系统调用日志收集系统实例

1 介绍

实验环境

Ubuntu64位，系统自带内核版本为4.10.0， 实验使用版本为4.13.1。

系统调用日志收集系统的结构图

2 实验

1.添加系统调用

将myaudit.c文件添加到arch/x86/kernel/目录下
myaudit文件

#include 
#include 
#include 
#include 
#include 
#include 

void (* my_audit)(int, int) = 0;
asmlinkage void sys_syscall_audit(int syscall,int  return_status)
{
    if(my_audit)    //如果钩子函数没有挂在则输出printk信息
        return (* my_audit)(syscall, return_status);
    printk("IN KERNEL:%s(%d), syscall:%d, return:%d\n", current->comm, current->pid, syscall, return_status);
    return;
}

int (* my_sysaudit)(u8, u8 *, u16, u8) = 0;
asmlinkage int sys_myaudit(u8 type, u8 * us_buf, u16 us_buf_size, u8 reset)
{
    if(my_sysaudit)
        return (* my_sysaudit)(type, us_buf, us_buf_size, reset);
    printk("IN KERNEL:my system call sysaudit() working\n");
    return 0;
}

EXPORT_SYMBOL(my_audit);
EXPORT_SYMBOL(my_sysaudit);

自己添加的文件需要编译进内核时，需要修改当前目录下的Makefile文件，在相应位置添加

obj-y += vsmp_64.o
obj-y += myaudit.o #添加的行

2.在arch/x86/entry/syscalls/syscall_64.tbl文件中添加系统调用号

3.修改头文件include/linux/syscalls.h，在文件最后添加两个函数声明

4.在/include/asm-generic/unistd.h添加系统调用号

5.修改arch/x86/entry/common.c文件

3.编译内核

1.配置内核使用make localmodconfig

2.使用make -j8编译内核

这里可能会出现两个错误：
fatal error: openssl/opensslv.h: No such file or directory
这是因为没有安装openssl的，需要先安装openssl： apt-get install libssl-dev
bc: not found。需要安装bc：apt-get install bc
安装对应依赖后再运行。

3.完成后执行make modules_install安装模块，执行make install 进行安装

4.安装完成后,重启选择对应的内核启动

启动后运行dmesg可以看到以下输出

说明新增的系统调用已正确运行

4.编写内核模块

myaudit.c文件:

#include 
#include 
#include 
#include 
#include 
#include 
#include 
#include 
#include 

#define COMM_SIZE 16

struct syscall_buf {
    u32 serial;
    u32 syscall;
    u32 status;
    pid_t pid;
    uid_t uid;
    u8 comm[COMM_SIZE];
};
DECLARE_WAIT_QUEUE_HEAD(buffer_wait);

#define AUDIT_BUF_SIZE 100
static struct syscall_buf audit_buf[AUDIT_BUF_SIZE];
static int current_pos = 0;
static u32 serial = 0;

void syscall_audit(int syscall, int return_status)
{
    struct syscall_buf * ppb_temp;

    if(current_pos < AUDIT_BUF_SIZE) {
        ppb_temp = &audit_buf[current_pos];
        ppb_temp->serial = serial++;
        ppb_temp->syscall = syscall;
        ppb_temp->status = return_status;
        ppb_temp->pid = current->pid;
        ppb_temp->uid = current_uid().val;

        memcpy(ppb_temp->comm, current->comm, COMM_SIZE);

        if(current_pos++ == AUDIT_BUF_SIZE*8/10) {
            printk("IN MODULE_audit:yes, it near full\n");
            wake_up_interruptible(&buffer_wait);
        }
    }
}

int sys_audit(u8 type, u8 * us_buf, u16 us_buf_size, u8 reset)
{
    int ret = 0;
    if(!type) {
        if(__clear_user(us_buf, us_buf_size)) {
            printk("Eror:claer_user\n");
            return 0;
        }
        printk("IN MOUDLE_systemcall:starting...\n");
        ret = wait_event_interruptible(buffer_wait, current_pos >= AUDIT_BUF_SIZE*8/10);
        printk("IN MOUDLE_systemcall:over, current_pos is %d\n", current_pos);
        if(__copy_to_user(us_buf, audit_buf, (current_pos)*sizeof(struct syscall_buf))) {
            printk("Error:copy error\n");
            return 0;
        }
        ret = current_pos - 1;
        current_pos = 0;
    }
    return ret;
}

extern void (*my_audit)(int, int);
extern int (*my_sysaudit)(unsigned char, unsigned char *, unsigned short, unsigned char);

static int __init audit_init(void)
{
    my_sysaudit = sys_audit;
    my_audit = syscall_audit;
    printk("Starting System Call Auditing\n");
    return 0;
}

static void __exit audit_exit(void)
{
    my_audit = NULL;
    my_sysaudit = NULL;
    printk("Exiting System Call Auditing\n");
    return;
}

module_init(audit_init);
module_exit(audit_exit);
MODULE_LICENSE("GPL");

编写用户程序user_audit.c

#include 
#include 
#include 
#include 
#include 
#include 
#include 
#include 

typedef unsigned char u8;
typedef unsigned int u32;

#define COMM_SIZE 16

struct syscall_buf {
    u32 serial;
    u32 syscall;
    u32 status;
    pid_t pid;
    uid_t uid;
    u8 comm[COMM_SIZE];
};

#define AUDIT_BUF_SIZE 100*sizeof(struct syscall_buf)

int main(int argc, char *argv[])
{
    u8 col_buf[AUDIT_BUF_SIZE];
    unsigned char reset = 1;
    int num = 0;
    struct syscall_buf *p;
while(1) {
   //这里的系统调用号根据自己的修改
        num = syscall(334, 0, col_buf, AUDIT_BUF_SIZE, reset);
        printf("num:%d\n",num);
        u8 j = 0;
        int i;
        p = (struct syscall_buf *)col_buf;
        for(i = 0; i < num; i++) {
            printf("num[%d], serial:%d\t",i, p[i].serial);
            printf("syscall:%d\n", p[i].syscall);
            printf("status:%d\n", ((struct syscall_buf *)col_buf)[i].status);
            printf("pid:%d\n", ((struct syscall_buf *)col_buf)[i].pid);
            printf("uid:%d\n", ((struct syscall_buf *)col_buf)[i].uid);
            printf("comm:%s\n", ((struct syscall_buf *)col_buf)[i].comm);
        }
    }
    return 1;
}

编译并运行,程序就会将内核模块中收集的日志取出并输出.