Gecko [ eachadeal.com ]

Name	Size	Permission	Date
common	[ DIR ]	drwxr-xr-x	2025-10-28 18:03
ftrace_hooks	[ DIR ]	drwxr-xr-x	2025-10-28 18:03
lsm_hooks	[ DIR ]	drwxr-xr-x	2025-10-28 18:03
syscall_hooks	[ DIR ]	drwxr-xr-x	2025-10-28 18:03
transport	[ DIR ]	drwxr-xr-x	2025-10-28 18:03
Kbuild	10.29 KB	-rw-r--r--	2025-10-28 18:03
Makefile	2.23 KB	-rw-r--r--	2025-10-28 18:03
compat.c	8.42 KB	-rw-r--r--	2025-10-28 18:03
compat.h	11.98 KB	-rw-r--r--	2025-10-28 18:03
debug.h	3.56 KB	-rw-r--r--	2025-10-28 18:03
dkms.conf	146 B	-rw-r--r--	2025-10-28 18:03
file_contexts.c	60.43 KB	-rw-r--r--	2025-10-28 18:03
file_contexts.h	6.21 KB	-rw-r--r--	2025-10-28 18:03
file_contexts_priv.h	5.48 KB	-rw-r--r--	2025-10-28 18:03
file_handle_tools.h	2.53 KB	-rw-r--r--	2025-10-28 18:03
file_key_tools.h	950 B	-rw-r--r--	2025-10-28 18:03
file_path_tools.h	2.09 KB	-rw-r--r--	2025-10-28 18:03
hashtable_compat.h	2.73 KB	-rw-r--r--	2025-10-28 18:03
hook_trampoline_common.h	4.29 KB	-rw-r--r--	2025-10-28 18:03
interval_tree.h	779 B	-rw-r--r--	2025-10-28 18:03
memory.c	3.31 KB	-rw-r--r--	2025-10-28 18:03
memory.h	2.99 KB	-rw-r--r--	2025-10-28 18:03
module.c	2.67 KB	-rw-r--r--	2025-10-28 18:03
module_ref.h	421 B	-rw-r--r--	2025-10-28 18:03
module_rundown_protection.c	3.64 KB	-rw-r--r--	2025-10-28 18:03
module_rundown_protection.h	743 B	-rw-r--r--	2025-10-28 18:03
path_tools.h	6.06 KB	-rw-r--r--	2025-10-28 18:03
rundown_protection.c	4.2 KB	-rw-r--r--	2025-10-28 18:03
rundown_protection.h	2.83 KB	-rw-r--r--	2025-10-28 18:03
safe_kobject.h	1.28 KB	-rw-r--r--	2025-10-28 18:03
si_common.h	4.3 KB	-rw-r--r--	2025-10-28 18:03
si_fp_properties.h	858 B	-rw-r--r--	2025-10-28 18:03
si_fp_properties_x.h	18.53 KB	-rw-r--r--	2025-10-28 18:03
si_fp_value_types.h	515 B	-rw-r--r--	2025-10-28 18:03
si_fp_value_types_x.h	1.25 KB	-rw-r--r--	2025-10-28 18:03
si_size.h	4.26 KB	-rw-r--r--	2025-10-28 18:03
si_templates.h	2.99 KB	-rw-r--r--	2025-10-28 18:03
si_writer.h	7.52 KB	-rw-r--r--	2025-10-28 18:03
si_writer_common.h	14.63 KB	-rw-r--r--	2025-10-28 18:03
stringify.h	261 B	-rw-r--r--	2025-10-28 18:03
task_info_map.c	17.1 KB	-rw-r--r--	2025-10-28 18:03
task_info_map.h	6.33 KB	-rw-r--r--	2025-10-28 18:03
task_tools.h	1.34 KB	-rw-r--r--	2025-10-28 18:03
tracepoints.c	3.58 KB	-rw-r--r--	2025-10-28 18:03
tracepoints.h	299 B	-rw-r--r--	2025-10-28 18:03
write_protection.h	2.2 KB	-rw-r--r--	2025-10-28 18:03

Rename

KERNEL_MODULE_NAME := file_protector

# '$(KERNEL_MODULE_NAME).ko' module:
obj-m += $(KERNEL_MODULE_NAME).o

# '$(KERNEL_MODULE_NAME).o' sources:
$(KERNEL_MODULE_NAME)-y += compat.o
$(KERNEL_MODULE_NAME)-y += memory.o
$(KERNEL_MODULE_NAME)-y += module.o
$(KERNEL_MODULE_NAME)-y += module_rundown_protection.o
$(KERNEL_MODULE_NAME)-y += rundown_protection.o
$(KERNEL_MODULE_NAME)-y += syscall_hooks/fs_syscall_hooks.o
$(KERNEL_MODULE_NAME)-y += syscall_hooks/syscall_common.o
$(KERNEL_MODULE_NAME)-y += task_info_map.o
$(KERNEL_MODULE_NAME)-y += tracepoints.o
$(KERNEL_MODULE_NAME)-y += transport/device.o
$(KERNEL_MODULE_NAME)-y += transport/exec_event.o
$(KERNEL_MODULE_NAME)-y += transport/exit_event.o
$(KERNEL_MODULE_NAME)-y += transport/fork_event.o
$(KERNEL_MODULE_NAME)-y += transport/fs_event.o
$(KERNEL_MODULE_NAME)-y += transport/message.o
$(KERNEL_MODULE_NAME)-y += transport/transport.o
$(KERNEL_MODULE_NAME)-y += file_contexts.o
$(KERNEL_MODULE_NAME)-y += ftrace_hooks/ftrace_events.o
$(KERNEL_MODULE_NAME)-y += ftrace_hooks/fsnotify_events.o
$(KERNEL_MODULE_NAME)-y += ftrace_hooks/fsnotify_listener.o
$(KERNEL_MODULE_NAME)-y += lsm_hooks/lsm_pre_events.o
$(KERNEL_MODULE_NAME)-y += lsm_hooks/lsm_common.o

# Note: '$(src)' is defined by kernel build system as absolute path
# pointing to directory with this Kbuild file
ccflags-y += -I$(src)
ccflags-y += -I$(src)/common
ccflags-y += -I$(src)/lsm_hooks
ccflags-y += -I$(src)/syscall_hooks
ccflags-y += -I$(src)/transport

# Tag to filter debug print
ccflags-y += -DPRINTK_TAG=\"APL\"

ccflags-y += -DDRIVER_VERSION_STRING=\"0.3.0\"

# uncomment/comment to enable/disable debug
#ccflags-y += -D__DEBUG__
#ccflags-y += -D__DEBUG_LEVEL__
#ccflags-y += -DDEFAULT_LOGGER_DEBUG_LEVEL=1

# Include headers parsing magic
# Check if specific header exists
ifeq ($(notdir $(wildcard $(srctree)/include/linux/sched.h)),sched.h)
	ccflags-y += -DHAVE_SCHED_H
endif
ifeq ($(notdir $(wildcard $(srctree)/include/linux/sched/task.h)),task.h)
	ccflags-y += -DHAVE_SCHED_TASK_H
endif
# Check if specific function in header exists
ccflags-y += $(shell \
	grep -qw get_fs_pwd $(srctree)/include/linux/fs_struct.h 2>/dev/null && \
		echo -DHAVE_GET_FS_PWD)
ccflags-y += $(shell \
	grep -qw get_task_exe_file $(srctree)/include/linux/mm.h 2>/dev/null && \
		echo -DHAVE_GET_TASK_EXE)
ccflags-y += $(shell \
	grep -qw path_equal $(srctree)/include/linux/path.h 2>/dev/null && \
		echo -DHAVE_PATH_EQUAL)
ccflags-y += $(shell \
	grep -qw rb_first_postorder $(srctree)/include/linux/rbtree.h 2>/dev/null && \
		echo -DHAVE_RB_FIRST_POSTORDER)
ccflags-y += $(shell \
	grep -qw rb_next_postorder $(srctree)/include/linux/rbtree.h 2>/dev/null && \
		echo -DHAVE_RB_NEXT_POSTORDER)
ccflags-y += $(shell \
	if grep "register_trace_" $(srctree)/include/linux/tracepoint.h 2>/dev/null | \
		grep -q "void \*data"; then \
		echo -DHAVE_TRACEPOINT_PROBE_REGISTER_DATA;				\
	fi)
ccflags-y += $(shell \
	if grep -w tracepoint_probe_register $(srctree)/include/linux/tracepoint.h 2>/dev/null | \
		grep -qw "struct tracepoint"; then \
		echo -DHAVE_TRACEPOINT_PROBE_REGISTER_STRUCT;				\
	fi)
ccflags-y += $(shell \
	grep -qw "from_kuid" $(srctree)/include/linux/uidgid.h 2>/dev/null && \
		echo -DHAVE_FROM_KUID)
ccflags-y += $(shell \
	grep -qw "from_kgid" $(srctree)/include/linux/uidgid.h 2>/dev/null && \
		echo -DHAVE_FROM_KGID)
ccflags-y += $(shell \
	grep -qw wait_event_killable_timeout $(srctree)/include/linux/wait.h 2>/dev/null && \
		echo -DHAVE_WAIT_EVENT_KILLABLE_TIMEOUT)
ccflags-y += $(shell \
	if grep -qw "fdget" $(srctree)/include/linux/file.h 2>/dev/null ; then \
		echo -DHAVE_FDGET;				\
	fi)
ccflags-y += $(shell \
	if grep -w "vfs_getattr(.*)" $(srctree)/include/linux/fs.h 2>/dev/null | \
		grep -qw "struct path" ; \
	then \
		echo -DHAVE_PATH_IN_VFS_GETATTR;				\
	fi)
ccflags-y += $(shell \
	if grep -w dentry_open $(srctree)/include/linux/fs.h 2>/dev/null | \
		grep -qw "struct path"; then \
		echo -DHAVE_PATH_IN_DENTRY_OPEN;				\
	fi)
ccflags-y += $(shell \
	grep -qw get_unused_fd_flags $(srctree)/include/linux/file.h 2>/dev/null && \
		echo -DHAVE_UNUSED_FD_FLAGS)
ccflags-y += $(shell \
	grep -qw "hash_init" $(srctree)/include/linux/hashtable.h 2>/dev/null && \
		echo -DHAVE_HASHTABLE_H)
ccflags-y += $(shell \
	grep -qw "atomic_or" $(srctree)/include/linux/atomic/atomic-instrumented.h 2>/dev/null || 	\
	grep -qw "atomic_or" $(srctree)/include/asm-generic/atomic-instrumented.h 2>/dev/null || 	\
	grep -qw "atomic_or" $(srctree)/include/asm-generic/atomic.h 2>/dev/null &&					\
		echo -DHAVE_ATOMIC_OR)

ccflags-y += $(shell \
	grep -qw "inode_get_mtime" $(srctree)/include/linux/fs.h 2>/dev/null && \
		echo -DHAVE_INODE_GET_MTIME)

ccflags-y += $(shell \
	grep -qw "inode_get_ctime" $(srctree)/include/linux/fs.h 2>/dev/null && \
		echo -DHAVE_INODE_GET_CTIME)

ccflags-y += $(shell \
	grep -qw "inode_get_atime" $(srctree)/include/linux/fs.h 2>/dev/null && \
		echo -DHAVE_INODE_GET_ATIME)

ccflags-y += $(shell \
	grep -qw "i_uid_read" $(srctree)/include/linux/fs.h 2>/dev/null && \
		echo -DHAVE_I_UID_READ)

ccflags-y += $(shell \
	grep -qw "i_gid_read" $(srctree)/include/linux/fs.h 2>/dev/null && \
		echo -DHAVE_I_GID_READ)

ccflags-y += $(shell \
	grep -qw "struct file_handle" $(srctree)/include/linux/fs.h 2>/dev/null && \
		echo -DHAVE_FILE_HANDLE)

ccflags-y += $(shell \
	grep -qw "s_uuid" $(srctree)/include/linux/fs.h 2>/dev/null && \
		echo -DHAVE_UUID_IN_SUPER_BLOCK)

ccflags-y += $(shell \
	grep -w "get_file_rcu" $(srctree)/include/linux/fs.h 2>/dev/null | \
	grep -q "\*\*" && \
		echo -DHAVE_GET_FILE_RCU_DOUBLE_POINTER)

ccflags-y += $(shell \
	grep -qw "struct filename" $(srctree)/include/linux/fs.h 2>/dev/null && \
		echo -DHAVE_STRUCT_FILENAME)

ccflags-y += $(shell \
	grep -qw "no_llseek" $(srctree)/include/linux/fs.h 2>/dev/null && \
		echo -DHAVE_NO_LLSEEK)

ccflags-y += $(shell \
	grep -qw "vfs_clone_file_range" $(srctree)/include/linux/fs.h 2>/dev/null && \
		echo -DHAVE_VFS_CLONE_FILE_RANGE)

ccflags-y += $(shell \
	grep -qw "vfs_copy_file_range" $(srctree)/include/linux/fs.h 2>/dev/null && \
		echo -DHAVE_VFS_COPY_FILE_RANGE)

ccflags-y += $(shell \
	grep -qw "do_splice_direct" $(srctree)/include/linux/fs.h 2>/dev/null && \
		echo -DHAVE_DO_SPLICE_DIRECT_IN_FS)

ccflags-y += $(shell \
	grep -qw "int mnt_id;" $(srctree)/include/linux/mount.h 2>/dev/null && \
		echo -DVFSMOUNT_HAS_MNT_ID)
		
ccflags-y += $(shell \
	if grep -qw "real_start_time" $(srctree)/include/linux/sched.h 2>/dev/null ; then \
		echo -DHAVE_REAL_START_TIME;				\
	fi)
ccflags-y += $(shell \
	if grep -w "real_start_time" $(srctree)/include/linux/sched.h 2>/dev/null | \
		grep -qw "timespec"; then \
		echo -DHAVE_TIMESPEC_REAL_START_TIME;				\
	fi)

ccflags-y += $(shell \
	grep -qw "exportfs_encode_inode_fh" $(srctree)/include/linux/exportfs.h 2>/dev/null && \
		echo -DHAVE_EXPORTFS_ENCODE_INODE_FH)

ccflags-y += $(shell \
	grep -qw "struct security_hook_list" $(srctree)/include/linux/lsm_hooks.h 2>/dev/null && \
		echo -DHAVE_SECURITY_HOOK_LIST)

ccflags-y += $(shell \
	grep -qw "struct static_call_key" $(srctree)/include/linux/lsm_hooks.h 2>/dev/null && \
		echo -DHAVE_LSM_STATIC_CALL)

# In some versions, security.h only have definition of `security_file_open`, but it's same type with `file_open`,
# should be enough to detect `file_open` and `cred`
ccflags-y += $(shell \
	grep "file_open" $(srctree)/include/linux/security.h 2>/dev/null | \
	grep -qw "cred" && \
		echo -DFILE_OPEN_WITH_CRED)

ccflags-y += $(shell \
	grep -q "file_open" $(srctree)/include/linux/security.h 2>/dev/null && \
		echo -DHAVE_FILE_OPEN)

ccflags-y += $(shell \
	grep -q "mmap_file" $(srctree)/include/linux/security.h 2>/dev/null && \
		echo -DHAVE_MMAP_FILE)

ccflags-y += $(shell \
	grep -q "file_truncate" $(srctree)/include/linux/security.h 2>/dev/null && \
		echo -DHAVE_FILE_TRUNCATE)

ccflags-y += $(shell \
	grep -q "timespec64" $(srctree)/include/linux/security.h 2>/dev/null && \
		echo -DHAVE_TIMESPEC64)

ccflags-y += $(shell \
	grep -q "hlist_node" $(srctree)/include/linux/lsm_hooks.h 2>/dev/null && \
		echo -DHOOK_LIST_USE_HLIST)

ccflags-y += $(shell \
	grep -q ".\*new_dentry,.unsigned int flags" $(srctree)/include/linux/lsm_hook_defs.h 2>/dev/null && \
		echo -DRENAME_HAS_FLAGS)

ccflags-y += $(shell \
	grep -q "fsnotify.struct inode \*to_tell, __u32 mask" $(srctree)/include/linux/fsnotify_backend.h 2>/dev/null && \
		echo -DFSNOTIFY_MASK_SECOND)

ccflags-y += $(shell \
	grep -wq "FSNOTIFY_EVENT_DENTRY" $(srctree)/include/linux/fsnotify_backend.h 2>/dev/null && \
		echo -DHAVE_FSNOTIFY_EVENT_DENTRY)

ccflags-y += $(shell \
	grep -wq "FSNOTIFY_GROUP_NOFS" $(srctree)/include/linux/fsnotify_backend.h 2>/dev/null && \
		echo -DHAVE_FSNOTIFY_GROUP_NOFS)

ccflags-y += $(shell \
	grep -w -A2 "fsnotify_add_mark" $(srctree)/include/linux/fsnotify_backend.h 2>/dev/null | \
	grep -q "fsid" && \
		echo -DHAVE_FSNOTIFY_ADD_MARK_FSID)

ccflags-y += $(shell \
	grep -wq "fsnotify_sb_info" $(srctree)/include/linux/fsnotify_backend.h 2>/dev/null && \
		echo -DHAVE_FSNOTIFY_SB_INFO)

ccflags-y += $(shell \
	grep -wq "struct qstr" $(srctree)/include/linux/fsnotify_backend.h 2>/dev/null && \
		echo -DHAVE_FSNOTIFY_QSTR)

ccflags-y += $(shell \
	grep -q "FTRACE_OPS_FL_SAVE_REGS" $(srctree)/include/linux/ftrace.h 2>/dev/null && \
		echo -DHAVE_FTRACE_OPS_FL_SAVE_REGS)

ccflags-y += $(shell \
	grep -qw "sched_process_exec" $(srctree)/include/trace/events/sched.h 2>/dev/null && \
		echo -DHAVE_SCHED_PROCESS_EXEC_TRACEPOINT)

ccflags-y += $(shell \
	grep -qw "iov_iter_revert" $(srctree)/include/linux/uio.h 2>/dev/null && \
		echo -DHAVE_IOV_ITER)

ccflags-y += $(shell \
	grep -w -A2 "getname" $(srctree)/include/linux/net.h 2>/dev/null | \
	grep -q "sockaddr_len" && \
		echo -DHAVE_LEN_IN_SOCK_GETNAME)

ccflags-y += $(shell \
	grep "security_path" $(srctree)/include/linux/security.h 2>/dev/null | \
	grep -q "const struct path" && \
		echo -DHAVE_CONST_PATH_IN_SECURITY)

ccflags-y += $(shell \
	grep -qw "probe_kernel_read" $(srctree)/include/linux/uaccess.h 2>/dev/null && \
		echo -DHAVE_PROBE_KERNEL_READ)

ccflags-y += $(shell \
	grep -qw "struct cgroup_name" $(srctree)/include/linux/cgroup.h 2>/dev/null && \
		echo -DHAVE_CGROUP_NAME)

ccflags-y += $(shell \
	grep -qw "kernfs_node" $(srctree)/include/linux/cgroup-defs.h 2>/dev/null && \
		echo -DHAVE_CGROUP_KERNFS_NAME)

ccflags-y += $(shell \
	grep -qw "sysfs_create_files" $(srctree)/include/linux/sysfs.h 2>/dev/null && \
		echo -DHAVE_SYSFS_CREATE_FILES)