full-disclosure - Re: who know about this--can not catch the absolute path on intercept the mkdir() syscall in linux.

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <AANLkTinsm2TG-Y8WhcVe43p15M4Rp8mB1he4ZPzljY-d@mail.gmail.com>
Date: Sat, 17 Jul 2010 17:15:20 -0700
From: coderman <coderman@...il.com>
To: supercodeing35271 supercodeing35271 <supercodeing35271@...il.com>
Cc: full-disclosure@...ts.grok.org.uk
Subject: Re: who know about this--can not catch the
	absolute path on intercept the mkdir() syscall in linux.

On Sat, Jul 17, 2010 at 12:51 AM, supercodeing35271 supercodeing35271
<supercodeing35271@...il.com> wrote:
> Hi,i am now write a simple file comparison and protect program in
> linux kernel module using the way of intercepting the syscall.What i
> have done is that when the module insmod into kernel,i can appoint a
> path that make any action which intend to mkdir in the path return a
> fail,so the path can be protect against  malicious tamper.
>...
> So my question is that is any idea of identify the shell command like
> mkdir if it is a absolute path or not,and how to change relative path
> into absolute for my module can intercept the relative path

you copied work; you did not learn and understand as suggested.

if you had learned and gained understanding, you would have awareness
of dentry cache and virtual file system interfaces, of device direct
i/o modes as just one path in many around your "protection" of write
by syscall intercept, of copy on write pages and memory mapped file
i/o, i could go on but learning is half the fun and i don't want to
spoil all the surprises!

suffice to say the correct solution is much more complicated than
you're currently prepared to implement... you've got more chops to
snuff up yet. be patient :)

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/