* use sys_enter tracepoint for sucompat
* update sucompat rules
* clean tif mark
* mark tif after load allow list
* clear all tif first, then mark target
* Fix shell su
* allow when escape
* fix bugs
* kernel: Resolve logical inconsistencies
---------
Co-authored-by: Ylarod <me@ylarod.cn>
Co-authored-by: weishu <twsxtd@gmail.com>
* Revert "feat: try manual reboot hook (#521)"
This reverts commit 1853d9decf.
* kernel: core_hook: provide a better reboot handler
I propose that you pass cmd and arg as reference.
this is so we can have much more extendable use of that pointer
kernel: core_hook: provide sys_reboot handler
- 2e2727d56c
kernel: kp_ksud: add sys_reboot kp hook
- 03285886b0
I'm proposing passing arg as reference to arg pointer and also pass int cmd
we can use it to pass numbers atleast.
for advanced usage, we can use it as a delimiter so we can pass a pointer to array.
example pass a char *array[] which decays to a char ** and then use cmd as the number of array members.
we can pass the pointer of the first member of the array and use cmd as the delimiter (count) of members.
for simpler usecase, heres some that I added.
kernel: core_hook: expose umount list on sys_reboot interface
- 352de41e4b
kernel: core_hook: expose nuke_ext4_sysfs to sys_reboot interface
- 83fc684ccb
ksud: add cmd for add-try-umount, wipe-umount-list and nuke-ext4-sysfs
- a4eab4b8c3
more usage demos
https://github.com/backslashxx/lkm_template/tree/write-pointer-on-pointerhttps://github.com/backslashxx/lkm_template/tree/pointer-reuse
I actually proposed sys_reboot upstream because of this pointer that is very usable.
Signed-off-by: backslashxx <118538522+backslashxx@users.noreply.github.com>
---------
Signed-off-by: backslashxx <118538522+backslashxx@users.noreply.github.com>
* kernel: Use NR_syscalls instead of SECCOMP_ARCH_NATIVE_NR
Old kernels don't has SECCOMP_ARCH_NATIVE_NR. But according to its definition,
it's equal to NR_syscalls. So use NR_syscalls instead.
* kernel: Fix wrong kernel version check
fsnotify_add_inode_mark was introduced in 4.17-rc5, not 4.12
* Pre Linux 5.9, handle_inode_event did not exist. This is was covered by handle_event.
* handle_event have a lot of changes, neither in arguments counts and arguments arrangements.
* Use fsnotify_add_mark_locked instead of fsnotify_add_inode_mark for kernel pre 4.12
NOTE: fsnotify_add_mark_locked is not tested! Report bugs if you found it!
Signed-off-by: Faris <rissu.ntk@gmail.com>
