Commit Graph

539 Commits

Author SHA1 Message Date
Solar Designer 3760e0e1bd Fix support for RHEL 9.0
This was very briefly broken with the previous commit
2023-11-08 19:50:58 +01:00
Adam_pi3 310e85d19c Add support for RHEL 8.8
A new 'text_poke_loc' was backported to RHEL 8.8+. This commit brings
the support for such kernels as well as addresses the #295 problem.
2023-11-08 19:39:30 +01:00
Solar Designer ea1454c28d README: More complete "Build requirements" 2023-10-25 22:56:34 +02:00
Solar Designer d5077fde52 RPM:
- Use weak-modules if available so that on RHEL and its rebuilds the same LKRG
  package build works across different kABI-compatible kernel revisions/builds

- Drop 32-bit x86 from ExclusiveArch since recent RHEL lacks such kernel-devel
2023-10-25 22:28:13 +02:00
Adam_pi3 ee41d81599 kINT: Fix synchronization problem
The reported problem with integrity verification on ARM64 (#269)
is a result of a very tight race condition with tracepoints.
Changes which simplify synchronization with JUMP_LABEL engine:
f98da1b17c
affected differently ARM64 platform which made such race possible.
However, potentially the same race problem may exist on x86 and
this commit fixes it and should address #269
2023-10-25 14:56:11 +02:00
Adam_pi3 687c4790cd
kINT: P_LKRG_JUMP_LABEL_STEXT_DEBUG: bump log level
... for better debuggability. If non standard P_LKRG_JUMP_LABEL_STEXT_DEBUG
is enabled, it means that LKRG is being actively debugged.
In that case, we want to avoid unnecessary noise.
2023-10-24 09:46:15 +00:00
Vitaly Chikunov 617cc87a40 CI: mainline: Change base URL
https://kernel.ubuntu.com/~kernel-ppa/mainline/daily/ reporting:
  <title>301 Moved Permanently</title>
  <p>The document has moved <a
  href="https://kernel.ubuntu.com/mainline/daily/">here</a>.</p>

Fixes: https://github.com/lkrg-org/lkrg/issues/292
Signed-off-by: Vitaly Chikunov <vt@altlinux.org>
2023-10-12 15:29:03 +02:00
Vitaly Chikunov 73840d7b91 CI: mkosi: Fix mainline boot on Ubuntu mantic
Ubuntu removed 'systemd-gpt-auto-generator' from systemd_253.5-1ubuntu5,
causing dracut to be unable to find the root partition without
assistance. It appears that specifying the root label could be a good
solution.

Fixes: https://github.com/lkrg-org/lkrg/issues/287
Signed-off-by: Vitaly Chikunov <vt@altlinux.org>
2023-09-20 15:33:02 +02:00
Solar Designer 91d3da9ece RPM: Use kernel build directory corresponding to kernel-devel 2023-09-14 22:09:33 +02:00
Solar Designer 5dc5cfea1f LKRG 0.9.7 2023-09-14 04:38:28 +02:00
Solar Designer db35e0e207 Add RPM spec file for Red Hat'ish distros 2023-09-14 03:00:43 +02:00
Solar Designer 5cfc92c0a3 CHANGES, README: Update with major changes since 0.9.6 2023-09-11 01:03:23 +02:00
Vitaly Chikunov 544479d704 CI: Update workflows to use latest versions of the actions
This should fix the warning:

  The following actions uses node12 which is deprecated and will be
  forced to run on node16: actions/checkout@v2. For more info:
  https://github.blog/changelog/2023-06-13-github-actions-all-actions-will-run-on-node16-instead-of-node12-by-default/

Signed-off-by: Vitaly Chikunov <vt@altlinux.org>
2023-08-26 11:46:31 +02:00
Vitaly Chikunov 1ab0d2e983 CI: Change openSUSE URLs to their official docker registry
Message on https://hub.docker.com/_/opensuse/

  DEPRECATION NOTICE
  These images were removed in favor of the opensuse/leap and
  opensuse/tumbleweed images provided and maintained by the openSUSE
  Project release team.

Signed-off-by: Vitaly Chikunov <vt@altlinux.org>
2023-08-25 19:52:21 +02:00
Vitaly Chikunov 69e682b37b CI: Fix docker build on opensuse/tumbleweed
This now requires gawk installed.

Error message:

  make -C /lib/modules/6.4.11-1-default/build M=/__w/lkrg/lkrg modules
  /bin/sh: line 1: awk: command not found
  make[2]: *** [/usr/src/linux-6.4.11-1/scripts/Makefile.build:262: /__w/lkrg/lkrg/lkrg.mod] Error 127
  make[2]: *** Deleting file '/__w/lkrg/lkrg/lkrg.mod'
  make[2]: *** Waiting for unfinished jobs....
    CC [M]  /__w/lkrg/lkrg/src/modules/ksyms/p_resolve_ksym.o
  /usr/src/linux-6.4.11-1/scripts/check-local-export: line 25: awk: command not found
  /usr/src/linux-6.4.11-1/scripts/check-local-export: nm failed
  make[2]: *** [/usr/src/linux-6.4.11-1/scripts/Makefile.build:253: /__w/lkrg/lkrg/src/modules/ksyms/p_resolve_ksym.o] Error 143
  make[2]: *** Deleting file '/__w/lkrg/lkrg/src/modules/ksyms/p_resolve_ksym.o'
  make[1]: *** [../../../linux-6.4.11-1/Makefile:2049: /__w/lkrg/lkrg] Error 2
  make: *** [Makefile💯 all] Error 2

Signed-off-by: Vitaly Chikunov <vt@altlinux.org>
2023-08-25 19:52:21 +02:00
Vitaly Chikunov 47191f9b29 CI: mkosi-mainline: Workaround 'dpkg: error: dpkg frontend lock'
Mkosi's own dracut hook, which is triggered from `dpkg -i`, calls
`dpkg-reconfigure` causing dpkg frontend lock conflict. But `initrd.img`
is generated correctly. Workaround by ignoring `dpkg-reconfigure` errors
in the hook.

  dpkg: error: dpkg frontend lock was locked by another process with pid 5
  Note: removing the lock file is always wrong, can damage the locked area
  and the entire system. See <https://wiki.debian.org/Teams/Dpkg/FAQ#db-lock>.
  run-parts: /etc/kernel/postinst.d/zz-systemd-boot exited with return code 2

Link: https://github.com/lkrg-org/lkrg/issues/283
Signed-off-by: Vitaly Chikunov <vt@altlinux.org>
2023-08-03 12:30:14 +02:00
Solar Designer 55d28c9f23 Stop using register_sysctl_table()
This is needed for post-6.4 kernels.

Fixes #280
2023-07-15 19:45:48 -08:00
Valentin Obst a78f3e5f3c README: Add remark about lkrg-bootup.sh to DKMS section 2023-07-11 14:23:20 +02:00
Valentin Obst 0f13b59d09 make bootup scripts independent of cwd, add usage and root checks 2023-07-11 14:23:20 +02:00
Solar Designer 64adf26f22 LICENSE, debian/copyright: Correct copyright years 2023-07-10 20:42:55 +02:00
Patrick Schleizer 563dc9a09c Update lkrg-dkms.lintian-overrides for Debian bookworm 2023-06-13 00:55:58 +00:00
Patrick Schleizer 306c430aa7 Update copyright 2023-06-13 00:55:08 +00:00
fluidog 001768de0c Simplify the use of P_SYM_INIT() 2023-05-19 14:09:29 +02:00
Adam_pi3 3d8e52e90b
Add support for Linux kernel post-6.3
Linux kernel post-6.3 modified the 'struct module' and introduced a new
substructure describing module's memory layout. Additionally, the logic for
dynamic debug (ddebug) has been modified and some of the functions which LKRG
uses are no longer exported. This commit adopts to these post-6.3 changed and
addresses #267
2023-05-03 00:47:51 +00:00
Solar Designer f37b478d25 p_exploit_detection.c: Add static keywords to ease code review 2023-03-19 15:18:55 +01:00
Vladimir D. Seleznev eaf8347646 RHEL 9.2 5.14.0-248.el9 aarch64: rename stackframe to unwind_state 2023-02-11 06:39:24 +00:00
RageLtMan ef52dec6e1 Add UMH modprobe path for Arch Linux init context
Address #258 by adding /usr/bin/modprobe to the UMH allow-list.
2023-02-03 06:48:33 +00:00
Adam_pi3 0e46fc41a5
Add support for RHEL 9.1
Starting from kernel 5.14.0-162.12.1 (RHEL 9.1), a new 'text_poke_loc'
structure is used. This commit brings the support for such kernels as
well as addresses the #256 problem
2023-02-02 03:03:35 +00:00
Solar Designer 0fdb556076 kINT: P_LKRG_JUMP_LABEL_STEXT_DEBUG: Fix sign extension bug 2023-01-30 22:40:20 +01:00
Vitaly Chikunov 87159cd74a CI: Use latest usable mkosi v14
Main (and only) branch of mkosi is switching to bleeding edge systemd
tools which are not available on Ubuntu we are testing on. Instead of
migrating off mkosi to something else, we can still use some previously
working tag such as `v14'.

Fixes: https://github.com/lkrg-org/lkrg/issues/253
Signed-off-by: Vitaly Chikunov <vt@altlinux.org>
2022-12-25 00:51:26 +01:00
Solar Designer 2481b3e2dd LKRG 0.9.6 2022-12-14 17:05:39 +01:00
Solar Designer 2ab926d202 CHANGES: Document the new kretprobe test 2022-12-09 19:07:56 +01:00
Adam_pi3 26f36ed495 Add a kprobe verification functionality
Add a new logic to the integrity verification routine verifying if the
kprobes are enabled and correctly run.
This commit makes kprobe verification functionality as an independent
module invoked by integrity verification routine as well as during
initialization to make sure kprobes are enabled and run as intended
(otherwise, initialization fails).
2022-12-04 21:31:22 +01:00
Solar Designer 7db7483880 CHANGES, README: Update with major changes since 0.9.5 2022-11-22 19:22:23 +01:00
Adam_pi3 1fc5312223 Add synchronization logic around sysctl interface
This commit fixes the race problem between 2+ concurrent sysctl updates.
It is part of the work related to #204
2022-11-19 19:55:46 +01:00
redp 2cd2c2bc00 add get_kprobe_maxactive to remaining kprobes
Co-authored-by: Solar Designer <solar@openwall.com>
2022-11-10 21:58:02 +01:00
redp 6736d568dc kretprobes.maxactive should depend on number of cores
Co-authored-by: Solar Designer <solar@openwall.com>
2022-11-10 21:58:02 +01:00
Solar Designer 3f7af09f5b UMH: Allow /usr/libexec/abrt-hook-ccpp for older Red Hat distros 2022-11-10 21:57:48 +01:00
Solar Designer fc3545696b pINT: Make the real_cred check in p_cmp_tasks() unconditional
Fixes #240
2022-11-05 18:39:49 +01:00
Adam_pi3 ad03367344 Add support for new RHEL8.6+ kernels
Starting from RHEL8.6 4.18.0-372.32.1.el8_6 kernel struct text_poke_loc
is not exported and we need to correctly take this into account.
Previous RHEL8.6 kernels did not hide this structure so we need to find
some ways to disinguish them. We do it in this commit and it should fix #236
2022-11-05 18:38:12 +01:00
Vladimir D. Seleznev a4e5c00f13 Add support for Kernel 5.19+ for aarch64
Since Linux Kernel 5.19 struct stackframe has been renamed to struct
unwind_state for arm64:

torvalds/linux@e9d75a0ba8
2022-11-05 14:15:44 +01:00
Vladimir D. Seleznev 8fbdbda372 Add support for RHEL 9.2 kernel
Reported-by: Alexey Gladkov <legion@altlinux.ru>
Signed-off-by: Vladimir D. Seleznev <vseleznv@altlinux.org>
2022-10-31 21:24:05 +01:00
Solar Designer 4da9ded1a2 CI: Re-enable AArch64 test, but without BTI 2022-10-29 16:06:17 +02:00
Solar Designer f32f627950 Simplify our get_random_long() wrapper (only used with old kernels)
Fixes #234
2022-10-17 22:20:20 +02:00
Solar Designer 11553ec0df Notifiers: Fix typo in the value of P_M_SS_MORE_OFTEN_RATE
Noticed by Jason A. Donenfeld
2022-10-17 22:20:20 +02:00
Solar Designer 2241a32231 Don't depend on get_random_int(), which Linux 6.1+ dropped
Fixes #233
2022-10-17 22:20:20 +02:00
Adam_pi3 717137dbd2
Remove IOMMU verification on kernel 5.19+
IOMMU table infrastructure was removed by this commit
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=78013eaadf696d2105982abb4018fbae394ca08f

which breaks the way how LKRG could verify it.
This commit skips the IOMMU verification starting from kernels 5.19+
and fixes #226
2022-09-25 00:09:01 +00:00
mrl5 d7f079baa1 fix: umh - allow openrc cgroup release agent [#230]
closes #230
2022-09-11 03:34:53 +00:00
Vitaly Chikunov b56b8758af CI: mkosi: Restore loading LKRG module from initrd
For (non-grub) BLS boot - install generated by Dracut initrd into
systemd-boot loader entry.

Man pages for curious details: systemd-boot(7), bootctl(1),
kernel-install(8).

Link: https://github.com/lkrg-org/lkrg/pull/228#issuecomment-1235403740
Fixes: db42541 ("CI: mkosi: Do not assume grub is installed")
Signed-off-by: Vitaly Chikunov <vt@altlinux.org>
2022-09-04 13:41:59 +02:00
Vitaly Chikunov db42541477 CI: mkosi: Do not assume grub is installed
mkosi' "--boot-protocols is deprecated and has no effect anymore", thus
do not assume we will be booting using grub/bios.

Fixes: https://github.com/lkrg-org/lkrg/issues/227
Signed-off-by: Vitaly Chikunov <vt@altlinux.org>
2022-09-02 13:41:33 +02:00