is currently completing a simple kernel module coding job that simulates the rootkit hidden process. According to the observation of strace ps , the ps program traverses the directory through open / proc opening fd, and getdents < fd > .
sys_getdents is as follows:
// linux/syscalls.h
asmlinkage long (*sys_getdents) (unsigned int fd, struct linux_dirent __user *dirent, unsigned int count); struct linux_dirent is as follows:
// linux/fs/readdir.c
struct linux_dirent {
unsigned long d_ino;
unsigned long d_off;
unsigned short d_reclen;
char d_name[1];
}; because you don"t want to pollute your access to other directories, you want to determine the path that fd points to when you add hooks to sys_getdents .
when programming in user mode, we can use readlink / proc/self/fd/ < fd > to get it, but is there any good way to do this in kernel state? I hope you will not hesitate to give me your advice, thank you!