0

I am trying to write a kernel module that hides some sockets from netstat. I checked how netstat is working and saw that it's reading from /proc/net/tcp.

Now I am stuck. I am trying to figure out what is happening when I am reading the /proc/net/tcp file. After a little research in Google I found that it's using tcp4_seq_show function.

My question is how can I find out which function is used without googling it?

I tried using strace like -

strace -y -yy -v cat /proc/net/tcp

but the output not contain any reference to the tcp4_seq_show function or any another kernel function.

the relevant output -

arch_prctl(ARCH_SET_FS, 0x7ff5ec3e1580) = 0
mprotect(0x7ff5ec3d6000, 12288, PROT_READ) = 0
mprotect(0x55c369b3b000, 4096, PROT_READ) = 0
mprotect(0x7ff5ec420000, 4096, PROT_READ) = 0
munmap(0x7ff5ec3e2000, 71701)           = 0
brk(NULL)                               = 0x55c36a40e000
brk(0x55c36a42f000)                     = 0x55c36a42f000
openat(AT_FDCWD, "/usr/lib/locale/locale-archive", O_RDONLY|O_CLOEXEC) = 3
fstat(3, {st_mode=S_IFREG|0644, st_size=5698896, ...}) = 0
mmap(NULL, 5698896, PROT_READ, MAP_PRIVATE, 3, 0) = 0x7ff5ebc7f000
close(3)                                = 0
fstat(1, {st_mode=S_IFCHR|0620, st_rdev=makedev(0x88, 0), ...}) = 0
openat(AT_FDCWD, "/proc/net/tcp", O_RDONLY) = 3
fstat(3, {st_mode=S_IFREG|0444, st_size=0, ...}) = 0
fadvise64(3, 0, 0, POSIX_FADV_SEQUENTIAL) = 0
mmap(NULL, 139264, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7ff5ebc5d000
read(3, "  sl  local_address rem_address "..., 131072) = 900
write(1, "  sl  local_address rem_address "..., 900  sl  local_address rem_address   st tx_queue rx_queue tr tm->when retrnsmt   uid  timeout inode                                                     
   0: 00000000:0915 00000000:0000 0A 00000000:00000000 00:00000000 00000000     0        0 69736 1 ffff9f59772fc600 100 0 0 10 0                     
   1: 3500007F:0035 00000000:0000 0A 00000000:00000000 00:00000000 00000000   102        0 31698 1 ffff9f59772f9a40 100 0 0 10 0                     
   2: 00000000:0016 00000000:0000 0A 00000000:00000000 00:00000000 00000000     0        0 38399 1 ffff9f5972c3a300 100 0 0 10 5                     
   3: 0100007F:0277 00000000:0000 0A 00000000:00000000 00:00000000 00000000     0        0 38548 1 ffff9f5972c3b480 100 0 0 10 0                     
   4: 0100007F:A879 00000000:0000 0A 00000000:00000000 00:00000000 00000000     0        0 44812 1 ffff9f59772fd780 100 0 0 10 0                     
) = 900
read(3, "", 131072)                     = 0
munmap(0x7ff5ebc5d000, 139264)          = 0
close(3)                                = 0
close(1)                                = 0
close(2)                                = 0
exit_group(0)                           = ?
+++ exited with 0 +++

Tried also using ltrace but it's returning an empty output...

So how can I determinate which function is used without knowing all the kernel and without googling it?

0

I don't think you can trace kernel calls simply with userspace tools. What you are probably looking for is ftrace, then you could (if your kernel supports it) do something like this:

sysctl kernel.ftrace_enabled=1
echo function_graph > /sys/kernel/debug/tracing/current_tracer
echo 1 > /sys/kernel/debug/tracing/tracing_on
cat /proc/net/tcp
echo 0 > /sys/kernel/debug/tracing/tracing_on
less /sys/kernel/debug/tracing/trace

For further information on what exactly goes on when you read /proc/net/tcp, you could download the kernel source files and/or read the kernel documentation, eg. about the virtual filesystem, /proc and the seq_file interface.

As the /proc filesystem is a kernel feature to make system information available to userspace, I don't know if it's possible to hide sockets from netstat (cf. How can I edit /proc/net/tcp?).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.