search

CodeAndData / kerokid

GNU General Public License v2.0
8 stars 5 forks source link

Error during make #2

Closed cfi01 closed 9 years ago

cfi01 commented 9 years ago

Hi,

i have tried to use KEROKID on Ubuntu 12.04.5 LTS. But make dosen't work:

:/tmp/kerokid$ make linux-x86_64 make ARCH=x86_64 EXTRA_CFLAGS="-D_CONFIG_X8664 " -C /lib/modules/3.2.0-33-generic/build M=/tmp/kerokid modules make[1]: Betrete Verzeichnis '/usr/src/linux-headers-3.2.0-33-generic' CC [M] /tmp/kerokid/main.o CC [M] /tmp/kerokid/common.o CC [M] /tmp/kerokid/addressAnalysis.o CC [M] /tmp/kerokid/inlineHooks.o CC [M] /tmp/kerokid/notifier.o CC [M] /tmp/kerokid/memory.o /tmp/kerokid/memory.c: In Funktion »get_number_of_vm_areas_without_IOremapping«: /tmp/kerokid/memory.c:33:3: Fehler: Dereferenzierung eines Zeigers auf unvollständigen Typen /tmp/kerokid/memory.c:33:3: Warnung: Initialisierung von inkompatiblem Zeigertyp [standardmäßig aktiviert] /tmp/kerokid/memory.c:33:3: Fehler: Dereferenzierung eines Zeigers auf unvollständigen Typen /tmp/kerokid/memory.c:33:3: Fehler: Dereferenzierung eines Zeigers auf unvollständigen Typen /tmp/kerokid/memory.c:33:3: Fehler: Dereferenzierung eines Zeigers auf unvollständigen Typen /tmp/kerokid/memory.c:33:3: Fehler: Dereferenzierung eines Zeigers auf unvollständigen Typen /tmp/kerokid/memory.c:33:3: Fehler: Dereferenzierung eines Zeigers auf unvollständigen Typen /tmp/kerokid/memory.c:33:3: Fehler: Dereferenzierung eines Zeigers auf unvollständigen Typen /tmp/kerokid/memory.c:33:3: Fehler: Dereferenzierung eines Zeigers auf unvollständigen Typen /tmp/kerokid/memory.c:34:12: Fehler: Dereferenzierung eines Zeigers auf unvollständigen Typen /tmp/kerokid/memory.c:35:15: Fehler: Dereferenzierung eines Zeigers auf unvollständigen Typen /tmp/kerokid/memory.c: In Funktion »store_vm_areas_without_IOremapping_to_list«: /tmp/kerokid/memory.c:47:3: Fehler: Dereferenzierung eines Zeigers auf unvollständigen Typen /tmp/kerokid/memory.c:47:3: Warnung: Initialisierung von inkompatiblem Zeigertyp [standardmäßig aktiviert] /tmp/kerokid/memory.c:47:3: Fehler: Dereferenzierung eines Zeigers auf unvollständigen Typen /tmp/kerokid/memory.c:47:3: Fehler: Dereferenzierung eines Zeigers auf unvollständigen Typen /tmp/kerokid/memory.c:47:3: Fehler: Dereferenzierung eines Zeigers auf unvollständigen Typen /tmp/kerokid/memory.c:47:3: Fehler: Dereferenzierung eines Zeigers auf unvollständigen Typen /tmp/kerokid/memory.c:47:3: Fehler: Dereferenzierung eines Zeigers auf unvollständigen Typen /tmp/kerokid/memory.c:47:3: Fehler: Dereferenzierung eines Zeigers auf unvollständigen Typen /tmp/kerokid/memory.c:47:3: Fehler: Dereferenzierung eines Zeigers auf unvollständigen Typen /tmp/kerokid/memory.c:48:11: Fehler: Dereferenzierung eines Zeigers auf unvollständigen Typen /tmp/kerokid/memory.c:49:10: Fehler: Dereferenzierung eines Zeigers auf unvollständigen Typen make[2]: * [/tmp/kerokid/memory.o] Fehler 1 make[1]: * [module/tmp/kerokid] Fehler 2 make[1]: Verlasse Verzeichnis '/usr/src/linux-headers-3.2.0-33-generic' make: *\ [linux-x86_64] Fehler 2

Any hints to solve this issue? Kind Regards cfi

weidenba commented 9 years ago

Hi,

we will try to reproduce this issue. Could you please provide us the output of "cat /proc/version"

Greetings weidenba

cfi01 commented 9 years ago

Hi,

cat /proc/version Linux version 3.2.0-33-generic (buildd@batsu) (gcc version 4.6.3 (Ubuntu/Linaro 4.6.3-1ubuntu5) ) #52-Ubuntu SMP Thu Oct 18 16:29:15 UTC 2012

Regards cfi

cfi01 commented 9 years ago

Hi,

i've seen a new makefile version. After a new git clone https://github.com/CodeAndData/kerokid.git and a make i'am able to compile the modules. Now the make command runs to the end.

Is there an explanation of positive or negativ output in dmesg?

Regards cfi

weidenba commented 9 years ago

We just added an output example for a manipulated syscall table to the README. In generall if there is no ALERT or WARNING, kerokid did not find anything suspicious.

cfi01 commented 9 years ago

Hi,

then here is someting wrong after compiling. I got a general protection fault:

[3382824.680975] KEROKID: Started [3382824.711009] KEROKID: Check for syscall table hooks... [3382824.711014] KEROKID: Check for inline hooks... [3382824.712046] general protection fault: 0000 [#1] SMP [3382824.715673] CPU 0 [3382824.715705] Modules linked in: kerokid(O+) vhost_net macvtap i2c_piix4 macvlan mac_hid psmouse virtio_balloon lp parport serio_raw floppy [3382824.716009] [3382824.716009] Pid: 25562, comm: insmod Tainted: G O 3.2.0-33-generic #52-Ubuntu Bochs Bochs [3382824.716009] RIP: 0010:[] [] memcpy+0xb/0x120 [3382824.716009] RSP: 0000:ffff880036f21e70 EFLAGS: 00010202 [3382824.716009] RAX: ffffc900008f4000 RBX: ffffc900008f4000 RCX: 0000000000000001 [3382824.716009] RDX: 0000000000000004 RSI: 6461625f6e726177 RDI: ffffc900008f4000 [3382824.716009] RBP: ffff880036f21ea8 R08: ffff88003a2a1af0 R09: ffff880036f21d34 [3382824.716009] R10: ffff88003e018020 R11: 0000000000000000 R12: 000000000000000c [3382824.716009] R13: 0000000000000002 R14: 6461625f6e726177 R15: 000000000000000c [3382824.716009] FS: 00007f755d4a7700(0000) GS:ffff88003fc00000(0000) knlGS:0000000000000000 [3382824.716009] CS: 0010 DS: 0000 ES: 0000 CR0: 000000008005003b [3382824.716009] CR2: 00007fa9b0862101 CR3: 000000003c694000 CR4: 00000000000006f0 [3382824.716009] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [3382824.716009] DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400 [3382824.716009] Process insmod (pid: 25562, threadinfo ffff880036f20000, task ffff88003c0dc500) [3382824.716009] Stack: [3382824.716009] ffffffffa00746dd ffffffff8114bfd4 0000000000000000 6461625f6e726177 [3382824.716009] ffffffffa00740a0 00000000022fe010 0000000000000003 ffff880036f21ee8 [3382824.716009] ffffffffa00747b3 000000020000000c 000000000000b848 00000000e0ff0000 [3382824.716009] Call Trace: [3382824.716009] [] ? check_hook+0x3d/0xc0 [kerokid] [3382824.716009] [] ? __vunmap.part.16+0x84/0xc0 [3382824.716009] [] ? check_syscall_table+0x40/0x40 [kerokid] [3382824.716009] [] check_for_hooks+0x53/0x80 [kerokid] [3382824.716009] [] check_inline_hooks+0x2d/0x40 [kerokid] [3382824.716009] [] init_module+0x4e/0x70 [kerokid] [3382824.716009] [] do_one_initcall+0x40/0x180 [3382824.716009] [] sys_init_module+0xbe/0x230 [3382824.716009] [] system_call_fastpath+0x16/0x1b [3382824.716009] Code: 58 48 2b 43 50 88 43 4e 48 83 c4 08 5b 5d c3 90 e8 1b fe ff ff eb e6 90 90 90 90 90 90 90 90 90 48 89 f8 89 d1 c1 e9 03 83 e2 07 48 a5 89 d1 f3 a4 c3 20 48 83 ea 20 4c 8b 06 4c 8b 4e 08 4c [3382824.716009] RIP [] memcpy+0xb/0x120 [3382824.716009] RSP [3382824.732967] ---[ end trace 91806d0d7f8a73aa ]---

Kind regards cfi

weidenba commented 9 years ago

Thx for the new bug report. We already identified the problem. We will hopefully fix it today.

cfi01 commented 9 years ago

Hi,

now it works, but what tells me the output of the modules macvlan and macvtap? Is this a problem? The server is a virtual machine on libvirt an i use the network types macvlan and macvtap for a VLAN setting.

[ 89.139134] KEROKID: Started [ 89.141320] KEROKID: Check for syscall table hooks... [ 89.141326] KEROKID: Check for inline hooks... [ 89.141936] KEROKID: Check notifier_subscriptions... [ 89.141941] KEROKID: -> Check keyboard notifier chain... [ 89.141944] KEROKID: -> Check module notifier chain... [ 89.141948] KEROKID: -> Check netdevice notifier chain... [ 89.141954] KEROKID: WARNING: Jump to module: ffffffffa00331a0 [ 89.142019] KEROKID: Name: macvlan [ 89.142021] KEROKID: Start-Address: ffffffffa0033000 [ 89.142023] KEROKID: End-Address: ffffffffa00379ef [ 89.142025] KEROKID: Object-Address: ffffffffa00360a0 [ 89.142027] KEROKID: Size: 18927 Bytes [ 89.142028] KEROKID: Module-State: LIVE [ 89.142030] KEROKID: WARNING: Jump to module: ffffffffa0040ac0 [ 89.142088] KEROKID: Name: macvtap [ 89.142090] KEROKID: Start-Address: ffffffffa0040000 [ 89.142092] KEROKID: End-Address: ffffffffa0044860 [ 89.142094] KEROKID: Object-Address: ffffffffa0043240 [ 89.142095] KEROKID: Size: 18528 Bytes [ 89.142097] KEROKID: Module-State: LIVE [ 89.142099] KEROKID: -> Check netevent notifier chain...

Kind Regards cfi

skevas commented 9 years ago

Hi cfi01,

kerokid detected two modules (macvlan and macvtap) monitoring the netdeivce notifier. The modules are not hidden (otherwise it would say "KEROKID: ALERT: Jump to hidden module", a strong indicator for a rootkit). The other information are related to the reserved address spaces and the module states.

Kerokid needs a better user interface! Its current output is indeed hard to read and understand...