Openwall GNU/*/Linux - a small security-enhanced Linux distro for servers
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Mon, 5 Feb 2018 23:50:58 +0100
From: Adam Zabrocki <pi3@....com.pl>
To: lkrg-users@...ts.openwall.com
Subject: Re: LKRG Debian jessie

Hi,

On Mon, Feb 05, 2018 at 06:01:31PM +0100, Xavier Sheperd wrote:
> Hi guys,
> 
> Thank you for all the hard work you put in this project.
> 

Thank you for your appreciation :)


> I'm trying to install LKRG on a Debian Jessie machine with these specs (some
> output stripped):
> # uname -a
> Linux marcelini 3.16.0-5-amd64 #1 SMP Debian 3.16.51-3+deb8u1 (2018-01-08) x86_64 GNU/Linux
> 
> # cat /etc/os-release
> PRETTY_NAME="Debian GNU/Linux 8 (jessie)"
> NAME="Debian GNU/Linux"
> VERSION_ID="8"
> VERSION="8 (jessie)"
> 
> # gcc --version
> gcc (Debian 4.9.2-10) 4.9.2
> 

Debian is using very stripped kernel any a lot of functionality is not exposed 
even to the kernel modules (like LKRG is). Their kernel is pretty hard to work 
on but it is possible to customize LKRG and force it to run.


> On first attempt the module compiles but it fails to load, yielding the
> message:
> 
> p_lkrg: Unknown symbol usb_unregister_notify (err 0)
> p_lkrg: Unknown symbol usb_register_notify (err 0)
> 
> After removing the calls to usb_register_notify and usb_unregister_notify[0],
> the module builds with a warning[1] and I get a "Can't find 'selinux_enforcing'
> variable" error[2].
> 
> Any hints are greatly appreciated.
> 
> Xavier
> 

Some of the notifiers are being removed from the kernel (or at least symbols) 
by custom distro patches but without changing the #ifdef definitions. One of 
the example could be not exposing SELinux variables but still keeping #ifdef 
SELINUX not-touched. This is what heppend in you case. Same might happend to 
the USB notifiers and you did a correct work to 'mask' them.

It looks like you're using experimental branch and as branch name says it's 
'experimental' so please take this into account ;-) Some of the recent "main" 
branch changes I didn't have time to backport into "experimental" branch yet. 
But this is in my TODO list.

I've prepared very 'hacky' patch for LKRG which should work on Debian 8 but I 
won't give any warranty of it. But you can use it to play with LKRG 
experimental branch. I believe if you could switch to different distro which do 
not use as stripped kernel you won't have as many problem. The 'hackish' patch 
commenting out these symbols which my debian instance doesn't see + extract 
necessary metadata from the LKRG  module itself to force it to run under debian 
kernel even they don't expose what LKRG requires (but they should!).

Please find out the hacky patch in attachment and apply it on the top of your 
changes.

Thanks,
Adam

> [0] usb_notifier.patch 
> [1] build.log
> [2] kern.log

> make -C /lib/modules/3.16.0-5-amd64/build M=/root/lkrg-experimental modules
> make[1]: Entering directory '/usr/src/linux-headers-3.16.0-5-amd64'
> make[1]: Entering directory `/usr/src/linux-headers-3.16.0-5-amd64'
>   CC [M]  /root/lkrg-experimental/src/modules/ksyms/p_resolve_ksym.o
>   CC [M]  /root/lkrg-experimental/src/modules/hashing/p_crypto_sha1.o
>   CC [M]  /root/lkrg-experimental/src/modules/hashing/p_lkrg_fast_hash.o
>   CC [M]  /root/lkrg-experimental/src/modules/wrap/p_struct_wrap.o
>   CC [M]  /root/lkrg-experimental/src/modules/integrity_timer/p_integrity_timer.o
>   CC [M]  /root/lkrg-experimental/src/modules/kmod/p_kmod.o
>   CC [M]  /root/lkrg-experimental/src/modules/database/CPU.o
>   CC [M]  /root/lkrg-experimental/src/modules/database/arch/x86/IDT_MSR_CRx.o
>   CC [M]  /root/lkrg-experimental/src/modules/database/p_database.o
>   CC [M]  /root/lkrg-experimental/src/modules/notifiers/p_notifiers.o
>   CC [M]  /root/lkrg-experimental/src/modules/self-defense/hiding/p_hiding.o
>   CC [M]  /root/lkrg-experimental/src/modules/protected_features/p_rb_trees/p_rb_pids/p_rb_pids_tree.o
> /root/lkrg-experimental/src/modules/notifiers/p_notifiers.c:90:30: warning: ‘p_usb_notifier_nb’ defined but not used [-Wunused-variable]
>  static struct notifier_block p_usb_notifier_nb = {
>                               ^
>   CC [M]  /root/lkrg-experimental/src/modules/protected_features/p_rb_trees/p_rb_inodes/p_rb_inodes_tree.o
>   CC [M]  /root/lkrg-experimental/src/modules/protected_features/p_rb_trees/p_rb_p_inodes/p_rb_p_inodes_tree.o
>   CC [M]  /root/lkrg-experimental/src/modules/protected_features/syscalls/p_sys_ptrace/p_sys_ptrace.o
>   CC [M]  /root/lkrg-experimental/src/modules/protected_features/syscalls/p_sys_execve/p_sys_execve.o
>   CC [M]  /root/lkrg-experimental/src/modules/protected_features/syscalls/p_sys_execveat/p_sys_execveat.o
>   CC [M]  /root/lkrg-experimental/src/modules/protected_features/syscalls/p_do_exit/p_do_exit.o
>   CC [M]  /root/lkrg-experimental/src/modules/protected_features/syscalls/p_do_fork/p_do_fork.o
>   CC [M]  /root/lkrg-experimental/src/modules/protected_features/syscalls/p_signal_wrappers/p_sys_tgkill/p_sys_tgkill.o
>   CC [M]  /root/lkrg-experimental/src/modules/protected_features/syscalls/p_signal_wrappers/p_sys_tkill/p_sys_tkill.o
>   CC [M]  /root/lkrg-experimental/src/modules/protected_features/syscalls/p_signal_wrappers/p_sys_kill/p_sys_kill.o
>   CC [M]  /root/lkrg-experimental/src/modules/protected_features/syscalls/p_signal_wrappers/p_sys_rt_sigqueueinfo/p_sys_rt_sigqueueinfo.o
>   CC [M]  /root/lkrg-experimental/src/modules/protected_features/syscalls/p_signal_wrappers/p_sys_rt_tgsigqueueinfo/p_sys_rt_tgsigqueueinfo.o
>   CC [M]  /root/lkrg-experimental/src/modules/protected_features/protected_files_func/p_may_open/p_may_open.o
>   CC [M]  /root/lkrg-experimental/src/modules/protected_features/protected_process_func/p_write_enabled_file_bool/p_write_enabled_file_bool.o
>   CC [M]  /root/lkrg-experimental/src/modules/protected_features/protected_process_func/p_process_vm_rw/p_process_vm_rw.o
>   CC [M]  /root/lkrg-experimental/src/modules/protected_features/protected_process_func/p_kprobe_seq_start/p_kprobe_seq_start.o
>   CC [M]  /root/lkrg-experimental/src/modules/protected_features/syscalls/compat/p_compat_sys_execve/p_compat_sys_execve.o
>   CC [M]  /root/lkrg-experimental/src/modules/protected_features/syscalls/compat/p_compat_sys_execveat/p_compat_sys_execveat.o
>   CC [M]  /root/lkrg-experimental/src/modules/protected_features/syscalls/compat/p_compat_sys_ptrace/p_compat_sys_ptrace.o
>   CC [M]  /root/lkrg-experimental/src/modules/protected_features/syscalls/compat/p_compat_process_vm_rw/p_compat_process_vm_rw.o
>   CC [M]  /root/lkrg-experimental/src/modules/protected_features/syscalls/compat/p_compat_sys_rt_sigqueueinfo/p_compat_sys_rt_sigqueueinfo.o
>   CC [M]  /root/lkrg-experimental/src/modules/protected_features/syscalls/compat/p_compat_sys_rt_tgsigqueueinfo/p_compat_sys_rt_tgsigqueueinfo.o
>   CC [M]  /root/lkrg-experimental/src/modules/protected_features/p_protected_API.o
>   CC [M]  /root/lkrg-experimental/src/modules/exploit_detection/p_rb_ed_trees/p_rb_ed_pids/p_rb_ed_pids_tree.o
>   CC [M]  /root/lkrg-experimental/src/modules/exploit_detection/syscalls/p_sys_setuid/p_sys_setuid.o
>   CC [M]  /root/lkrg-experimental/src/modules/exploit_detection/syscalls/p_sys_setreuid/p_sys_setreuid.o
>   CC [M]  /root/lkrg-experimental/src/modules/exploit_detection/syscalls/p_sys_setresuid/p_sys_setresuid.o
>   CC [M]  /root/lkrg-experimental/src/modules/exploit_detection/syscalls/p_sys_setfsuid/p_sys_setfsuid.o
>   CC [M]  /root/lkrg-experimental/src/modules/exploit_detection/syscalls/p_sys_setgid/p_sys_setgid.o
>   CC [M]  /root/lkrg-experimental/src/modules/exploit_detection/syscalls/p_sys_setregid/p_sys_setregid.o
>   CC [M]  /root/lkrg-experimental/src/modules/exploit_detection/syscalls/p_sys_setresgid/p_sys_setresgid.o
>   CC [M]  /root/lkrg-experimental/src/modules/exploit_detection/syscalls/p_sys_setfsgid/p_sys_setfsgid.o
>   CC [M]  /root/lkrg-experimental/src/modules/exploit_detection/syscalls/p_sys_setgroups/p_sys_setgroups.o
>   CC [M]  /root/lkrg-experimental/src/modules/exploit_detection/syscalls/p_do_init_module/p_do_init_module.o
>   CC [M]  /root/lkrg-experimental/src/modules/exploit_detection/syscalls/p_sys_finit_module/p_sys_finit_module.o
>   CC [M]  /root/lkrg-experimental/src/modules/exploit_detection/syscalls/p_sys_delete_module/p_sys_delete_module.o
>   CC [M]  /root/lkrg-experimental/src/modules/exploit_detection/syscalls/p_sel_write_enforce/p_sel_write_enforce.o
>   CC [M]  /root/lkrg-experimental/src/modules/exploit_detection/syscalls/p_seccomp/p_seccomp.o
>   CC [M]  /root/lkrg-experimental/src/modules/exploit_detection/syscalls/p_sys_unshare/p_sys_unshare.o
>   CC [M]  /root/lkrg-experimental/src/modules/exploit_detection/syscalls/p_userns_install/p_userns_install.o
>   CC [M]  /root/lkrg-experimental/src/modules/exploit_detection/syscalls/caps/p_sys_capset/p_sys_capset.o
>   CC [M]  /root/lkrg-experimental/src/modules/exploit_detection/syscalls/caps/p_cap_task_prctl/p_cap_task_prctl.o
>   CC [M]  /root/lkrg-experimental/src/modules/exploit_detection/syscalls/keyring/p_lookup_user_key/p_lookup_user_key.o
>   CC [M]  /root/lkrg-experimental/src/modules/exploit_detection/syscalls/keyring/p_key_change_session_keyring/p_key_change_session_keyring.o
>   CC [M]  /root/lkrg-experimental/src/modules/exploit_detection/syscalls/keyring/p_sys_keyctl/p_sys_keyctl.o
>   CC [M]  /root/lkrg-experimental/src/modules/exploit_detection/syscalls/compat/p_compat_sys_keyctl/p_compat_sys_keyctl.o
>   CC [M]  /root/lkrg-experimental/src/modules/exploit_detection/p_exploit_detection.o
>   CC [M]  /root/lkrg-experimental/src/p_lkrg_main.o
>   LD [M]  /root/lkrg-experimental/p_lkrg.o
>   Building modules, stage 2.
>   MODPOST 1 modules
>   CC      /root/lkrg-experimental/p_lkrg.mod.o
>   LD [M]  /root/lkrg-experimental/p_lkrg.ko
> make[1]: Leaving directory '/usr/src/linux-headers-3.16.0-5-amd64'
> make -C /lib/modules/3.16.0-5-amd64/build M=/root/lkrg-experimental/src/modules/kmod/client/kmod modules
> make[1]: Entering directory '/usr/src/linux-headers-3.16.0-5-amd64'
> make[1]: Entering directory `/usr/src/linux-headers-3.16.0-5-amd64'
>   CC [M]  /root/lkrg-experimental/src/modules/kmod/client/kmod/src/p_lkrg_cli.o
>   LD [M]  /root/lkrg-experimental/src/modules/kmod/client/kmod/p_lkrg_kmod_cli.o
>   Building modules, stage 2.
>   MODPOST 1 modules
>   CC      /root/lkrg-experimental/src/modules/kmod/client/kmod/p_lkrg_kmod_cli.mod.o
>   LD [M]  /root/lkrg-experimental/src/modules/kmod/client/kmod/p_lkrg_kmod_cli.ko
> make[1]: Leaving directory '/usr/src/linux-headers-3.16.0-5-amd64'
> gcc -Wall -ggdb src/modules/kmod/client/cli/p_lkrg-client.c -o p_lkrg-client
> mkdir -p "output/client/cli"
> mkdir -p "output/client/kmod"
> mv /root/lkrg-experimental/p_lkrg.ko "output"
> mv /root/lkrg-experimental/p_lkrg-client "output/client/cli"
> mv /root/lkrg-experimental/src/modules/kmod/client/kmod/"p_lkrg_kmod_cli.ko" "output/client/kmod"

> Feb  5 15:28:19 marcelini kernel: [53511532.800445] [p_lkrg] Loading LKRG...
> Feb  5 15:28:19 marcelini kernel: [53511532.801229] [p_lkrg] Entering function <get_kallsyms_address>
> Feb  5 15:28:19 marcelini kernel: [53511532.802563] [p_lkrg] kallsyms_on_each_symbol() returned => 0x810dc4f0
> Feb  5 15:28:19 marcelini kernel: [53511532.803216] [p_lkrg] Leaving function <get_kallsyms_address> (p_ret => 0)
> Feb  5 15:28:19 marcelini kernel: [53511532.803902] [p_lkrg] Entering function <p_exploit_detection_init>
> Feb  5 15:28:19 marcelini kernel: [53511532.811517] [p_lkrg] [ED] ERROR: Can't find 'selinux_enforcing' variable :( Exiting...
> Feb  5 15:28:19 marcelini kernel: [53511532.812192] [p_lkrg] Leaving function <p_exploit_detection_init> (p_ret => -1)
> Feb  5 15:28:19 marcelini kernel: [53511532.812858] [p_lkrg] Can't initialize exploit detection features! Exiting...
> Feb  5 15:28:19 marcelini kernel: [53511532.813524] [p_lkrg] Entering function <p_protected_features_exit>
> Feb  5 15:28:19 marcelini kernel: [53511532.814196] [p_lkrg] Entering function <p_uninstall_sys_ptrace_hook>
> Feb  5 15:28:19 marcelini kernel: [53511532.814852] [p_lkrg] [kretprobe] <sys_ptrace> at 0x          (null) is NOT installed
> Feb  5 15:28:19 marcelini kernel: [53511532.814853] [p_lkrg] Leaving function <p_uninstall_sys_ptrace_hook>
> Feb  5 15:28:19 marcelini kernel: [53511532.815531] [p_lkrg] Entering function <p_uninstall_sys_execve_hook>
> Feb  5 15:28:19 marcelini kernel: [53511532.816185] [p_lkrg] [kretprobe] <sys_execve> at 0x          (null) is NOT installed
> Feb  5 15:28:19 marcelini kernel: [53511532.816187] [p_lkrg] Leaving function <p_uninstall_sys_execve_hook>
> Feb  5 15:28:19 marcelini kernel: [53511532.816835] [p_lkrg] Entering function <p_uninstall_do_exit_hook>
> Feb  5 15:28:19 marcelini kernel: [53511532.817481] [p_lkrg] [kretprobe] <do_exit> at 0x          (null) is NOT installed
> Feb  5 15:28:19 marcelini kernel: [53511532.817482] [p_lkrg] Leaving function <p_uninstall_do_exit_hook>
> Feb  5 15:28:19 marcelini kernel: [53511532.818135] [p_lkrg] Entering function <p_uninstall_do_fork_hook>
> Feb  5 15:28:19 marcelini kernel: [53511532.818780] [p_lkrg] [kretprobe] <do_fork> at 0x          (null) is NOT installed
> Feb  5 15:28:19 marcelini kernel: [53511532.818782] [p_lkrg] Leaving function <p_uninstall_do_fork_hook>
> Feb  5 15:28:19 marcelini kernel: [53511532.819424] [p_lkrg] Entering function <p_uninstall_sys_tgkill_hook>
> Feb  5 15:28:19 marcelini kernel: [53511532.820093] [p_lkrg] [kretprobe] <sys_tgkill> at 0x          (null) is NOT installed
> Feb  5 15:28:19 marcelini kernel: [53511532.820095] [p_lkrg] Leaving function <p_uninstall_sys_tgkill_hook>
> Feb  5 15:28:19 marcelini kernel: [53511532.820739] [p_lkrg] Entering function <p_uninstall_sys_tkill_hook>
> Feb  5 15:28:19 marcelini kernel: [53511532.821386] [p_lkrg] [kretprobe] <sys_tkill> at 0x          (null) is NOT installed
> Feb  5 15:28:19 marcelini kernel: [53511532.821387] [p_lkrg] Leaving function <p_uninstall_sys_tkill_hook>
> Feb  5 15:28:19 marcelini kernel: [53511532.822025] [p_lkrg] Entering function <p_uninstall_sys_kill_hook>
> Feb  5 15:28:19 marcelini kernel: [53511532.822658] [p_lkrg] [kretprobe] <sys_kill> at 0x          (null) is NOT installed
> Feb  5 15:28:19 marcelini kernel: [53511532.822659] [p_lkrg] Leaving function <p_uninstall_sys_kill_hook>
> Feb  5 15:28:19 marcelini kernel: [53511532.823289] [p_lkrg] Entering function <p_uninstall_sys_rt_sigqueueinfo_hook>
> Feb  5 15:28:19 marcelini kernel: [53511532.823953] [p_lkrg] [kretprobe] <sys_rt_sigqueueinfo> at 0x          (null) is NOT installed
> Feb  5 15:28:19 marcelini kernel: [53511532.823954] [p_lkrg] Leaving function <p_uninstall_sys_rt_sigqueueinfo_hook>
> Feb  5 15:28:19 marcelini kernel: [53511532.824592] [p_lkrg] Entering function <p_uninstall_sys_rt_tgsigqueueinfo_hook>
> Feb  5 15:28:19 marcelini kernel: [53511532.825227] [p_lkrg] [kretprobe] <sys_rt_tgsigqueueinfo> at 0x          (null) is NOT installed
> Feb  5 15:28:19 marcelini kernel: [53511532.825228] [p_lkrg] Leaving function <p_uninstall_sys_rt_tgsigqueueinfo_hook>
> Feb  5 15:28:19 marcelini kernel: [53511532.825862] [p_lkrg] Entering function <p_uninstall_may_open_hook>
> Feb  5 15:28:19 marcelini kernel: [53511532.826490] [p_lkrg] [kretprobe] <may_open> at 0x          (null) is NOT installed
> Feb  5 15:28:19 marcelini kernel: [53511532.826491] [p_lkrg] Leaving function <p_uninstall_may_open_hook>
> Feb  5 15:28:19 marcelini kernel: [53511532.827126] [p_lkrg] Entering function <p_uninstall_write_enabled_file_bool_hook>
> Feb  5 15:28:19 marcelini kernel: [53511532.827783] [p_lkrg] [kretprobe] <write_enabled_file_bool> at 0x          (null) is NOT installed
> Feb  5 15:28:19 marcelini kernel: [53511532.827785] [p_lkrg] Leaving function <p_uninstall_write_enabled_file_bool_hook>
> Feb  5 15:28:19 marcelini kernel: [53511532.828422] [p_lkrg] Entering function <p_uninstall_process_vm_rw_hook>
> Feb  5 15:28:19 marcelini kernel: [53511532.829057] [p_lkrg] [kretprobe] <process_vm_rw> at 0x          (null) is NOT installed
> Feb  5 15:28:19 marcelini kernel: [53511532.829058] [p_lkrg] Leaving function <p_uninstall_process_vm_rw_hook>
> Feb  5 15:28:19 marcelini kernel: [53511532.829695] [p_lkrg] Entering function <p_uninstall_compat_sys_execve_hook>
> Feb  5 15:28:19 marcelini kernel: [53511532.830352] [p_lkrg] [kretprobe] <compat_sys_execve> at 0x          (null) is NOT installed
> Feb  5 15:28:19 marcelini kernel: [53511532.830353] [p_lkrg] Leaving function <p_uninstall_compat_sys_execve_hook>
> Feb  5 15:28:19 marcelini kernel: [53511532.831013] [p_lkrg] Entering function <p_uninstall_compat_sys_ptrace_hook>
> Feb  5 15:28:19 marcelini kernel: [53511532.831693] [p_lkrg] [kretprobe] <compat_sys_ptrace> at 0x          (null) is NOT installed
> Feb  5 15:28:19 marcelini kernel: [53511532.831695] [p_lkrg] Leaving function <p_uninstall_compat_sys_ptrace_hook>
> Feb  5 15:28:19 marcelini kernel: [53511532.832355] [p_lkrg] Entering function <p_uninstall_compat_process_vm_rw_hook>
> Feb  5 15:28:19 marcelini kernel: [53511532.833019] [p_lkrg] [kretprobe] <compat_process_vm_rw> at 0x          (null) is NOT installed
> Feb  5 15:28:19 marcelini kernel: [53511532.833020] [p_lkrg] Leaving function <p_uninstall_compat_process_vm_rw_hook>
> Feb  5 15:28:19 marcelini kernel: [53511532.833686] [p_lkrg] Entering function <p_uninstall_compat_sys_rt_sigqueueinfo_hook>
> Feb  5 15:28:19 marcelini kernel: [53511532.834366] [p_lkrg] [kretprobe] <compat_sys_rt_sigqueueinfo> at 0x          (null) is NOT installed
> Feb  5 15:28:19 marcelini kernel: [53511532.834368] [p_lkrg] Leaving function <p_uninstall_compat_sys_rt_sigqueueinfo_hook>
> Feb  5 15:28:19 marcelini kernel: [53511532.835042] [p_lkrg] Entering function <p_uninstall_compat_sys_rt_tgsigqueueinfo_hook>
> Feb  5 15:28:19 marcelini kernel: [53511532.835749] [p_lkrg] [kretprobe] <compat_sys_rt_tgsigqueueinfo> at 0x          (null) is NOT installed
> Feb  5 15:28:19 marcelini kernel: [53511532.835755] [p_lkrg] Leaving function <p_uninstall_compat_sys_rt_tgsigqueueinfo_hook>
> Feb  5 15:28:19 marcelini kernel: [53511532.836434] [p_lkrg] Entering function <p_delete_rb_pids>
> Feb  5 15:28:19 marcelini kernel: [53511532.837103] [p_lkrg] Leaving function <p_delete_rb_pids>
> Feb  5 15:28:19 marcelini kernel: [53511532.837766] [p_lkrg] kmem_cache "protected_pids" destroyed!
> Feb  5 15:28:19 marcelini kernel: [53511532.837767] [p_lkrg] Entering function <p_delete_rb_inodes>
> Feb  5 15:28:19 marcelini kernel: [53511532.838442] [p_lkrg] Leaving function <p_delete_rb_inodes>
> Feb  5 15:28:19 marcelini kernel: [53511532.839107] [p_lkrg] kmem_cache "protected_inodes" destroyed!
> Feb  5 15:28:19 marcelini kernel: [53511532.839108] [p_lkrg] Entering function <p_delete_rb_p_inodes>
> Feb  5 15:28:19 marcelini kernel: [53511532.839796] [p_lkrg] Leaving function <p_delete_rb_p_inodes>
> Feb  5 15:28:19 marcelini kernel: [53511532.840459] [p_lkrg] kmem_cache "protected_p_inodes" destroyed!
> Feb  5 15:28:19 marcelini kernel: [53511532.840460] [p_lkrg] Leaving function <p_protected_features_exit>
> Feb  5 15:28:19 marcelini kernel: [53511532.841124] [p_lkrg] Entering function <p_exploit_detection_exit>
> Feb  5 15:28:19 marcelini kernel: [53511532.841780] [p_lkrg] Entering function <p_uninstall_sys_setuid_hook>
> Feb  5 15:28:19 marcelini kernel: [53511532.842430] [p_lkrg] [kretprobe] <sys_setuid> at 0x          (null) is NOT installed
> Feb  5 15:28:19 marcelini kernel: [53511532.842431] [p_lkrg] Leaving function <p_uninstall_sys_setuid_hook>
> Feb  5 15:28:19 marcelini kernel: [53511532.843090] [p_lkrg] Entering function <p_uninstall_sys_setreuid_hook>
> Feb  5 15:28:19 marcelini kernel: [53511532.843769] [p_lkrg] [kretprobe] <sys_setreuid> at 0x          (null) is NOT installed
> Feb  5 15:28:19 marcelini kernel: [53511532.843770] [p_lkrg] Leaving function <p_uninstall_sys_setreuid_hook>
> Feb  5 15:28:19 marcelini kernel: [53511532.844424] [p_lkrg] Entering function <p_uninstall_sys_setresuid_hook>
> Feb  5 15:28:19 marcelini kernel: [53511532.845082] [p_lkrg] [kretprobe] <sys_setresuid> at 0x          (null) is NOT installed
> Feb  5 15:28:19 marcelini kernel: [53511532.845083] [p_lkrg] Leaving function <p_uninstall_sys_setresuid_hook>
> Feb  5 15:28:19 marcelini kernel: [53511532.845741] [p_lkrg] Entering function <p_uninstall_sys_setfsuid_hook>
> Feb  5 15:28:19 marcelini kernel: [53511532.846409] [p_lkrg] [kretprobe] <sys_setfsuid> at 0x          (null) is NOT installed
> Feb  5 15:28:19 marcelini kernel: [53511532.846411] [p_lkrg] Leaving function <p_uninstall_sys_setfsuid_hook>
> Feb  5 15:28:19 marcelini kernel: [53511532.847072] [p_lkrg] Entering function <p_uninstall_sys_setgid_hook>
> Feb  5 15:28:19 marcelini kernel: [53511532.847753] [p_lkrg] [kretprobe] <sys_setgid> at 0x          (null) is NOT installed
> Feb  5 15:28:19 marcelini kernel: [53511532.847755] [p_lkrg] Leaving function <p_uninstall_sys_setgid_hook>
> Feb  5 15:28:19 marcelini kernel: [53511532.848412] [p_lkrg] Entering function <p_uninstall_sys_setregid_hook>
> Feb  5 15:28:19 marcelini kernel: [53511532.849065] [p_lkrg] [kretprobe] <sys_setregid> at 0x          (null) is NOT installed
> Feb  5 15:28:19 marcelini kernel: [53511532.849066] [p_lkrg] Leaving function <p_uninstall_sys_setregid_hook>
> Feb  5 15:28:19 marcelini kernel: [53511532.849725] [p_lkrg] Entering function <p_uninstall_sys_setresgid_hook>
> Feb  5 15:28:19 marcelini kernel: [53511532.850375] [p_lkrg] [kretprobe] <sys_setresgid> at 0x          (null) is NOT installed
> Feb  5 15:28:19 marcelini kernel: [53511532.850376] [p_lkrg] Leaving function <p_uninstall_sys_setresgid_hook>
> Feb  5 15:28:19 marcelini kernel: [53511532.851038] [p_lkrg] Entering function <p_uninstall_sys_setfsgid_hook>
> Feb  5 15:28:19 marcelini kernel: [53511532.851716] [p_lkrg] [kretprobe] <sys_setfsgid> at 0x          (null) is NOT installed
> Feb  5 15:28:19 marcelini kernel: [53511532.851718] [p_lkrg] Leaving function <p_uninstall_sys_setfsgid_hook>
> Feb  5 15:28:19 marcelini kernel: [53511532.852349] [p_lkrg] Entering function <p_uninstall_sys_setgroups_hook>
> Feb  5 15:28:19 marcelini kernel: [53511532.852997] [p_lkrg] [kretprobe] <sys_setgroups> at 0x          (null) is NOT installed
> Feb  5 15:28:19 marcelini kernel: [53511532.853006] [p_lkrg] Leaving function <p_uninstall_sys_setgroups_hook>
> Feb  5 15:28:19 marcelini kernel: [53511532.853646] [p_lkrg] Entering function <p_uninstall_do_init_module_hook>
> Feb  5 15:28:19 marcelini kernel: [53511532.854286] [p_lkrg] [kretprobe] <sys_init_module> at 0x          (null) is NOT installed
> Feb  5 15:28:19 marcelini kernel: [53511532.854288] [p_lkrg] Leaving function <p_uninstall_do_init_module_hook>
> Feb  5 15:28:19 marcelini kernel: [53511532.854925] [p_lkrg] Entering function <p_uninstall_sys_finit_module_hook>
> Feb  5 15:28:19 marcelini kernel: [53511532.855587] [p_lkrg] [kretprobe] <sys_finit_module> at 0x          (null) is NOT installed
> Feb  5 15:28:19 marcelini kernel: [53511532.855589] [p_lkrg] Leaving function <p_uninstall_sys_finit_module_hook>
> Feb  5 15:28:19 marcelini kernel: [53511532.856227] [p_lkrg] Entering function <p_uninstall_sys_delete_module_hook>
> Feb  5 15:28:19 marcelini kernel: [53511532.856863] [p_lkrg] [kretprobe] <sys_delete_module> at 0x          (null) is NOT installed
> Feb  5 15:28:19 marcelini kernel: [53511532.856864] [p_lkrg] Leaving function <p_uninstall_sys_delete_module_hook>
> Feb  5 15:28:19 marcelini kernel: [53511532.857499] [p_lkrg] Entering function <p_uninstall_sel_write_enforce_hook>
> Feb  5 15:28:19 marcelini kernel: [53511532.858139] [p_lkrg] [kretprobe] <sel_write_enforce> at 0x          (null) is NOT installed
> Feb  5 15:28:19 marcelini kernel: [53511532.858141] [p_lkrg] Leaving function <p_uninstall_sel_write_enforce_hook>
> Feb  5 15:28:19 marcelini kernel: [53511532.858769] [p_lkrg] Entering function <p_uninstall_seccomp_hook>
> Feb  5 15:28:19 marcelini kernel: [53511532.859391] [p_lkrg] [kretprobe] <prctl_set_seccomp> at 0x          (null) is NOT installed
> Feb  5 15:28:19 marcelini kernel: [53511532.859392] [p_lkrg] Leaving function <p_uninstall_seccomp_hook>
> Feb  5 15:28:19 marcelini kernel: [53511532.860024] [p_lkrg] Entering function <p_uninstall_sys_unshare_hook>
> Feb  5 15:28:19 marcelini kernel: [53511532.860644] [p_lkrg] [kretprobe] <sys_unshare> at 0x          (null) is NOT installed
> Feb  5 15:28:19 marcelini kernel: [53511532.860645] [p_lkrg] Leaving function <p_uninstall_sys_unshare_hook>
> Feb  5 15:28:19 marcelini kernel: [53511532.861269] [p_lkrg] Entering function <p_uninstall_userns_install_hook>
> Feb  5 15:28:19 marcelini kernel: [53511532.861898] [p_lkrg] [kretprobe] <userns_install> at 0x          (null) is NOT installed
> Feb  5 15:28:19 marcelini kernel: [53511532.861899] [p_lkrg] Leaving function <p_uninstall_userns_install_hook>
> Feb  5 15:28:19 marcelini kernel: [53511532.862523] [p_lkrg] Entering function <p_uninstall_sys_capset_hook>
> Feb  5 15:28:19 marcelini kernel: [53511532.863149] [p_lkrg] [kretprobe] <sys_capset> at 0x          (null) is NOT installed
> Feb  5 15:28:19 marcelini kernel: [53511532.863149] [p_lkrg] Leaving function <p_uninstall_sys_capset_hook>
> Feb  5 15:28:19 marcelini kernel: [53511532.863801] [p_lkrg] Entering function <p_uninstall_cap_task_prctl_hook>
> Feb  5 15:28:19 marcelini kernel: [53511532.864441] [p_lkrg] [kretprobe] <cap_task_prctl> at 0x          (null) is NOT installed
> Feb  5 15:28:19 marcelini kernel: [53511532.864442] [p_lkrg] Leaving function <p_uninstall_cap_task_prctl_hook>
> Feb  5 15:28:19 marcelini kernel: [53511532.865083] [p_lkrg] Entering function <p_uninstall_lookup_user_key_hook>
> Feb  5 15:28:19 marcelini kernel: [53511532.865734] [p_lkrg] [kretprobe] <lookup_user_key> at 0x          (null) is NOT installed
> Feb  5 15:28:19 marcelini kernel: [53511532.865735] [p_lkrg] Leaving function <p_uninstall_lookup_user_key_hook>
> Feb  5 15:28:19 marcelini kernel: [53511532.866393] [p_lkrg] Entering function <p_uninstall_key_change_session_keyring_hook>
> Feb  5 15:28:19 marcelini kernel: [53511532.867052] [p_lkrg] [kretprobe] <key_change_session_keyring> at 0x          (null) is NOT installed
> Feb  5 15:28:19 marcelini kernel: [53511532.867054] [p_lkrg] Leaving function <p_uninstall_key_change_session_keyring_hook>
> Feb  5 15:28:19 marcelini kernel: [53511532.867740] [p_lkrg] Entering function <p_uninstall_sys_keyctl_hook>
> Feb  5 15:28:19 marcelini kernel: [53511532.868405] [p_lkrg] [kretprobe] <sys_keyctl> at 0x          (null) is NOT installed
> Feb  5 15:28:19 marcelini kernel: [53511532.868406] [p_lkrg] Leaving function <p_uninstall_sys_keyctl_hook>
> Feb  5 15:28:19 marcelini kernel: [53511532.869074] [p_lkrg] Entering function <p_uninstall_compat_sys_keyctl_hook>
> Feb  5 15:28:19 marcelini kernel: [53511532.869742] [p_lkrg] [kretprobe] <compat_sys_keyctl> at 0x          (null) is NOT installed
> Feb  5 15:28:19 marcelini kernel: [53511532.869743] [p_lkrg] Leaving function <p_uninstall_compat_sys_keyctl_hook>
> Feb  5 15:28:19 marcelini kernel: [53511532.870420] [p_lkrg] Entering function <p_delete_rb_ed_pids>
> Feb  5 15:28:19 marcelini kernel: [53511532.871094] [p_lkrg] Leaving function <p_delete_rb_ed_pids>
> Feb  5 15:28:19 marcelini kernel: [53511532.871780] [p_lkrg] kmem_cache "p_ed_pids" destroyed!
> Feb  5 15:28:19 marcelini kernel: [53511532.871782] [p_lkrg] Leaving function <p_exploit_detection_exit>
> Feb  5 15:28:19 marcelini kernel: [53511532.872469] [p_lkrg] Entering function <p_offload_cache_delete>
> Feb  5 15:28:19 marcelini kernel: [53511532.873571] [p_lkrg] Leaving function <p_offload_cache_delete>

> diff --git a/src/modules/notifiers/p_notifiers.c b/src/modules/notifiers/p_notifiers.c
> index b5aab58..e02a13d 100644
> --- a/src/modules/notifiers/p_notifiers.c
> +++ b/src/modules/notifiers/p_notifiers.c
> @@ -118,7 +118,6 @@ void p_register_notifiers(void) {
>     task_handoff_register(&p_taskfree_notifier_nb);
>     profile_event_register(PROFILE_TASK_EXIT, &p_profile_event_exit_notifier_nb);
>     profile_event_register(PROFILE_MUNMAP, &p_profile_event_munmap_notifier_nb);
> -   usb_register_notify(&p_usb_notifier_nb);
>     register_acpi_notifier(&p_acpi_notifier_nb);
>  
>  
> @@ -348,7 +347,6 @@ void p_deregister_notifiers(void) {
>     task_handoff_unregister(&p_taskfree_notifier_nb);
>     profile_event_unregister(PROFILE_TASK_EXIT, &p_profile_event_exit_notifier_nb);
>     profile_event_unregister(PROFILE_MUNMAP, &p_profile_event_munmap_notifier_nb);
> -   usb_unregister_notify(&p_usb_notifier_nb);
>     unregister_acpi_notifier(&p_acpi_notifier_nb);
>  
>  // STRONG_DEBUG


-- 
pi3 (pi3ki31ny) - pi3 (at) itsec pl
http://pi3.com.pl

View attachment "p_debian_weirdness.diff" of type "text/plain" (10340 bytes)

Powered by blists - more mailing lists

Your e-mail address:

Powered by Openwall GNU/*/Linux - Powered by OpenVZ