Server IP : 103.169.32.36 / Your IP : 216.73.217.13 Web Server : Apache System : Linux web.dpmptsp 3.10.0-1160.119.1.el7.x86_64 #1 SMP Tue Jun 4 14:43:51 UTC 2024 x86_64 User : apache ( 48) PHP Version : 5.6.40 Disable Function : NONE MySQL : ON | cURL : ON | WGET : ON | Perl : ON | Python : ON | Sudo : ON | Pkexec : ON Directory : /var/opt/eset/efs/eventd/eset_rtp/ |
Upload File : |
| Current File : /var/opt/eset/efs/eventd/eset_rtp/ertp_handlers_mmap.c |
/*
* eset_rtp (ESET Real-time file system protection module)
* Copyright (C) 1992-2023 ESET, spol. s r.o.
*
* This program is free software: you can redistribute it and/or modify
* it under the terms of the GNU General Public License as published by
* the Free Software Foundation, either version 3 of the License, or
* (at your option) any later version.
*
* This program is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU General Public License for more details.
*
* You should have received a copy of the GNU General Public License
* along with this program. If not, see <https://www.gnu.org/licenses/>.
*
* In case of any questions, you can contact us at ESET, spol. s r.o., Einsteinova 24, 851 01 Bratislava, Slovakia.
*/
#include <linux/file.h>
#include <linux/namei.h>
#include "ertp_event_check.h"
#include "ertp_ftrace_utils.h"
#include "ertp_handlers_mmap.h"
#include "ertp_logs.h"
#include "ertp_path.h"
#ifdef ERTP_KERNEL_USES_SYSCALL_WRAPPER
sys_regs_t ertp_original_native_64_mmap;
#else
sys_mmap_t ertp_original_native_64_mmap;
#endif
#ifdef ERTP_KERNEL_USES_SYSCALL_WRAPPER
asmlinkage long notrace ertp_handler_native_64_mmap(struct pt_regs *regs) {
unsigned long prot = ERTP_SYSCALL64_ARG2(unsigned long, regs);
unsigned long flags = ERTP_SYSCALL64_ARG3(unsigned long, regs);
unsigned long fd = ERTP_SYSCALL64_ARG4(unsigned long, regs);
long ret = 0;
struct file *file;
if ((flags & MAP_ANONYMOUS) || (fd == -1) || !(prot & PROT_EXEC)) {
goto end;
}
file = fget(fd);
if (!file) {
ret = -EBADF;
goto error;
}
ret = ertp_check_exec(file);
fput(file);
if (unlikely(ret == ERTP_DENIED)) {
ertp_pr_log(ERTP_LOG_EXEC,
"mmap failed or was denied by scanner (errno: %ld)", ret);
ret = -EPERM;
goto error;
}
end:
ret = ertp_original_native_64_mmap(regs);
error:
ertp_handler_end();
return ret;
}
#else
asmlinkage long notrace ertp_handler_native_64_mmap(
unsigned long addr, unsigned long len, unsigned long prot,
unsigned long flags, unsigned long fd, off_t pgoff) {
long ret = 0;
struct file *file;
if ((flags & MAP_ANONYMOUS) || (fd == -1) || !(prot & PROT_EXEC)) {
goto end;
}
file = fget(fd);
if (!file) {
ret = -EBADF;
goto error;
}
ret = ertp_check_exec(file);
fput(file);
if (unlikely(ret == ERTP_DENIED)) {
ertp_pr_log(ERTP_LOG_EXEC,
"mmap failed or was denied by scanner (errno: %ld)", ret);
ret = -EPERM;
goto error;
}
end:
ret = ertp_original_native_64_mmap(addr, len, prot, flags, fd, pgoff);
error:
ertp_handler_end();
return ret;
}
#endif