search

unix-thrust / beurk

BEURK Experimental Unix RootKit
GNU General Public License v3.0
362 stars 94 forks source link

fix(core): force init() constructor call #57

Closed chqrly closed 9 years ago

chqrly commented 9 years ago

show the Developer's Guide

ghost commented 9 years ago

It seems REALLY hack-ish, I won't merge immediately. And I will amend 70ef8f2

nil0x42 commented 9 years ago

i ll accept this pull request. therefore, there is a test that should be done later (and i created an issue for it): https://github.com/unix-thrust/beurk/issues/58

nil0x42 commented 9 years ago

ah, didn't saw that @mzap is not ok to merge.

@mzap : what do you find hacky ?

nil0x42 commented 9 years ago

(except for the commit message, which indeed deserves an amend :dancers:)

ghost commented 9 years ago

Calling init() on every hooked function seemed hack-ish. But I did some digging and there's no other way to deal with that since SElinux does explicitely forbid some LD_PRELOAD shenanigans on occasion. (But it looks like it's only fopen[64] that we have a problem with, apparently because SElinux calls that function beforehand, can someone check that ?)