Re: [RFC 04/16] kgr: add testing kgraft patch

From: Pavel Machek <pavel@ucw.cz>
To: Jiri Slaby <jslaby@suse.cz>
Cc: linux-kernel@vger.kernel.org, jirislaby@gmail.com,
	Vojtech Pavlik <vojtech@suse.cz>, Michael Matz <matz@suse.de>,
	Jiri Kosina <jkosina@suse.cz>,
	Steven Rostedt <rostedt@goodmis.org>,
	Frederic Weisbecker <fweisbec@gmail.com>,
	Ingo Molnar <mingo@redhat.com>
Subject: Re: [RFC 04/16] kgr: add testing kgraft patch
Date: Tue, 6 May 2014 13:03:18 +0200	[thread overview]
Message-ID: <20140506110318.GB15033@xo-6d-61-c0.localdomain> (raw)
In-Reply-To: <1398868249-26169-5-git-send-email-jslaby@suse.cz>

Hi!

> This is intended to be a presentation of the kgraft engine, so it is
> placed into samples/ directory.
> 
> It patches sys_iopl() and sys_capable() to print an additional message
> to the original functionality.
> 
> Jiri Kosina <jkosina@suse.cz>

??

> Signed-off-by: Jiri Slaby <jslaby@suse.cz>
> Cc: Steven Rostedt <rostedt@goodmis.org>
> Cc: Frederic Weisbecker <fweisbec@gmail.com>
> Cc: Ingo Molnar <mingo@redhat.com>

> +++ b/samples/kgr/kgr_patcher.c
> @@ -0,0 +1,97 @@
> +/*
> + * kgr_patcher -- just kick kgr infrastructure for test
> + *
> + *  Copyright (c) 2013-2014 SUSE
> + *   Authors: Jiri Kosina
> + *	      Vojtech Pavlik
> + *	      Jiri Slaby
> + */
> +
> +/*
> + * This program is free software; you can redistribute it and/or modify it
> + * under the terms of the GNU General Public License as published by the Free
> + * Software Foundation; either version 2 of the License, or (at your option)
> + * any later version.
> + */
> +
> +#include <linux/module.h>
> +#include <linux/kernel.h>
> +#include <linux/init.h>
> +#include <linux/kgr.h>
> +#include <linux/kallsyms.h>
> +#include <linux/sched.h>
> +#include <linux/types.h>
> +#include <linux/capability.h>
> +#include <linux/ptrace.h>
> +
> +#include <asm/processor.h>
> +
> +/*
> + * This all should be autogenerated from the patched sources
> + *
> + * IMPORTANT TODO: we have to handle cases where the new code is calling out
> + * into functions which are not exported to modules.

Is this todo still valid? Hey, its important :-).

> + * This can either be handled by calling all such functions indirectly, i.e
> + * obtaining pointer from kallsyms in the stub (and transforming all callsites
> + * to do pointer dereference), or by modifying the kernel module linker.
> + */
> +
> +asmlinkage long kgr_new_sys_iopl(unsigned int level)
> +{
> +        struct pt_regs *regs = current_pt_regs();
> +        unsigned int old = (regs->flags >> 12) & 3;
> +        struct thread_struct *t = &current->thread;
> +
> +	printk(KERN_DEBUG "kgr-patcher: this is a new sys_iopl()\n");

Tabs vs. spaces problem at more than one place.

> +KGR_PATCHED_FUNCTION(patch, SyS_iopl, kgr_new_sys_iopl);
> +
> +static bool new_capable(int cap)
> +{
> +	printk(KERN_DEBUG "kgr-patcher: this is a new capable()\n");
> +
> +        return ns_capable(&init_user_ns, cap);
> +}
> +KGR_PATCHED_FUNCTION(patch, capable, new_capable);

So for some reason when replacing sys_iopl, capable needs to be replaced, too?

> +static int __init kgr_patcher_init(void)
> +{
> +	/* removing not supported (yet?) */

So.. is it?
> +	__module_get(THIS_MODULE);
> +	kgr_start_patching(&patch);
> +	return 0;
> +}
> +
> +static void __exit kgr_patcher_cleanup(void)
> +{
> +	/* extra care needs to be taken when freeing ftrace_ops->private */
> +	printk(KERN_ERR "removing now buggy!\n");
> +}
> +

-- 
(english) http://www.livejournal.com/~pavelmachek
(cesky, pictures) http://atrey.karlin.mff.cuni.cz/~pavel/picture/horses/blog.html