diff --git a/2_MemoryLoading/2.1_kpatch/Makefile b/2_MemoryLoading/2.1_kpatch/Makefile new file mode 100644 index 0000000..b5c08b9 --- /dev/null +++ b/2_MemoryLoading/2.1_kpatch/Makefile @@ -0,0 +1,14 @@ +kmod_name = livepatch_chown + +all: + echo "#include " > tmp.c + echo "#include " >> tmp.c + echo "#include " >> tmp.c + echo "" >> tmp.c + xxd -i $(kmod_name).ko >> tmp.c + echo "const char args[] = \"\\\0\";" >> tmp.c + echo "" >> tmp.c + cat stub.c >> tmp.c + cat tmp.c | sed 's/example_ko/$(kmod_name)_ko/g' > load.c + rm tmp.c + gcc -o load load.c diff --git a/2_MemoryLoading/2.1_kpatch/README.md b/2_MemoryLoading/2.1_kpatch/README.md new file mode 100644 index 0000000..8f43056 --- /dev/null +++ b/2_MemoryLoading/2.1_kpatch/README.md @@ -0,0 +1,16 @@ +# Linux Kernel Hacking + +## 2.0: Loading a Kernel Module from Memory (No Arguments) + +Patch the kernel with a single executable! + +To use: +* Set up kpatch following [these](../2.0_no_arguments/) instructions. +* Build the patch with `kpatch-build -t vmlinux -v /lib/debug/boot/vmlinux--generic chown.patch` +* Remove the `-` from the filename (C doesn't like it in variable names) + * `mv livepatch-chown.ko livepatch_chown.ko` +* Build the loader with `make` +* Execute as root with `sudo ./load` +* `chown` a file, e.g. `chown vagrant:vagrant chown.patch` +* Check output in kernel buffer with `dmesg` +* Unload with `echo 0 | sudo tee /sys/kernel/livepatch/chown/enabled && sudo rmmod chown` diff --git a/2_MemoryLoading/2.1_kpatch/chown.patch b/2_MemoryLoading/2.1_kpatch/chown.patch new file mode 100644 index 0000000..74862cf --- /dev/null +++ b/2_MemoryLoading/2.1_kpatch/chown.patch @@ -0,0 +1,12 @@ +diff --git a/fs/open.c b/fs/open.c +index 6cd48a61cda3..0602d7d7e530 100644 +--- a/fs/open.c ++++ b/fs/open.c +@@ -720,6 +720,7 @@ int do_fchownat(int dfd, const char __user *filename, uid_t user, gid_t group, + goto retry; + } + out: ++ printk(KERN_NOTICE "UID:GID %d:%d now owns the file %s\n", user, group, filename); + return error; + } + diff --git a/2_MemoryLoading/2.1_kpatch/stub.c b/2_MemoryLoading/2.1_kpatch/stub.c new file mode 100644 index 0000000..e70313a --- /dev/null +++ b/2_MemoryLoading/2.1_kpatch/stub.c @@ -0,0 +1,14 @@ +int main(void) +{ + int result; + + result = init_module(example_ko, example_ko_len, args); + + if( result != 0 ) + { + printf("Error: %d\n", result); + return(-1); + } + + return(0); +}