncet动作                case SS_UNCONNECTED:                    ret = 1;                    //3. struct sockaddr->sa_family                    switch (uaddr->sa_family)                     {                        case AF_INET6:                        case AF_INET:                            ret = 1;                            break;                         default:                            ret = 0;                    }                    break;                 default:                    ret = 0;            }              break;        default:            ret = 0;    }  out:     return ret;sock_error:     goto out;}void socket_connect_log(struct socket *sock, struct sockaddr *addr, int addr_len){       int ret = 0;    const __be32 *daddr = NULL;     __be16 dport = 0;    __be16 sport = 0;    const __be32 *saddr = NULL;    pid_t pid = current->pid;    do     {          ret = 0;        //过滤冗余事件        ret = is_inet_stream_connect(sock, (struct sockaddr *)&addr, addr_len, sock->file->f_flags);        if (ret != 1)        {            goto skip;          }         //获取待连接的对端的IP、PORT信息        switch (addr->sa_family)         {            case AF_INET6:                if (addr_len < SIN6_LEN_RFC2133)                {                    goto skip;                   }                  daddr = (__be32 *) ((struct sockaddr_in6 *) addr)->sin6_addr.s6_addr;                dport = ((struct sockaddr_in6 *) addr)->sin6_port;                                saddr = &inet_sk(sock->sk)->SADDR;                //sport = ntohs(inet_sk(sock->sk)->SPORT);                  sport = inet_sk(sock->sk)->SPORT;                 break;            case AF_INET:                if (addr_len < sizeof(struct sockaddr_in))                {                    goto skip;                }                 daddr = (__be32 *) &((struct sockaddr_in *) addr)->sin_addr;                dport = ((struct sockaddr_in *) addr)->sin_port;                saddr = &inet_sk(sock->sk)->SADDR;                //sport = ntohs(inet_sk(sock->sk)->SPORT);                  sport = inet_sk(sock->sk)->SPORT;                 break;            default:                daddr = NULL;                dport = 0;                saddr = NULL;                sport = 0;                goto skip;        }         //printk("process: %d,  daddr: %s,  dport: %d\n", pid, daddr, dport);        printk("process: %d, saddr: %d:%d, daddr: %d:%d\n", pid, saddr, sport, daddr, dport);    } while (false); skip:    return; }static int __init hello_init(void){     int ret_val = -1;    unsigned long int cr0 = 0;    do     {        memset(&sec_ops, 0, sizeof(sec_ops));         //sprintf(sec_ops.name,"aegis_lsm");        //针对TCP CONNECT连接动作进行Hook        sec_ops.socket_connect = socket_connect_log;         if (!init_lookup_func())        {            break;        }        //获取LSM注册函数register_security的内核地址        register_security_p = acquire_func_by_kprobe("register_security");         printk("register_security:%p\n", register_security_p);         if (!register_security_p)        {            printk("get register_security error\n");        }        //获取LSM注销函数unregister_security的内核地址        unregister_security_p = acquire_func_by_kprobe("unregister_security");         printk("unregister_security:%p\n", unregister_security_p);         if (!unregister_security_p)        {            printk("get unregister_security error\n");         }        //注册LSM Hook模块        if (register_security_p)        {            ret_val = register_security_p(&sec_ops);            printk("register_security successfully: %d\n", ret_val);            break;        }          memset(&org_sec_ops_back_up, 0, sizeof(org_sec_ops_back_up));        //获取内核中security_ops(LSM Table)的地址        org_sec_ops_p = look_up_symbol("security_ops");        if (!org_sec_ops_p)        {            break;        }         org_sec_ops_p = *(void**)org_sec_ops_p;         printk("org_sec_ops:%p\n", org_sec_ops_p);        //保存内核中的"security_ops"        memcpy(&org_sec_ops_back_up, org_sec_ops_p, sizeof(org_sec_ops_back_up));        cr0 = wpoff_cr0();         org_sec_ops_p->socket_connect = socket_connect_log;         set_cr0(cr0);         ret_val = 0;    }    while(false);    printk(KERN_INFO "Hello world!\n");     return ret_val;         } static void __exit hello_cleanup(void){    unsigned long int cr0 = 0;    if (unregister_security_p)    {        unregister_security_p(&sec_ops);     }     else if(org_sec_ops_p)    {        cr0 = wpoff_cr0();          org_sec_ops_p->socket_connect = org_sec_ops_back_up.socket_connect;         set_cr0(cr0);         SLEEP_MILLI_SEC(100);    }     printk(KERN_INFO "Cleaning up module.\n");} module_init(hello_init);module_exit(hello_cleanup);MODULE_LICENSE("GPL");