librewolf
/
lkrg
mirror of https://github.com/openwall/lkrg.git
1
0
Fork 0
Code Issues Projects Releases Wiki Activity
lkrg/Makefile

105 lines
6.5 KiB
Makefile
Raw Normal View History

Initial LKRG-main
2017-10-27 07:29:49 +02:00
##
Makefile changes (and clean up)
2018-02-05 04:26:06 +01:00
# Makefile for LKRG (main branch)
Initial LKRG-main
2017-10-27 07:29:49 +02:00
#
# Author:
# - Adam 'pi3' Zabrocki (http://pi3.com.pl)
##
export CFLAGS="$CFLAGS"
Makefile changes (and clean up)
2018-02-05 04:26:06 +01:00
P_OUTPUT = output
1. Add LKRG early boot systemd script file. Currently only Systemd init system is supported. There are no technical reasons to not add support for other Init systems. 2. Modify Makefile to support install/unistall option which will deploy/remove systemd boot service. 3. [ED] Add functionality of freezing all user-mode processes during Exploit-Detection initialization.
2019-02-13 01:12:10 +01:00
P_PWD ?= $(shell pwd)
Extend P_KVER variable definition in Makefile
2018-11-13 05:19:33 +01:00
P_KVER ?= $(shell uname -r)
[1] Add Mikhail Klementev's <jollheef@riseup.net> patch for Makefile. [2] Add Mikhail Klementev's <jollheef@riseup.net> patch which creates .gitignore file. [3] Add Mikhail Klementev's <jollheef@riseup.net> patch for missing include file (linux/profile.h) [4] [CI] Change output message format when *_JUMP_LABEL was detected for kernel module's .text section.
2018-09-05 02:43:48 +02:00
P_KERNEL := /lib/modules/$(P_KVER)/build
1. Add LKRG early boot systemd script file. Currently only Systemd init system is supported. There are no technical reasons to not add support for other Init systems. 2. Modify Makefile to support install/unistall option which will deploy/remove systemd boot service. 3. [ED] Add functionality of freezing all user-mode processes during Exploit-Detection initialization.
2019-02-13 01:12:10 +01:00
P_BOOTUP_SCRIPT ?= scripts/bootup/lkrg-bootup.sh
Initial LKRG-main
2017-10-27 07:29:49 +02:00
obj-m += p_lkrg.o
p_lkrg-objs += src/modules/ksyms/p_resolve_ksym.o \
Replace SuperFastHash algorithm with SipHash
2017-12-21 05:45:46 +01:00
src/modules/hashing/p_lkrg_fast_hash.o \
Initial LKRG-main
2017-10-27 07:29:49 +02:00
src/modules/comm_channel/p_comm_channel.o \
src/modules/integrity_timer/p_integrity_timer.o \
src/modules/kmod/p_kmod.o \
src/modules/database/CPU.o \
[1] Refactor LKRG's code to support various CPU architecture [2] Add beta version support for ARM64 [3] [ED] Fix FP (race condition) in pCFI in glitching scenario during process update and add memory barrier [4] [ED] Fix potential FP during LKRG unloading procedure and add memory barrier [5] [ED] Create own version of user_access_begin() function compatible across various kernel versions and leverage it for argument extraction for *init_module/delete_module [6] [ED] Fix logic for *init_module/delete_module for kernel with CONFIG_ARCH_HAS_SYSCALL_WRAPPER
2019-04-20 20:14:57 +02:00
src/modules/database/arch/x86/p_x86_metadata.o \
[CI] Add *_JUMP_LABEL support for kernel modules - very big and heavy change.
2018-09-05 02:25:37 +02:00
src/modules/database/arch/x86/p_switch_idt/p_switch_idt.o \
[1] Refactor LKRG's code to support various CPU architecture [2] Add beta version support for ARM64 [3] [ED] Fix FP (race condition) in pCFI in glitching scenario during process update and add memory barrier [4] [ED] Fix potential FP during LKRG unloading procedure and add memory barrier [5] [ED] Create own version of user_access_begin() function compatible across various kernel versions and leverage it for argument extraction for *init_module/delete_module [6] [ED] Fix logic for *init_module/delete_module for kernel with CONFIG_ARCH_HAS_SYSCALL_WRAPPER
2019-04-20 20:14:57 +02:00
src/modules/database/arch/arm64/p_arm64_metadata.o \
[CI] Add *_JUMP_LABEL support for kernel modules - very big and heavy change.
2018-09-05 02:25:37 +02:00
src/modules/database/arch/p_arch_metadata.o \
[CI] Complete rewrite of *_JUMP_LABEL support. New logic simplifies some internal algorithms, removes whitelisting logic (not needed anymore) and significantly reduce memory footprint. It's a huge change!
2019-02-15 15:52:21 +01:00
src/modules/database/JUMP_LABEL/p_arch_jump_label_transform/p_arch_jump_label_transform.o \
Initial LKRG-main
2017-10-27 07:29:49 +02:00
src/modules/database/p_database.o \
src/modules/notifiers/p_notifiers.o \
src/modules/self-defense/hiding/p_hiding.o \
src/modules/exploit_detection/p_rb_ed_trees/p_rb_ed_pids/p_rb_ed_pids_tree.o \
src/modules/exploit_detection/syscalls/p_sys_execve/p_sys_execve.o \
[ED] Fix very gentle p_off_count uninit usage after mem cache reuse for the process tracking structure during OFFing process but before update is done. [ED] Add missing execveat syscall available since kernel 3.19+. [ED] Temporarily disable OFF count data corruption validation. [LKRG] Fix handling of ED initializaiton failure and hot plugging CPU not being executed yet.
2018-01-04 15:32:31 +01:00
src/modules/exploit_detection/syscalls/p_sys_execveat/p_sys_execveat.o \
[ED] Add support for call_usermodehelper
2018-02-13 08:06:38 +01:00
src/modules/exploit_detection/syscalls/p_call_usermodehelper/p_call_usermodehelper.o \
[1] Add support for OverlayFS commonly used by docker [2] Change internal flags logic [3] Address changes in subprocess_info structure for kernel 4.18+
2019-04-02 19:28:40 +02:00
src/modules/exploit_detection/syscalls/p_call_usermodehelper_exec/p_call_usermodehelper_exec.o \
Initial LKRG-main
2017-10-27 07:29:49 +02:00
src/modules/exploit_detection/syscalls/p_do_exit/p_do_exit.o \
src/modules/exploit_detection/syscalls/p_do_fork/p_do_fork.o \
src/modules/exploit_detection/syscalls/p_sys_setuid/p_sys_setuid.o \
src/modules/exploit_detection/syscalls/p_sys_setreuid/p_sys_setreuid.o \
src/modules/exploit_detection/syscalls/p_sys_setresuid/p_sys_setresuid.o \
src/modules/exploit_detection/syscalls/p_sys_setfsuid/p_sys_setfsuid.o \
src/modules/exploit_detection/syscalls/p_sys_setgid/p_sys_setgid.o \
src/modules/exploit_detection/syscalls/p_sys_setregid/p_sys_setregid.o \
src/modules/exploit_detection/syscalls/p_sys_setresgid/p_sys_setresgid.o \
src/modules/exploit_detection/syscalls/p_sys_setfsgid/p_sys_setfsgid.o \
1) This is a pretty big change in LKRG which brings support for 4.17+ kernels. 4.17 introduced a new logic how syscall stubs are created and change the name convetions + added new one. If kernel is compiled with CONFIG_IA32_EMULATION (implies CONFIG_COMPAT) and/or CONFIG_X32_X86 (and many distros does that), each syscall might generate up to 4 different stubs as an entry-point. Even 4 stubs exists, not all of them are used :) This of course affects Exploit Detection feature which needs to be aware about execution of critical syscalls, regardless if the entry point was from X32, IA32 or standard stub. Moreover, in the previous kernels, X32 ended up in the standard compat syscall, but now we need to create a separate hooks for the newly generated stubs. Also, now we need to add more syscalls to cover IA32_EMULATION logic - it was not needed in the previous kernels. I think this patch covers all corner cases - I hope I didn't miss anything :) 2) SELinux variables are now accumulated in one structure, before they were just global variables. We are addressing this change in this patch too. 3) Change the INFO messages (log_level=4) in case of error during ED initialization (more useful for debugging). 4) Change a bit the logic for monitoring a setgroups() syscall. This change is compatible across all kernels and can avoid monitoring multiple syscall stubs mentioned at point 1)
2018-08-14 23:50:54 +02:00
src/modules/exploit_detection/syscalls/p_set_current_groups/p_set_current_groups.o \
Initial LKRG-main
2017-10-27 07:29:49 +02:00
src/modules/exploit_detection/syscalls/p_do_init_module/p_do_init_module.o \
[ED] Add Keyring support. Make LKRG fully functional on kernel 3.xx
2017-12-13 01:18:39 +01:00
src/modules/exploit_detection/syscalls/p_sys_finit_module/p_sys_finit_module.o \
Initial LKRG-main
2017-10-27 07:29:49 +02:00
src/modules/exploit_detection/syscalls/p_sys_delete_module/p_sys_delete_module.o \
[ED] Replace 'may_open' with 'generic_permission' function hook. More information about what was the reason behind it, you can find in the source-code comments.
2018-09-18 20:23:44 +02:00
src/modules/exploit_detection/syscalls/p_generic_permission/p_generic_permission.o \
Guard SELinux variables
2017-11-13 09:17:20 +01:00
src/modules/exploit_detection/syscalls/p_sel_write_enforce/p_sel_write_enforce.o \
[ED] Add SECCOMP protection
2017-11-18 23:42:29 +01:00
src/modules/exploit_detection/syscalls/p_seccomp/p_seccomp.o \
[ED] Fix seccomp corner case. Refactor ED XOR p_off cookie code. Add missing commit_creds() entry points.
2017-12-06 07:51:33 +01:00
src/modules/exploit_detection/syscalls/p_sys_unshare/p_sys_unshare.o \
src/modules/exploit_detection/syscalls/p_userns_install/p_userns_install.o \
src/modules/exploit_detection/syscalls/caps/p_sys_capset/p_sys_capset.o \
src/modules/exploit_detection/syscalls/caps/p_cap_task_prctl/p_cap_task_prctl.o \
[ED] Add Keyring support. Make LKRG fully functional on kernel 3.xx
2017-12-13 01:18:39 +01:00
src/modules/exploit_detection/syscalls/keyring/p_key_change_session_keyring/p_key_change_session_keyring.o \
1. [ED] Change how the keyrings are supported 2. [ED] Add new logic for 'off' flag 3. [ED] Re-enable 'off_count' 4. [ED] Add ptrace interception 5. Fix typos...
2018-01-31 22:36:52 +01:00
src/modules/exploit_detection/syscalls/keyring/p_sys_add_key/p_sys_add_key.o \
src/modules/exploit_detection/syscalls/keyring/p_sys_request_key/p_sys_request_key.o \
1. Add new sysctl to silent 'clean' message regardless log_level 2. [ED] Add support for keyctl 3. [ED] Add support for COMPAT
2018-01-18 07:16:43 +01:00
src/modules/exploit_detection/syscalls/keyring/p_sys_keyctl/p_sys_keyctl.o \
1. [ED] Change how the keyrings are supported 2. [ED] Add new logic for 'off' flag 3. [ED] Re-enable 'off_count' 4. [ED] Add ptrace interception 5. Fix typos...
2018-01-31 22:36:52 +01:00
src/modules/exploit_detection/syscalls/p_sys_ptrace/p_sys_ptrace.o \
1. Add new sysctl to silent 'clean' message regardless log_level 2. [ED] Add support for keyctl 3. [ED] Add support for COMPAT
2018-01-18 07:16:43 +01:00
src/modules/exploit_detection/syscalls/compat/p_compat_sys_execve/p_compat_sys_execve.o \
src/modules/exploit_detection/syscalls/compat/p_compat_sys_execveat/p_compat_sys_execveat.o \
src/modules/exploit_detection/syscalls/compat/p_compat_sys_keyctl/p_compat_sys_keyctl.o \
1. [ED] Change how the keyrings are supported 2. [ED] Add new logic for 'off' flag 3. [ED] Re-enable 'off_count' 4. [ED] Add ptrace interception 5. Fix typos...
2018-01-31 22:36:52 +01:00
src/modules/exploit_detection/syscalls/compat/p_compat_sys_ptrace/p_compat_sys_ptrace.o \
1) This is a pretty big change in LKRG which brings support for 4.17+ kernels. 4.17 introduced a new logic how syscall stubs are created and change the name convetions + added new one. If kernel is compiled with CONFIG_IA32_EMULATION (implies CONFIG_COMPAT) and/or CONFIG_X32_X86 (and many distros does that), each syscall might generate up to 4 different stubs as an entry-point. Even 4 stubs exists, not all of them are used :) This of course affects Exploit Detection feature which needs to be aware about execution of critical syscalls, regardless if the entry point was from X32, IA32 or standard stub. Moreover, in the previous kernels, X32 ended up in the standard compat syscall, but now we need to create a separate hooks for the newly generated stubs. Also, now we need to add more syscalls to cover IA32_EMULATION logic - it was not needed in the previous kernels. I think this patch covers all corner cases - I hope I didn't miss anything :) 2) SELinux variables are now accumulated in one structure, before they were just global variables. We are addressing this change in this patch too. 3) Change the INFO messages (log_level=4) in case of error during ED initialization (more useful for debugging). 4) Change a bit the logic for monitoring a setgroups() syscall. This change is compatible across all kernels and can avoid monitoring multiple syscall stubs mentioned at point 1)
2018-08-14 23:50:54 +02:00
src/modules/exploit_detection/syscalls/compat/p_compat_sys_delete_module/p_compat_sys_delete_module.o \
src/modules/exploit_detection/syscalls/compat/p_compat_sys_capset/p_compat_sys_capset.o \
src/modules/exploit_detection/syscalls/compat/p_compat_sys_add_key/p_compat_sys_add_key.o \
src/modules/exploit_detection/syscalls/compat/p_compat_sys_request_key/p_compat_sys_request_key.o \
src/modules/exploit_detection/syscalls/__x32/p_x32_sys_execve/p_x32_sys_execve.o \
src/modules/exploit_detection/syscalls/__x32/p_x32_sys_execveat/p_x32_sys_execveat.o \
src/modules/exploit_detection/syscalls/__x32/p_x32_sys_keyctl/p_x32_sys_keyctl.o \
src/modules/exploit_detection/syscalls/__x32/p_x32_sys_ptrace/p_x32_sys_ptrace.o \
Correctly handle override / revert creds
2018-10-18 02:22:11 +02:00
src/modules/exploit_detection/syscalls/override/p_override_creds/p_override_creds.o \
src/modules/exploit_detection/syscalls/override/p_revert_creds/p_revert_creds.o \
[1] Add support for OverlayFS commonly used by docker [2] Change internal flags logic [3] Address changes in subprocess_info structure for kernel 4.18+
2019-04-02 19:28:40 +02:00
src/modules/exploit_detection/syscalls/override/overlayfs/p_ovl_create_or_link/p_ovl_create_or_link.o \
Introduce pCFI mitigation - new type of mitigation which dynamically adds "poor's man CFI"
2018-12-31 21:52:20 +01:00
src/modules/exploit_detection/syscalls/pCFI/p_mark_inode_dirty/p_mark_inode_dirty.o \
src/modules/exploit_detection/syscalls/pCFI/p_schedule/p_schedule.o \
[1] Introduce a new LKRG sysctl interface lkrg.smep_panic enabled by default. [2] Introduce a new LKRG sysctl interface lkrg.umh_lock disabled by default [3] Add SMEP/WP bit verification in a new various places. [4] Enfore Stack Pointer validation on lookup_fast function
2019-02-21 03:35:27 +01:00
src/modules/exploit_detection/syscalls/pCFI/p___queue_work/p___queue_work.o \
src/modules/exploit_detection/syscalls/pCFI/p_lookup_fast/p_lookup_fast.o \
Initial LKRG-main
2017-10-27 07:29:49 +02:00
src/modules/exploit_detection/p_exploit_detection.o \
src/p_lkrg_main.o
all:
[1] Add Mikhail Klementev's <jollheef@riseup.net> patch for Makefile. [2] Add Mikhail Klementev's <jollheef@riseup.net> patch which creates .gitignore file. [3] Add Mikhail Klementev's <jollheef@riseup.net> patch for missing include file (linux/profile.h) [4] [CI] Change output message format when *_JUMP_LABEL was detected for kernel module's .text section.
2018-09-05 02:43:48 +02:00
# $(MAKE) -C $(P_KERNEL) M=$(P_PWD) modules CONFIG_DEBUG_SECTION_MISMATCH=y
$(MAKE) -C $(P_KERNEL) M=$(P_PWD) modules
Initial LKRG-main
2017-10-27 07:29:49 +02:00
mkdir -p $(P_OUTPUT)
Makefile changes (and clean up)
2018-02-05 04:26:06 +01:00
cp $(P_PWD)/p_lkrg.ko $(P_OUTPUT)
Initial LKRG-main
2017-10-27 07:29:49 +02:00
install:
[1] Add Mikhail Klementev's <jollheef@riseup.net> patch for Makefile. [2] Add Mikhail Klementev's <jollheef@riseup.net> patch which creates .gitignore file. [3] Add Mikhail Klementev's <jollheef@riseup.net> patch for missing include file (linux/profile.h) [4] [CI] Change output message format when *_JUMP_LABEL was detected for kernel module's .text section.
2018-09-05 02:43:48 +02:00
$(MAKE) -C $(P_KERNEL) M=$(P_PWD) modules_install
1. Add LKRG early boot systemd script file. Currently only Systemd init system is supported. There are no technical reasons to not add support for other Init systems. 2. Modify Makefile to support install/unistall option which will deploy/remove systemd boot service. 3. [ED] Add functionality of freezing all user-mode processes during Exploit-Detection initialization.
2019-02-13 01:12:10 +01:00
depmod -a
$(P_PWD)/$(P_BOOTUP_SCRIPT) install
uninstall:
$(P_PWD)/$(P_BOOTUP_SCRIPT) uninstall
Initial LKRG-main
2017-10-27 07:29:49 +02:00
clean:
[1] Add Mikhail Klementev's <jollheef@riseup.net> patch for Makefile. [2] Add Mikhail Klementev's <jollheef@riseup.net> patch which creates .gitignore file. [3] Add Mikhail Klementev's <jollheef@riseup.net> patch for missing include file (linux/profile.h) [4] [CI] Change output message format when *_JUMP_LABEL was detected for kernel module's .text section.
2018-09-05 02:43:48 +02:00
$(MAKE) -C $(P_KERNEL) M=$(P_PWD) clean
Initial LKRG-main
2017-10-27 07:29:49 +02:00
$(RM) Module.markers modules.order
Makefile changes (and clean up)
2018-02-05 04:26:06 +01:00
$(RM) $(P_PWD)/src/modules/kmod/client/kmod/Module.markers
$(RM) $(P_PWD)/src/modules/kmod/client/kmod/modules.order
Initial LKRG-main
2017-10-27 07:29:49 +02:00
$(RM) -rf $(P_OUTPUT)