absolute path of a process (as the credential of a process)
A message that is not in the archive (sent off-list or not yet received): [email protected]
* Senhua Tao ([email protected]) wrote:
<some details snipped>
Quoted 4 lines
The ip filter checking can be done in
sys_connect(). That is the problem that I am having. I try to get the absolute path of the current process which callsconnect()to against the entries in the config file (they also have to be translated to absolute path) and get lost.
if you look at the code in fs/proc/base.c::proc_exe_link() you can see how the absolute pathname is gathered (note: only on execve is the VM_EXECUTABLE flag set). basically you need the dentry and vfsmount of the file. btw, you are only stopping tcp and bound udp if you hook in sys_connect, perhaps you should consider the sendmsg family as well. also, if the trojan is a server you have not protected listen/accept or resvmsg so sys_socket may be the best spot to watch.
also, all of this can be done using the LSM framework. (see lsm.immunix.org for patches).
cheers,
-chris