# SPDX-License-Identifier: GPL-3.0-or-later """Anti-rootkit: detect things that are being hidden from the normal views. The technique a rootkit uses to hide is also how you catch it: ask the same question two different ways and compare the answers. A process the ``/proc`` listing omits but the scheduler still knows about; a loaded module absent from ``/proc/modules`` but live in ``/sys/module``; a listening port in ``/proc/net/tcp`` that ``ss`` won't show — each discrepancy is a hiding artifact. Honest limits: this runs in user space, so it reliably catches userland (LD_PRELOAD) rootkits and the common ``/proc``-hiding LKMs, but a kernel rootkit that hooks *every* path (the scheduler, /proc, and /sys consistently) can still evade it. It raises the bar and catches the common cases; it is not a guarantee against a bespoke ring-0 implant. Pair it with the off-box dead-man's switch. """ from __future__ import annotations import os import re import subprocess from collections.abc import Iterator from .alert import Alert, Severity from .config import Config from .system import SystemState SID_HIDDEN_PROC = 100022 SID_HIDDEN_MODULE = 100023 SID_HIDDEN_PORT = 100024 SID_PROMISC = 100025 IFF_PROMISC = 0x100 # --- pure diff cores (unit-tested without a live system) ------------------ def find_hidden_pids(proc_pids: set[int], alive_pids: set[int]) -> set[int]: """PIDs the kernel confirms alive but that are missing from /proc.""" return alive_pids - proc_pids def find_hidden_modules(proc_modules: set[str], sys_live: set[str]) -> set[str]: """Modules live in /sys/module but absent from /proc/modules.""" return sys_live - proc_modules def find_hidden_ports(procnet_ports: set[int], ss_ports: set[int]) -> set[int]: """Listening ports in /proc/net/tcp that ss does not report.""" return procnet_ports - ss_ports # --- system views --------------------------------------------------------- def proc_pids() -> set[int]: return {int(n) for n in os.listdir("/proc") if n.isdigit()} def pid_max(cap: int) -> int: try: return min(int(open("/proc/sys/kernel/pid_max").read().strip()), cap) except (OSError, ValueError): return cap def alive_pids(cap: int) -> set[int]: """Brute-force which PIDs exist via kill(pid, 0). kill returns success or EPERM for a live PID, ESRCH (ProcessLookupError) for a dead one. Goes through the process table, not the /proc readdir a rootkit may have hooked. """ alive: set[int] = set() for pid in range(1, pid_max(cap) + 1): try: os.kill(pid, 0) alive.add(pid) except PermissionError: alive.add(pid) # exists, just not ours to signal except (ProcessLookupError, OSError): pass return alive def proc_modules() -> set[str]: out: set[str] = set() try: with open("/proc/modules") as fh: for line in fh: out.add(line.split()[0]) except OSError: pass return out def sys_live_modules() -> set[str]: """Modules under /sys/module whose initstate is 'live' (i.e. loaded, not built-in — built-ins have no initstate file).""" out: set[str] = set() base = "/sys/module" try: for m in os.listdir(base): try: with open(os.path.join(base, m, "initstate")) as fh: if fh.read().strip() == "live": out.add(m) except OSError: continue except OSError: pass return out def _procnet_listen_ports(path: str) -> set[int]: ports: set[int] = set() try: with open(path) as fh: next(fh, None) # header for line in fh: parts = line.split() if len(parts) < 4 or parts[3] != "0A": # 0A = TCP_LISTEN continue local = parts[1] # HEX_ADDR:HEX_PORT ports.add(int(local.rsplit(":", 1)[1], 16)) except OSError: pass return ports def procnet_listen_ports() -> set[int]: return _procnet_listen_ports("/proc/net/tcp") | _procnet_listen_ports("/proc/net/tcp6") def ss_listen_ports(state: SystemState) -> set[int]: ports: set[int] = set() for s in state.listening_sockets(): tail = s.local.rsplit(":", 1) if len(tail) == 2 and tail[1].isdigit(): ports.add(int(tail[1])) return ports def promiscuous_interfaces() -> list[str]: out: list[str] = [] base = "/sys/class/net" try: for iface in os.listdir(base): try: with open(os.path.join(base, iface, "flags")) as fh: flags = int(fh.read().strip(), 16) if flags & IFF_PROMISC: out.append(iface) except (OSError, ValueError): continue except OSError: pass return out # --- the check ------------------------------------------------------------ def run(cfg: Config, state: SystemState | None = None) -> Iterator[Alert]: state = state or SystemState() cap = cfg.rootcheck_pid_cap # Hidden processes — re-verify each candidate to shake out exit races. visible = proc_pids() candidates = find_hidden_pids(visible, alive_pids(cap)) confirmed = [] for pid in candidates: try: os.kill(pid, 0) except PermissionError: pass except OSError: continue if not os.path.exists(f"/proc/{pid}"): confirmed.append(pid) if confirmed: yield Alert( severity=Severity.CRITICAL, signature="rootkit_hidden_process", key=f"rk:hidproc:{min(confirmed)}", detail=("process(es) alive but hidden from /proc: " + ", ".join(map(str, sorted(confirmed)[:20]))), pids=tuple(sorted(confirmed)[:20]), sid=SID_HIDDEN_PROC, classtype="rootkit-hidden-process") hidden_mods = find_hidden_modules(proc_modules(), sys_live_modules()) for m in sorted(hidden_mods): yield Alert( severity=Severity.CRITICAL, signature="rootkit_hidden_module", key=f"rk:hidmod:{m}", detail=f"kernel module live in /sys/module but hidden from /proc/modules: {m}", sid=SID_HIDDEN_MODULE, classtype="rootkit-hidden-module") hidden_ports = find_hidden_ports(procnet_listen_ports(), ss_listen_ports(state)) if hidden_ports: yield Alert( severity=Severity.HIGH, signature="rootkit_hidden_port", key=f"rk:hidport:{min(hidden_ports)}", detail=("listening port(s) in /proc/net/tcp not reported by ss " "(tool may be hooked): " + ", ".join(map(str, sorted(hidden_ports)))), sid=SID_HIDDEN_PORT, classtype="rootkit-hidden-port") for iface in promiscuous_interfaces(): yield Alert( severity=Severity.MEDIUM, signature="promiscuous_interface", key=f"rk:promisc:{iface}", detail=f"interface in promiscuous mode (possible sniffer): {iface}", sid=SID_PROMISC, classtype="network-sniffer")