[翻译]内核驱动mmap Handler利用技术

内核驱动mmap Handler利用技术

译自exploit-database-papers中收录的kernel-driver-mmap-handler-exploitation,详见原文。鉴于译者水平有限，不免有错误存在，如是，望读者斧正。本文同步在我的博客.

1. 内核驱动简介

在实现Linux内核驱动中，开发者可以注册一个设备驱动文件，该文件常常在/dev/目录下完成注册。该文件可以支持所有的常规文件方法，比如opening, reading, writing, mmaping, closing等等。设备驱动文件支持的操作由包含了一组函数指针的结构体file_operations描述，每个指针描述一个操作。在4.9版本内核中可以找到如下的定义。

struct file_operations { 

  struct module *owner; 

  loff_t(*llseek) (struct file *, loff_t, int); 

  ssize_t(*read) (struct file *, char __user *, size_t, loff_t *);

  ssize_t(*write) (struct file *, const char __user *, size_t,     loff_t *); 

  ssize_t(*read_iter) (struct kiocb *, struct iov_iter *); 

  ssize_t(*write_iter) (struct kiocb *, struct iov_iter *); 

  int(*iterate) (struct file *, struct dir_context *); 

  int(*iterate_shared) (struct file *, struct dir_context *); 

  unsigned int(*poll) (struct file *, struct poll_table_struct *); 

  long(*unlocked_ioctl) (struct file *, unsigned int, unsigned long); 

  long(*compat_ioctl) (struct file *, unsigned int, unsigned long); 

  int(*mmap) (struct file *, struct vm_area_struct *); 

  int(*open) (struct inode *, struct file *); 

  int(*flush) (struct file *, fl_owner_t id); 

  int(*release) (struct inode *, struct file *); 

  int(*fsync) (struct file *, loff_t, loff_t, int datasync); 

  int(*fasync) (int, struct file *, int); 

  int(*lock) (struct file *, int, struct file_lock *); 

  ssize_t(*sendpage) (struct file *, struct page *, int, size_t, loff_t *, int); 

  unsigned long(*get_unmapped_area)(struct file *, unsigned long, unsigned long, unsigned long, unsigned long); 

  int(*check_flags)(int); int(*flock) (struct file *, int, struct file_lock *); 

  ssize_t(*splice_write)(struct pipe_inode_info *, struct file *, loff_t *, size_t, unsigned int); 

  ssize_t(*splice_read)(struct file *, loff_t *, struct pipe_inode_info *, size_t, unsigned int); 

  int(*setlease)(struct file *, long, struct file_lock **, void **); 

  long(*fallocate)(struct file *file, int mode, loff_t offset,loff_t len); 

  void(*show_fdinfo)(struct seq_file *m, struct file *f); 

#ifndef CONFIG_MMU 

  unsigned(*mmap_capabilities)(struct file *); 

#endif 

  ssize_t(*copy_file_range)(struct file *, loff_t, struct file *, loff_t, size_t, unsigned int); 

  int(*clone_file_range)(struct file *, loff_t, struct file *, loff_t,u64); 

  ssize_t(*dedupe_file_range)(struct file *, u64, u64, struct file *, u64); 

};

如同上面展示，可以实现非常多的文件操作，本文的主角是mmap handler的实现。

0 0 0 举报 分享

分享到

微信

QQ

微博

复制链接

取消分享

微信扫码分享

关闭

复制成功