enodia-sentinal/enodia_sentinel/rootcheck.py

# SPDX-License-Identifier: GPL-3.0-or-later
"""Anti-rootkit: detect things that are being hidden from the normal views.

The technique a rootkit uses to hide is also how you catch it: ask the same
question two different ways and compare the answers. A process the ``/proc``
listing omits but the scheduler still knows about; a loaded module absent from
``/proc/modules`` but live in ``/sys/module``; a listening port in
``/proc/net/tcp`` that ``ss`` won't show — each discrepancy is a hiding artifact.

Honest limits: this runs in user space, so it reliably catches userland
(LD_PRELOAD) rootkits and the common ``/proc``-hiding LKMs, but a kernel rootkit
that hooks *every* path (the scheduler, /proc, and /sys consistently) can still
evade it. It raises the bar and catches the common cases; it is not a guarantee
against a bespoke ring-0 implant. Pair it with the off-box dead-man's switch.
"""
from __future__ import annotations

import os
import re
import subprocess
from collections.abc import Iterator

from .alert import Alert, Severity
from .config import Config
from .system import SystemState

SID_HIDDEN_PROC = 100022
SID_HIDDEN_MODULE = 100023
SID_HIDDEN_PORT = 100024
SID_PROMISC = 100025

IFF_PROMISC = 0x100


# --- pure diff cores (unit-tested without a live system) ------------------

def find_hidden_pids(proc_pids: set[int], alive_pids: set[int]) -> set[int]:
    """PIDs the kernel confirms alive but that are missing from /proc."""
    return alive_pids - proc_pids


def find_hidden_modules(proc_modules: set[str], sys_live: set[str]) -> set[str]:
    """Modules live in /sys/module but absent from /proc/modules."""
    return sys_live - proc_modules


def find_hidden_ports(procnet_ports: set[int], ss_ports: set[int]) -> set[int]:
    """Listening ports in /proc/net/tcp that ss does not report."""
    return procnet_ports - ss_ports


# --- system views ---------------------------------------------------------

def proc_pids() -> set[int]:
    return {int(n) for n in os.listdir("/proc") if n.isdigit()}


def pid_max(cap: int) -> int:
    try:
        return min(int(open("/proc/sys/kernel/pid_max").read().strip()), cap)
    except (OSError, ValueError):
        return cap


def alive_pids(cap: int) -> set[int]:
    """Brute-force which PIDs exist via kill(pid, 0).

    kill returns success or EPERM for a live PID, ESRCH (ProcessLookupError)
    for a dead one. Goes through the process table, not the /proc readdir a
    rootkit may have hooked.
    """
    alive: set[int] = set()
    for pid in range(1, pid_max(cap) + 1):
        try:
            os.kill(pid, 0)
            alive.add(pid)
        except PermissionError:
            alive.add(pid)            # exists, just not ours to signal
        except (ProcessLookupError, OSError):
            pass
    return alive


def proc_modules() -> set[str]:
    out: set[str] = set()
    try:
        with open("/proc/modules") as fh:
            for line in fh:
                out.add(line.split()[0])
    except OSError:
        pass
    return out


def sys_live_modules() -> set[str]:
    """Modules under /sys/module whose initstate is 'live' (i.e. loaded, not
    built-in — built-ins have no initstate file)."""
    out: set[str] = set()
    base = "/sys/module"
    try:
        for m in os.listdir(base):
            try:
                with open(os.path.join(base, m, "initstate")) as fh:
                    if fh.read().strip() == "live":
                        out.add(m)
            except OSError:
                continue
    except OSError:
        pass
    return out


def _procnet_listen_ports(path: str) -> set[int]:
    ports: set[int] = set()
    try:
        with open(path) as fh:
            next(fh, None)  # header
            for line in fh:
                parts = line.split()
                if len(parts) < 4 or parts[3] != "0A":  # 0A = TCP_LISTEN
                    continue
                local = parts[1]                # HEX_ADDR:HEX_PORT
                ports.add(int(local.rsplit(":", 1)[1], 16))
    except OSError:
        pass
    return ports


def procnet_listen_ports() -> set[int]:
    return _procnet_listen_ports("/proc/net/tcp") | _procnet_listen_ports("/proc/net/tcp6")


def ss_listen_ports(state: SystemState) -> set[int]:
    ports: set[int] = set()
    for s in state.listening_sockets():
        tail = s.local.rsplit(":", 1)
        if len(tail) == 2 and tail[1].isdigit():
            ports.add(int(tail[1]))
    return ports


def promiscuous_interfaces() -> list[str]:
    out: list[str] = []
    base = "/sys/class/net"
    try:
        for iface in os.listdir(base):
            try:
                with open(os.path.join(base, iface, "flags")) as fh:
                    flags = int(fh.read().strip(), 16)
                if flags & IFF_PROMISC:
                    out.append(iface)
            except (OSError, ValueError):
                continue
    except OSError:
        pass
    return out


# --- the check ------------------------------------------------------------

def run(cfg: Config, state: SystemState | None = None) -> Iterator[Alert]:
    state = state or SystemState()
    cap = cfg.rootcheck_pid_cap

    # Hidden processes — re-verify each candidate to shake out exit races.
    visible = proc_pids()
    candidates = find_hidden_pids(visible, alive_pids(cap))
    confirmed = []
    for pid in candidates:
        try:
            os.kill(pid, 0)
        except PermissionError:
            pass
        except OSError:
            continue
        if not os.path.exists(f"/proc/{pid}"):
            confirmed.append(pid)
    if confirmed:
        yield Alert(
            severity=Severity.CRITICAL, signature="rootkit_hidden_process",
            key=f"rk:hidproc:{min(confirmed)}",
            detail=("process(es) alive but hidden from /proc: "
                    + ", ".join(map(str, sorted(confirmed)[:20]))),
            pids=tuple(sorted(confirmed)[:20]),
            sid=SID_HIDDEN_PROC, classtype="rootkit-hidden-process")

    hidden_mods = find_hidden_modules(proc_modules(), sys_live_modules())
    for m in sorted(hidden_mods):
        yield Alert(
            severity=Severity.CRITICAL, signature="rootkit_hidden_module",
            key=f"rk:hidmod:{m}",
            detail=f"kernel module live in /sys/module but hidden from /proc/modules: {m}",
            sid=SID_HIDDEN_MODULE, classtype="rootkit-hidden-module")

    hidden_ports = find_hidden_ports(procnet_listen_ports(), ss_listen_ports(state))
    if hidden_ports:
        yield Alert(
            severity=Severity.HIGH, signature="rootkit_hidden_port",
            key=f"rk:hidport:{min(hidden_ports)}",
            detail=("listening port(s) in /proc/net/tcp not reported by ss "
                    "(tool may be hooked): " + ", ".join(map(str, sorted(hidden_ports)))),
            sid=SID_HIDDEN_PORT, classtype="rootkit-hidden-port")

    for iface in promiscuous_interfaces():
        yield Alert(
            severity=Severity.MEDIUM, signature="promiscuous_interface",
            key=f"rk:promisc:{iface}",
            detail=f"interface in promiscuous mode (possible sniffer): {iface}",
            sid=SID_PROMISC, classtype="network-sniffer")