You are here: hacking technology > invades the examination > Content
Hot Articles
Recommend Articles
New Articles
Linux invasion observation system LIDS principle(7)
  Add date: 10/27/2008   Publishing date: 10/27/2008   Hits: 2
Total 7 pages, Current page:7, Jump to page:
 

if (retval >= 0) {
#ifdef CONFIG_LIDS_HIDE_PROC
if (lids_search_proc_to_hide(dentry->d_inode))
current->flags |= PF_HIDDEN;
…  

  Because each Linux advancement has one in the /proc filing system's entrance, we to hide the advancement also to need to revise proc the document entry.


In fs/proc/root.c

static struct dentry *proc_root_lookup (struct inode * dir, struct dentry * dentry)
{

inode = NULL;

#ifdef CONFIG_LIDS_HIDE_PROC
if (pid && p && (! ((p->flags & PF_HIDDEN) && lids_load && lids_local_load)) ) {
#else
if (pid && p) {
#endif
unsigned long ino = (pid >> 16) + PROC_PID_INO;
inode = proc_get_inode (dir->i_sb, ino, &proc_pid);
if (! inode)
return ERR_PTR(-EINVAL);
inode->i_flags|=S_IMMUTABLE;
}

}  

  Then if the advancement by the PF_HIDDEN mark, it will not be demonstrated in the proc filing system.


 
Other pages: : <<Prev * 1 * 2 * 3 * 4 * 5 * 6 * 7
Prev:Is invaded system's restoration guide (next) Next:Linux invasion observation system LIDS principle (2)

Comment:

Category: Home > invades the examination