diff --git a/kerneldriver/cases/Makefile b/kerneldriver/cases/Makefile index c353a555551d7f7837feda76e2aa5288f325b194..2a877a5d6b8029f89285dd64bf2fdcd1052dc0f4 100644 --- a/kerneldriver/cases/Makefile +++ b/kerneldriver/cases/Makefile @@ -1,15 +1,15 @@ # make secDetector_core obj-m += secDetector_memory_corruption.o -obj-m += secDetector_task_block.o -obj-m += secDetector_file_block.o +#obj-m += secDetector_task_block.o +#obj-m += secDetector_file_block.o obj-m += secDetector_kmodule_baseline.o # obj-m += secDetector_kprobe_example.o # obj-m += secDetector_lsm_example.o secDetector_memory_corruption-objs := memory_corruption/secDetector_memory_corruption.o memory_corruption/secDetector_mc_kmodule_list.o -secDetector_task_block-objs := task_block/secDetector_task_block.o -secDetector_file_block-objs := file_block/secDetector_file_block.o +#secDetector_task_block-objs := task_block/secDetector_task_block.o +#secDetector_file_block-objs := file_block/secDetector_file_block.o secDetector_kmodule_baseline-objs := kmodule_baseline/secDetector_kmodule_baseline.o kmodule_baseline/secDetector_mc_kmodule_baseline.o # secDetector_kprobe_example-objs := kprobe_example/secDetector_kprobe_example.o # secDetector_lsm_example-objs := lsm_example/secDetector_lsm_example.o diff --git a/kerneldriver/core/hook_unit/secDetector_hook_tracepoint.c b/kerneldriver/core/hook_unit/secDetector_hook_tracepoint.c index b46001cbe8182310b445757bbc18b6836b8aec81..8fef9008494d323850088a3902101e2cd3673109 100644 --- a/kerneldriver/core/hook_unit/secDetector_hook_tracepoint.c +++ b/kerneldriver/core/hook_unit/secDetector_hook_tracepoint.c @@ -8,7 +8,6 @@ #include #include -#include #include "secDetector_hook.h" typedef int (*REGFUNC)(void *, void *); @@ -22,37 +21,8 @@ struct secDetector_tracepoint { UNREGFUNC unregister_func; }; -static void file_event_handler(void *cb_data __attribute__((unused)), - struct secdetector_file *file, int flag, - int *sec_ret) -{ - do_secDetector_hook_callback(file_event, TRACEPOINT_FILE_EVENT, sec_ret, - PARAMS(file, flag)); -} - -static void task_event_handler(void *cb_data __attribute__((unused)), - struct secdetector_task *task, int flag, - int *sec_ret) -{ - do_secDetector_hook_callback(task_event, TRACEPOINT_TASK_EVENT, sec_ret, - PARAMS(task, flag)); -} static struct secDetector_tracepoint secDetector_tracepoint_hook_functions[] = { - [TRACEPOINT_TASK_EVENT] = { - .handler = task_event_handler, - .register_func = - tracepoint_register_call(secdetector_chktaskevent), - .unregister_func = - tracepoint_unregister_call(secdetector_chktaskevent), - }, - [TRACEPOINT_FILE_EVENT] = { - .handler = file_event_handler, - .register_func = - tracepoint_register_call(secdetector_chkfsevent), - .unregister_func = - tracepoint_unregister_call(secdetector_chkfsevent), - }, [HOOKEND] = { .handler = NULL, .register_func = NULL, diff --git a/kerneldriver/include/secDetector_hook_type.h b/kerneldriver/include/secDetector_hook_type.h index 3daaff50c8bdb73f5f143af149a10af14617e626..e73686342b1184d956fa99b87dd352001a5f647c 100644 --- a/kerneldriver/include/secDetector_hook_type.h +++ b/kerneldriver/include/secDetector_hook_type.h @@ -21,9 +21,7 @@ enum HOOK_TYPE { LSM_HOOK_END = LSM_INODE_MKDIR, TRACEPOINT_HOOK_START, - TRACEPOINT_TASK_EVENT = TRACEPOINT_HOOK_START, - TRACEPOINT_FILE_EVENT, - TRACEPOINT_HOOK_END = TRACEPOINT_FILE_EVENT, + TRACEPOINT_HOOK_END = TRACEPOINT_HOOK_START, HOOKEND, diff --git a/kerneldriver/include/secDetector_workflow_type.h b/kerneldriver/include/secDetector_workflow_type.h index 6ea78d8469acc210e5b1fc44591f694687626762..00d5ce919dce18721b293a6c514ae0b57fbe9413 100644 --- a/kerneldriver/include/secDetector_workflow_type.h +++ b/kerneldriver/include/secDetector_workflow_type.h @@ -8,7 +8,6 @@ #ifndef SECDETECTOR_WORKFLOW_TYPE_H #define SECDETECTOR_WORKFLOW_TYPE_H -#include #include "secDetector_hook_type.h" #include "secDetector_collect_type.h" #include "secDetector_analyze_type.h" @@ -22,10 +21,6 @@ enum WORKFLOW_TYPE { struct secDetector_workflow; union workflow_func { void (*func)(void); - int (*file_event)(struct secDetector_workflow *, - struct secdetector_file *, int); - int (*task_event)(struct secDetector_workflow *, - struct secdetector_task *, int flag); void (*timer_func)(struct secDetector_workflow *, struct timer_list *); void (*func_wf)(struct secDetector_workflow *); int (*kprobe_func)(struct secDetector_workflow *,