[<prev] [next>] [day] [month] [year] [list]
Date: Tue, 9 Jun 2020 23:46:22 +0200
From: Adam Zabrocki <pi3@....com.pl>
To: lkrg-users@...ts.openwall.com
Subject: ISRA optimized functions
Hi,
I've just pushed new changes to LKRG to better support non-standard kernels
which are more-likely to have ISRA-optimized functions. Additionally, I've
added more "relax" rules for initialization since not all hooks are critical
from LKRG perspective. If some of the hooks can't be placed and are not
critical, initialization is not halt. However, appropriate message is being
printed. Summary of the changes:
[1] Change initialization logic for exploit detection module:
- Not all hooks are fatal. If for any reason non-fatal hook can't be placed, continue initialization and print appropriate message
- If hook is fatal, stop intialization
[2] Add support for ISRA optimized functions:
- Some of the functions might be optimized by ISRA. However, some of the hooks can still be functional even under ISRA optimized functions.
ISRA optimized function example:
[ 5639.107779] [p_lkrg] Loading LKRG...
[ 5639.123862] Freezing user space processes ... (elapsed 0.001 seconds) done.
[ 5639.125747] OOM killer disabled.
[ 5639.126327] [p_lkrg] 7/23 UMH paths were whitelisted...
[ 5647.021663] [p_lkrg] [kretprobe] register_kretprobe() for <ttwu_do_wakeup> failed! [err=-22]
[ 5647.021761] [p_lkrg] Trying to find ISRA name for <ttwu_do_wakeup>
[ 5647.023761] [p_lkrg] Found ISRA version of function <ttwu_do_wakeup.isra.0>
[ 5647.227805] [p_lkrg] ISRA version was found and hook was planted at <ttwu_do_wakeup.isra.0>
[ 5648.053144] [p_lkrg] LKRG initialized successfully!
[ 5648.053211] OOM killer enabled.
[ 5648.053211] Restarting tasks ... done.
Thanks,
Adam
--
pi3 (pi3ki31ny) - pi3 (at) itsec pl
http://pi3.com.pl
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
