2020#include <linux/sched.h>
2121#include <linux/uaccess.h>
2222#include <linux/slab.h>
23- /** This is what we're using here. */
2423#include <linux/ftrace.h>
2524
2625MODULE_LICENSE ("GPL" );
2726
2827#define MAX_FILENAME_SIZE 200
2928
29+ #undef pr_fmt
30+ #define pr_fmt (fmt ) "[syscall-ftrace] " fmt
31+
3032/* UID we want to spy on - will be filled from the command line. */
3133static int uid = 0 ;
3234module_param (uid , int , 0644 );
@@ -48,14 +50,12 @@ typedef struct ftrace_hook {
4850 struct ftrace_ops ops ; // ftrace structure
4951} ftrace_hook_t ;
5052
51- // clang-format off
52- #define PREPARE_HOOK (_nr , _hook , _orig ) \
53- { \
54- .nr = (_nr), .new = (_hook), .orig = (_orig) \
53+ #define PREPARE_HOOK (_nr , _hook , _orig ) \
54+ { \
55+ .nr = (_nr), .new = (_hook), .orig = (_orig) \
5556 }
5657
57- unsigned long * * sys_call_table ;
58- // clang-format on
58+ static unsigned long * * sys_call_table ;
5959
6060/**
6161 * For the sake of simplicity, only the kprobe method is included.
@@ -71,19 +71,19 @@ static int resolve_address(ftrace_hook_t *hook)
7171 unregister_kprobe (& kp );
7272
7373 if (kallsyms_lookup_name )
74- pr_info ("[syscall-ftrace] kallsyms_lookup_name is found at 0x%lx\n" ,
74+ pr_info ("kallsyms_lookup_name is found at 0x%lx\n" ,
7575 (unsigned long )kallsyms_lookup_name );
7676 else {
77- pr_err ("[syscall-ftrace] kallsyms_lookup_name is not found!\n" );
77+ pr_err ("kallsyms_lookup_name is not found!\n" );
7878 return -1 ;
7979 }
8080
8181 sys_call_table = (unsigned long * * )kallsyms_lookup_name ("sys_call_table" );
8282 if (sys_call_table )
83- pr_info ("[syscall-ftrace] sys_call_table is found at 0x%lx\n" ,
83+ pr_info ("sys_call_table is found at 0x%lx\n" ,
8484 (unsigned long )sys_call_table );
8585 else {
86- pr_err ("[syscall-ftrace] sys_call_table is not found!\n" );
86+ pr_err ("sys_call_table is not found!\n" );
8787 return -1 ;
8888 }
8989
@@ -127,7 +127,7 @@ static void notrace ftrace_thunk(unsigned long ip, unsigned long parent_ip,
127127
128128#endif /** Version >= v5.11 */
129129
130- int install_hook (ftrace_hook_t * hook )
130+ static int install_hook (ftrace_hook_t * hook )
131131{
132132 int err ;
133133 err = resolve_address (hook );
@@ -141,38 +141,38 @@ int install_hook(ftrace_hook_t *hook)
141141 /** Only sys_openat should be traced */
142142 err = ftrace_set_filter_ip (& hook -> ops , hook -> address , 0 , 0 );
143143 if (err ) {
144- pr_err ("[syscall-ftrace] ftrace_set_filter_ip() failed: %d\n" , err );
144+ pr_err ("ftrace_set_filter_ip() failed: %d\n" , err );
145145 return err ;
146146 }
147147
148148 err = register_ftrace_function (& hook -> ops );
149149 if (err ) {
150- pr_err ("[syscall-ftrace] register_ftrace_function() failed: %d\n" , err );
150+ pr_err ("register_ftrace_function() failed: %d\n" , err );
151151 return err ;
152152 }
153153
154154 return 0 ;
155155}
156156
157- void remove_hook (ftrace_hook_t * hook )
157+ static void remove_hook (ftrace_hook_t * hook )
158158{
159159 int err ;
160160 err = unregister_ftrace_function (& hook -> ops );
161161 if (err )
162- pr_err ("[syscall-ftrace] unregister_ftrace_function() failed: %d\n" ,
163- err );
162+ pr_err ("unregister_ftrace_function() failed: %d\n" , err );
164163
165164 /** Disable the trace by setting remove to 1 */
166165 err = ftrace_set_filter_ip (& hook -> ops , hook -> address , 1 , 0 );
167166 if (err )
168- pr_err ("[syscall-ftrace] ftrace_set_filter_ip() failed: %d\n" , err );
167+ pr_err ("ftrace_set_filter_ip() failed: %d\n" , err );
169168}
170169
171170/** For some reason the kernel segfaults when the parameters are expanded. */
172171static asmlinkage long (* original_call )(struct pt_regs * regs );
173172static asmlinkage long our_sys_openat (struct pt_regs * regs )
174173{
175174 char * kfilename ;
175+ int errcode = 0 ;
176176 if (current -> cred -> uid .val != uid )
177177 return original_call (regs );
178178 kfilename = kmalloc (GFP_KERNEL , MAX_FILENAME_SIZE * sizeof (char ));
@@ -186,14 +186,14 @@ static asmlinkage long our_sys_openat(struct pt_regs *regs)
186186 * Change regs->si to appropriate registers
187187 * if you are trying on different architecture.
188188 */
189- // clang-format off
190- if (copy_from_user (kfilename , (char __user * )regs -> si , MAX_FILENAME_SIZE ) < 0 ) {
189+ errcode =
190+ copy_from_user (kfilename , (char __user * )regs -> si , MAX_FILENAME_SIZE );
191+ if (errcode < 0 ) {
191192 kfree (kfilename );
192193 return original_call (regs );
193194 }
194- // clang-format on
195195
196- pr_info ("[syscall-ftrace] File opened by UID %d: %s\n" , uid , kfilename );
196+ pr_info ("File opened by UID %d: %s\n" , uid , kfilename );
197197 kfree (kfilename );
198198
199199 return original_call (regs );
@@ -208,14 +208,14 @@ static int __init syscall_ftrace_start(void)
208208 err = install_hook (& sys_openat_hook );
209209 if (err )
210210 return err ;
211- pr_info ("[syscall-ftrace] hooked, spying on uid %d\n" , uid );
211+ pr_info ("hooked, spying on uid %d\n" , uid );
212212 return 0 ;
213213}
214214
215215static void __exit syscall_ftrace_end (void )
216216{
217217 remove_hook (& sys_openat_hook );
218- pr_info ("[syscall-ftrace] removed\n" );
218+ pr_info ("removed\n" );
219219}
220220
221221module_init (syscall_ftrace_start );
0 commit comments