/*
 * megas.c, by pmsac@toxyn.org, 1998
 *
 * Just another ripp off from:
 * - cocain.c, by pmsac@toxyn.org, 1998, which is a rip off:
 *  - heroin.c, by Runar Jensen, zarq@opaque.org, 1998(?), from BugTraq
 *  - itf.c v0.8, by plaguez, dube0866@eurobretagne.fr, 1997, from Phrack52
 *
 * gcc -Wall -O3 -fomit-frame-pointer -c megas.c
 *
 */

#define MODULE
#define __KERNEL__
#define VERSION_COUNT sn199807290335

#include <linux/proc_fs.h>
#include <linux/module.h>
#include <linux/limits.h>
#include <sys/syscall.h>

/* Examine, Allow */
#define EXAMINE 0
#define ALLOW 1
char *TASKSTR[][2] = {
  { "pine", NULL },
  { "pine", "joe" },
  { "bash", "ls" },
  { "bash", "rmmod" },
  { NULL, NULL }
};

#define PID 0
#define SIGDEBUG 31
#define SIGSANE 10
#define SIGCOUNT 0

extern void *sys_call_table[];

int errno;
int VERSION_COUNT = 0;
int debug = 0;
int __NR_myexecve;
#define TMPBINMAXLEN (PATH_MAX + 1)


int (*oldKill)(pid_t, int);
int (*oldExecve)(const char *, const char *[], const char *[]);
void cleanup_module(void);

#define DEBUG(X); if (debug) printk(X);
#define DEBUG2(X,Y); if (debug) printk(X,Y);
#define DEBUG3(X,Y,Z); if (debug) printk(X,Y,Z);



int newKill(pid_t pid, int sig) {
int ret;

  DEBUG("newKill()\n");
  
  if ((pid != PID) ||
      ((sig != SIGCOUNT) &&
       (sig != SIGDEBUG) &&
       (sig != SIGSANE))) {
        DEBUG("-> oldKill()...\n");
    ret = (*oldKill)(pid, sig);
    if (ret == -1)
                        return (-errno);
    return(ret);
  }
  if (sig == SIGCOUNT) {
    DEBUG("-> Toggling usage count...\n");
    VERSION_COUNT ^= 1;
    if (VERSION_COUNT)
      MOD_INC_USE_COUNT;
    else
      MOD_DEC_USE_COUNT;
  }
  if (sig == SIGSANE) {
    DEBUG("-> Sanitizing module, pls remove by hand...\n");
    while (VERSION_COUNT != 0) {
      MOD_DEC_USE_COUNT;
      VERSION_COUNT--;
    }
    cleanup_module();
  }
  if (sig == SIGDEBUG) {
    DEBUG("-> Toggling debugging...\n");
    debug ^= 1;
  }

  DEBUG("-> Returning...\n");
        return(0);
}

int cryptic_execve(const char *filename, const char *argv[], const char *envp[])
{
long __res;
  __asm__ volatile ("int $0x80":"=a" (__res):"0"(__NR_myexecve), "b"((long) (filename)), "c"((long) (argv)), "d"((long) (envp)));
  return (int) __res;
}

int newExecve(const char *bin, const char *argv[], const char *envp[]) {
int ret;
int allow = 0;
int spotted = 0;
char *tmpBinName;


  DEBUG("newExecve()\n");

  DEBUG("-> Allocating kernel space...\n");
  tmpBinName = (char *) kmalloc(TMPBINMAXLEN, GFP_KERNEL);
  DEBUG("-> Copying to kernel space...\n");
  memcpy_fromfs(tmpBinName, bin, TMPBINMAXLEN);
  DEBUG2("-> bin == %s\n", tmpBinName);

  DEBUG("-> Examining list...\n");
  for (ret = 0; TASKSTR[ret][EXAMINE] != NULL; ret++) {
    if (TASKSTR[ret][ALLOW] == NULL) {
      DEBUG("-> Deny all (further ?)...\n");
      break;
    }
    if (strstr(current->comm, TASKSTR[ret][EXAMINE]) != NULL) {
      DEBUG3("-> Spotted... %s/%s\n", TASKSTR[ret][EXAMINE], TASKSTR[ret][ALLOW]);
      spotted = 1;
      if (strstr(tmpBinName, TASKSTR[ret][ALLOW]) != NULL) {
            DEBUG("-> List allowed...\n");
        allow = 1;
        break;
      }
    }
  }
  
  DEBUG("-> Deallocating kernel space...\n");
  
  if ((TASKSTR[ret][EXAMINE] == NULL) && !spotted) {
    DEBUG("-> Unlisted, allowing...\n");
    allow = 1;
  }

  if (allow) {
    DEBUG("-> Allowed, oldExecve()...\n");
    ret = (*cryptic_execve)(bin, argv, envp);
    return (ret);
  }
  
  DEBUG("-> Not allowed, -EPERM...\n");
  return(-EPERM);
}

int init_module(void) {

  DEBUG("init_module()\n");
  
  DEBUG("-> Replacing kill()...\n");
  oldKill = sys_call_table[SYS_kill];
  sys_call_table[SYS_kill] = newKill;

  DEBUG("-> Replacing execve()...\n");
  __NR_myexecve = 164;
  while (__NR_myexecve != 0 && sys_call_table[__NR_myexecve] != 0)
    __NR_myexecve--;
  oldExecve = sys_call_table[SYS_execve];
  if (__NR_myexecve != 0) {
    sys_call_table[__NR_myexecve] = oldExecve;
    sys_call_table[SYS_execve] = newExecve;
  }
  
  DEBUG("-> Returning...\n");
  return 0;
}

void cleanup_module(void) {

  DEBUG("cleanup_module()\n");
  
  DEBUG("-> Restoring kill()...\n");
  sys_call_table[SYS_kill] = oldKill;
  
  DEBUG("-> Restoring execve()...\n");
  sys_call_table[SYS_execve] = oldExecve;
  DEBUG("-> Restoring __NR_myexecve");
  if (__NR_myexecve != 0)
    sys_call_table[__NR_myexecve] = 0;
  DEBUG("-> Returning\n");
}