File: //etc/init.d/ics-agent-file-stop
#!/bin/bash
#
# ics-agent-file Start/Stop anti-virus service
#
# chkconfig: 2345 99 01
# description: Start/Stop anti-virus service
### BEGIN INIT INFO
# Provides: ics-agent-file
# Required-Start: $local_fs
# Required-Stop: $local_fs
# Should-Start:
# Default-Start: 2 3 4 5
# Default-Stop: 0 1 6
# Description: Start/Stop the icsfilesec
### END INIT INFO
export PATH=$PATH:/usr/bin:/bin:/usr/sbin:/sbin:/usr/local/bin:/usr/local/sbin:/opt/bin:/root/bin
export LD_LIBRARY_PATH=/opt/nubosh/vmsec-host/file/lib/
log=/opt/nubosh/vmsec-host/file/log/start.log
function export_kallsyms {
kallsyms="/tmp/kallsyms"
[ -f "kallsyms" ] && rm -f ${kallsyms}
cp -f /proc/kallsyms $kallsyms
}
syshook_dir=/opt/nubosh/vmsec-host/file/syshook
SYSHOOK_VERSION_LIMIT="0.9.9"
function check_syshook {
lsmod | grep -w syshook_linux >/dev/null 2>&1 || return 0
hook_ver=`cat /proc/syshook/version | head -n 1 | awk '{print $1}'`
for((i=1; i<4; i++))
do
limit_exp=`echo $SYSHOOK_VERSION_LIMIT | awk -vidx=$i -F'.' '{print $idx}'`
act_conf=`echo $hook_ver | awk -vidx=$i -F'.' '{print $idx}'`
if [ $limit_exp -gt $act_conf ]; then
echo "The version of syshook [$hook_ver] less than expect [$SYSHOOK_VERSION_LIMIT]" >> $log
exit 1
fi
done
hook_num=`grep -w hook64_num /proc/syshook/status | awk -F'[ |:]' '{print $NF}'`
[ $hook_num -gt 0 ] && return 0 || echo "Status of kernel syshook is not normal" >> $log
exit 1
}
OS_TYPE=""
function get_os_release {
os_list=("/etc/os-release" "/etc/lsb-release" "/etc/issue" "/etc/SuSE-release" "/etc/redhat-release")
os_name=("centos" "red" "ubuntu" "suse" "isoft")
for os_file in ${os_list[@]}
do
[ -f $os_file ] || continue
for cur_name in ${os_name[@]}
do
grep -wi $cur_name $os_file >/dev/null && OS_TYPE=$cur_name || OS_TYPE=""
[ -n "$OS_TYPE" ] && break 2
done
done
#Map os_type to syshook folder
case $OS_TYPE in
centos) OS_TYPE="centos";;
red) OS_TYPE="centos";;
isoft) OS_TYPE="centos";;
ubuntu) OS_TYPE="ubuntu-generic";;
suse) OS_TYPE="suse-default";;
*) OS_TYPE="";;
esac
}
function load_syshook {
lsmod | grep -w syshook_linux >/dev/null 2>&1 && return 0
#find release type of os, such as centos, debian, suse, ubuntu and so on
get_os_release
[ -z "$OS_TYPE" ] && return 1
#OS_TYPE="centos" # for test only
if [ x"`uname -m`" = xx86_64 ];then
os_bit="x64"
else
os_bit="x86"
fi
syshook_path=$syshook_dir/$OS_TYPE/$os_bit
syshook_kof=$syshook_path/`uname -r | awk -F'.el|-generic|-default' '{print $1}'`/syshook_linux/syshook_linux.ko
if [ ! -h /opt/nubosh/vmsec-host/file/syshook/syshook_linux.ko ]; then
test -f $syshook_kof && ln -sf $syshook_kof /opt/nubosh/vmsec-host/file/syshook/syshook_linux.ko || return 1
fi
if [ -f /etc/redhat-release ]; then
rpm -qa|grep centos-release|grep centos-release-8.0 > /dev/null 2>&1
if [ $? -eq 0 ]; then
semodule -l|grep my-insmod > /dev/null 2>&1
if [ ! $? -eq 0 ]; then
ausearch -c 'insmod' --raw | audit2allow -M my-insmod >/dev/null 2>&1
semodule -i my-insmod.pp >/dev/null 2>&1
fi
val=''
getenforce > /dev/null 2>&1
if [ $? == 0 ]; then
val=`getenforce`
setenforce 0 > /dev/null 2>&1
insmod /opt/nubosh/vmsec-host/file/syshook/syshook_linux.ko >/dev/null 2>&1
if [ $? != 0 ]; then
mkdir -p /lib/modules/`uname -r`/extra/ >/dev/null 2>&1
cp /opt/nubosh/vmsec-host/file/syshook/syshook_linux.ko /lib/modules/`uname -r`/extra/ >/dev/null 2>&1
insmod /lib/modules/`uname -r`/extra/syshook_linux.ko >/dev/null 2>&1
fi
if [ x$val == "xEnforcing" ]; then
setenforce 1 > /dev/null 2>&1
fi
else
insmod /opt/nubosh/vmsec-host/file/syshook/syshook_linux.ko >/dev/null 2>&1
if [ $? != 0 ]; then
mkdir -p /lib/modules/`uname -r`/extra/ >/dev/null 2>&1
cp /opt/nubosh/vmsec-host/file/syshook/syshook_linux.ko /lib/modules/`uname -r`/extra/ >/dev/null 2>&1
insmod /lib/modules/`uname -r`/extra/syshook_linux.ko >/dev/null 2>&1
fi
fi
else
insmod /opt/nubosh/vmsec-host/file/syshook/syshook_linux.ko >/dev/null 2>&1
if [ $? != 0 ]; then
mkdir -p /lib/modules/`uname -r`/extra/ >/dev/null 2>&1
cp /opt/nubosh/vmsec-host/file/syshook/syshook_linux.ko /lib/modules/`uname -r`/extra/ >/dev/null 2>&1
insmod /lib/modules/`uname -r`/extra/syshook_linux.ko >/dev/null 2>&1
fi
fi
else
insmod /opt/nubosh/vmsec-host/file/syshook/syshook_linux.ko >/dev/null 2>&1
if [ $? != 0 ]; then
mkdir -p /lib/modules/`uname -r`/extra/ >/dev/null 2>&1
cp /opt/nubosh/vmsec-host/file/syshook/syshook_linux.ko /lib/modules/`uname -r`/extra/ >/dev/null 2>&1
insmod /lib/modules/`uname -r`/extra/syshook_linux.ko >/dev/null 2>&1
fi
fi
#insmod /opt/nubosh/vmsec-host/file/syshook/syshook_linux.ko
lsmod | grep -w syshook_linux >/dev/null 2>&1 && return 0 || return 1
}
function load_vmsecmod {
#if [ ! -f /opt/nubosh/vmsec-host/file/module/vmsecmod.ko ]; then
kof=/opt/nubosh/vmsec-host/file/module/vmsecmod-`uname -r`.`uname -m`.o
if [ ! -f $kof ]; then
un=`uname -r`
#Debian8
echo $un | grep "amd64" | grep -e "^3.16.0" > /dev/null 2>&1
if [ $? -eq 0 ]; then
kof=/opt/nubosh/vmsec-host/file/module/vmsecmod-3.16.0-4-amd64.x86_64.ko
fi
#CentOS 8
echo $un | grep "4\.18\.0-147" | grep "el8" > /dev/null 2>&1
if [ $? -eq 0 ]; then
kof=/opt/nubosh/vmsec-host/file/module/vmsecmod-4.18.0-147.el8.x86_64.x86_64.o
fi
echo $un | grep "4\.18\.0-193" | grep "el8" > /dev/null 2>&1
if [ $? -eq 0 ]; then
kof=/opt/nubosh/vmsec-host/file/module/vmsecmod-4.18.0-193.el8.x86_64.x86_64.o
fi
#CentOS 7
echo $un | grep -e "^3.10.0" > /dev/null 2>&1
if [ $? -eq 0 ]; then
#kof=/opt/nubosh/vmsec-host/file/module/vmsecmod-3.10.0-1127.el7.x86_64.x86_64.o
echo $un | grep -e "^3.10.0-1160" > /dev/null 2>&1
if [ $? -eq 0 ]; then
kof=/opt/nubosh/vmsec-host/file/module/vmsecmod-3.10.0-1160.el7.x86_64.x86_64.o
fi
echo $un | grep -e "^3.10.0-1127" > /dev/null 2>&1
if [ $? -eq 0 ]; then
kof=/opt/nubosh/vmsec-host/file/module/vmsecmod-3.10.0-1127.el7.x86_64.x86_64.o
fi
echo $un | grep -e "^3.10.0-1062" > /dev/null 2>&1
if [ $? -eq 0 ]; then
kof=/opt/nubosh/vmsec-host/file/module/vmsecmod-3.10.0-1062.el7.x86_64.x86_64.o
fi
echo $un | grep -e "^3.10.0-957" > /dev/null 2>&1
if [ $? -eq 0 ]; then
kof=/opt/nubosh/vmsec-host/file/module/vmsecmod-3.10.0-957.el7.x86_64.x86_64.o
fi
echo $un | grep -e "^3.10.0-862" > /dev/null 2>&1
if [ $? -eq 0 ]; then
kof=/opt/nubosh/vmsec-host/file/module/vmsecmod-3.10.0-862.el7.x86_64.x86_64.o
fi
echo $un | grep -e "^3.10.0-693" > /dev/null 2>&1
if [ $? -eq 0 ]; then
kof=/opt/nubosh/vmsec-host/file/module/vmsecmod-3.10.0-693.2.2.el7.x86_64.x86_64.o
fi
#506,514
echo $un | grep -e "^3.10.0-5" > /dev/null 2>&1
if [ $? -eq 0 ]; then
kof=/opt/nubosh/vmsec-host/file/module/vmsecmod-3.10.0-514.6.2.el7.x86_64.x86_64.o
fi
echo $un | grep -e "^3.10.0-327" > /dev/null 2>&1
if [ $? -eq 0 ]; then
kof=/opt/nubosh/vmsec-host/file/module/vmsecmod-3.10.0-327.el7.x86_64.x86_64.o
fi
echo $un | grep -e "^3.10.0-229" > /dev/null 2>&1
if [ $? -eq 0 ]; then
kof=/opt/nubosh/vmsec-host/file/module/vmsecmod-3.10.0-229.el7.x86_64.x86_64.o
fi
echo $un | grep -e "^3.10.0-123" > /dev/null 2>&1
if [ $? -eq 0 ]; then
kof=/opt/nubosh/vmsec-host/file/module/vmsecmod-3.10.0-123.el7.x86_64.x86_64.o
fi
echo $un | grep -e "^3.10.0-121" > /dev/null 2>&1
if [ $? -eq 0 ]; then
kof=/opt/nubosh/vmsec-host/file/module/vmsecmod-3.10.0-121.el7.x86_64.x86_64.o
fi
fi
#CentOS 6
echo $un | grep -e "^2.6.32-" > /dev/null 2>&1
if [ $? -eq 0 ]; then
kof=/opt/nubosh/vmsec-host/file/module/vmsecmod-2.6.32-573.el6.x86_64.x86_64.o
fi
echo $un | grep -e "^2.6.32-754" > /dev/null 2>&1
if [ $? -eq 0 ]; then
kof=/opt/nubosh/vmsec-host/file/module/vmsecmod-2.6.32-754.el6.x86_64.x86_64.o
fi
echo $un | grep -e "^2.6.32-696" > /dev/null 2>&1
if [ $? -eq 0 ]; then
kof=/opt/nubosh/vmsec-host/file/module/vmsecmod-2.6.32-696.10.2.el6.x86_64.x86_64.o
fi
echo $un | grep -e "^2.6.32-642" > /dev/null 2>&1
if [ $? -eq 0 ]; then
kof=/opt/nubosh/vmsec-host/file/module/vmsecmod-2.6.32-642.13.1.el6.x86_64.x86_64.o
fi
echo $un | grep -e "^2.6.32-504" > /dev/null 2>&1
if [ $? -eq 0 ]; then
kof=/opt/nubosh/vmsec-host/file/module/vmsecmod-2.6.32-573.el6.x86_64.x86_64.o
fi
echo $un | grep -e "^2.6.32-431" > /dev/null 2>&1
if [ $? -eq 0 ]; then
kof=/opt/nubosh/vmsec-host/file/module/vmsecmod-2.6.32-431.el6.x86_64.x86_64.o
fi
echo $un | grep -e "^2.6.32-358" > /dev/null 2>&1
if [ $? -eq 0 ]; then
kof=/opt/nubosh/vmsec-host/file/module/vmsecmod-2.6.32-358.el6.x86_64.x86_64.o
fi
echo $un | grep -e "^2.6.32-71" > /dev/null 2>&1
if [ $? -eq 0 ]; then
kof=/opt/nubosh/vmsec-host/file/module/vmsecmod-2.6.32-71.el6.x86_64.x86_64.o
fi
#oracle
echo $un | grep -e "^2.6.39-200" > /dev/null 2>&1
if [ $? -eq 0 ]; then
kof=/opt/nubosh/vmsec-host/file/module/vmsecmod-2.6.39-200.24.1.el6uek.x86_64.x86_64.o
fi
echo $un | grep -e "^4.1.12-94" > /dev/null 2>&1
if [ $? -eq 0 ]; then
kof=/opt/nubosh/vmsec-host/file/module/vmsecmod-4.1.12-94.3.9.el7uek.x86_64.x86_64.o
fi
#Ubuntu 12.04.5 or 14.04
echo $un | grep -e "3\.13\.0" | grep "generic" > /dev/null 2>&1
if [ $? -eq 0 ]; then
kof=/opt/nubosh/vmsec-host/file/module/vmsecmod-3.13.0-88-generic.`uname -m`.o
fi
echo $un | grep -e "4\.18\.0" | grep "generic" > /dev/null 2>&1
if [ $? -eq 0 ]; then
kof=/opt/nubosh/vmsec-host/file/module/vmsecmod-4.18.0-10-generic.`uname -m`.o
fi
#BCLinux 4.19.25
echo $un | grep -e "4\.19\.25" | grep "bclinux" > /dev/null 2>&1
if [ $? -eq 0 ]; then
kof=/opt/nubosh/vmsec-host/file/module/vmsecmod-4.19.25-200HG.el7.bclinux.x86_64.x86_64.o
fi
#euleros
echo $un | grep -e "^3.10.0-862.14.0.1" | grep "euleros" > /dev/null 2>&1
if [ $? -eq 0 ]; then
kof=/opt/nubosh/vmsec-host/file/module/vmsecmod-3.10.0-862.14.0.1.h137.eulerosv2r7.x86_64.x86_64.o
fi
#suse15
echo $un | grep -e "^4.12.14-23" > /dev/null 2>&1
if [ $? -eq 0 ]; then
kof=/opt/nubosh/vmsec-host/file/module/vmsecmod-4.12.14-23-default.x86_64.o
fi
if [ ! -f $kof ]; then
echo "Not supported kernel!"
return
fi
fi
ln -sf $kof /opt/nubosh/vmsec-host/file/module/vmsecmod.ko
#fi
sym=/proc/kallsyms
if [ ! -f $sym ]; then
sym=/boot/System.map-`uname -r`
else
vmagentmod_addr=$(awk '/ sys_call_table$/{print $1}' $sym)
if [ x"$vmagentmod_addr" = x ]; then
sym=/boot/System.map-`uname -r`
fi
fi
if [ ! -f $sym ]; then
echo "$sym not exist"
exit -2
fi
vmagentmod_addr=$(awk '/ sys_call_table$/{print $1}' $sym)
if [ x"$vmagentmod_addr" = x ]; then
vmagentmod_addr=0
fi
vmagentmod_execve_addr=$(awk '/ do_execve$/{print $1}' $sym)
if [ x"$vmagentmod_execve_addr" = x ]; then
vmagentmod_execve_addr=0
fi
if [ x"`uname -m`" = xx86_64 ]; then
vmagentmod_ret_addr=$(awk '/ int_ret_from_sys_call$/{print $1}' $sym)
if [ x"$vmagentmod_ret_addr" = x ]; then
vmagentmod_ret_addr=0
fi
#vmagentmod_ia32_addr=$(awk '/ ia32_sys_call_table$/{print $1}' $sym)
#if [ x"$vmagentmod_ia32_addr" = x ]; then
# vmagentmod_ia32_addr=0
#fi
#vmagentmod_compat_do_execve_addr=$(awk '/ compat_do_execve$/{print $1}' $sym)
#if [ x"$vmagentmod_compat_do_execve_addr" = x ]; then
# vmagentmod_compat_do_execve_addr=0
#fi
fi
lsmod | grep -w syshook_linux >/dev/null 2>&1 && syshook_enable=1 || syshook_enable=0
lsmod | grep vmsecmod > /dev/null
if [ $? == 0 ]; then
major=$(awk "\$2==\"vmagentdev\" {print \$1}" /proc/devices)
rm -rf /dev/vmagentdev >/dev/null 2>&1
mknod --mode=640 /dev/vmagentdev c $major 0 >/dev/null 2>&1
echo "ics-agent-file kernel module already loaded!"
else
if [ x"`uname -m`" = xx86_64 ]; then
if [ x"$syshook_enable" = x1 ];then
param="vmagentmod_debug=0 syshook_enable=1"
else
param="vmagentmod_debug=0 syshook_enable=0 vmagentmod_addr=0x$vmagentmod_addr vmagentmod_execve_addr=0x$vmagentmod_execve_addr vmagentmod_ret_addr=0x$vmagentmod_ret_addr"
fi
if [ -f /etc/redhat-release ]; then
rpm -qa|grep centos-release|grep centos-release-8.0 > /dev/null 2>&1
if [ $? -eq 0 ]; then
semodule -l|grep my-insmod > /dev/null 2>&1
if [ ! $? -eq 0 ]; then
ausearch -c 'insmod' --raw | audit2allow -M my-insmod
semodule -i my-insmod.pp
fi
val=''
getenforce > /dev/null 2>&1
if [ $? == 0 ]; then
val=`getenforce`
setenforce 0 > /dev/null 2>&1
insmod /opt/nubosh/vmsec-host/file/module/vmsecmod.ko $param >/dev/null 2>&1
if [ $? != 0 ]; then
mkdir -p /lib/modules/`uname -r`/extra/ >/dev/null 2>&1
cp /opt/nubosh/vmsec-host/file/module/vmsecmod.ko /lib/modules/`uname -r`/extra/ >/dev/null 2>&1
insmod /lib/modules/`uname -r`/extra/vmsecmod.ko $param >/dev/null 2>&1
fi
if [ x$val == "xEnforcing" ]; then
setenforce 1 > /dev/null 2>&1
fi
else
insmod /opt/nubosh/vmsec-host/file/module/vmsecmod.ko $param >/dev/null 2>&1
if [ $? != 0 ]; then
mkdir -p /lib/modules/`uname -r`/extra/ >/dev/null 2>&1
cp /opt/nubosh/vmsec-host/file/module/vmsecmod.ko /lib/modules/`uname -r`/extra/ >/dev/null 2>&1
insmod /lib/modules/`uname -r`/extra/vmsecmod.ko $param >/dev/null 2>&1
fi
fi
else
insmod /opt/nubosh/vmsec-host/file/module/vmsecmod.ko $param >/dev/null 2>&1
if [ $? != 0 ]; then
mkdir -p /lib/modules/`uname -r`/extra/ >/dev/null 2>&1
cp /opt/nubosh/vmsec-host/file/module/vmsecmod.ko /lib/modules/`uname -r`/extra/ >/dev/null 2>&1
insmod /lib/modules/`uname -r`/extra/vmsecmod.ko $param >/dev/null 2>&1
fi
fi
else
insmod /opt/nubosh/vmsec-host/file/module/vmsecmod.ko $param >/dev/null 2>&1
if [ $? != 0 ]; then
mkdir -p /lib/modules/`uname -r`/extra/ >/dev/null 2>&1
cp /opt/nubosh/vmsec-host/file/module/vmsecmod.ko /lib/modules/`uname -r`/extra/ >/dev/null 2>&1
insmod /lib/modules/`uname -r`/extra/vmsecmod.ko $param >/dev/null 2>&1
fi
fi
else
if [ x"$syshook_enable" = x1 ];then
param="vmagentmod_debug=0 syshook_enable=1"
else
param="vmagentmod_debug=0 syshook_enable=0 vmagentmod_addr=0x$vmagentmod_addr vmagentmod_execve_addr=0x$vmagentmod_execve_addr"
fi
insmod /opt/nubosh/vmsec-host/file/module/vmsecmod.ko $param >/dev/null 2>&1
fi
echo "$param" >> $log
lsmod | grep vmsecmod > /dev/null
if [ $? != 0 ]; then
echo "start kernel mode failed" >> $log
echo "start kernel mode failed"
exit 1
fi
major=$(awk "\$2==\"vmagentdev\" {print \$1}" /proc/devices)
rm -rf /dev/vmagentdev
mknod --mode=640 /dev/vmagentdev c $major 0
sleep 2
echo "kernel mode loaded"
echo "kernel mode loaded" >> $log
fi
}
function unload_vmsecmod {
lsmod | grep vmsecmod > /dev/null 2>&1
if [ $? == 0 ]; then
rmmod vmsecmod > /dev/null 2>&1
unlink /var/lock/subsys/vmsecmod > /dev/null 2>&1
unlink /dev/vmagentdev > /dev/null 2>&1
sleep 2
else
unlink /var/lock/subsys/vmsecmod > /dev/null 2>&1
unlink /dev/vmagentdev > /dev/null 2>&1
fi
}
case "$1" in
start)
echo -n "Starting ics-agent-file: "
check_syshook
load_syshook
if [ $? -ne 0 ]; then
echo "load syshook kernel failed."
echo "load self define hook kernel"
#exit 1
fi
export_kallsyms
load_vmsecmod
ulimit -c 0
if [ -f /opt/nubosh/vmsec-host/file/bin/icsfilesec.pid ]; then
/bin/rm -f /opt/nubosh/vmsec-host/file/bin/icsfilesec.pid
fi
/opt/nubosh/vmsec-host/file/bin/icsfilesec
echo "Done."
;;
stop)
# stop ics-agent-file
echo -n "Stopping ics-agent-file: "
kill `cat /opt/nubosh/vmsec-host/file/bin/icsfilesec.pid` > /dev/null 2>&1
for j in `seq 5`
do
sleep 1
if test $( pgrep -f bin/icsfilesec | wc -l ) -eq 0
then
break
fi
done
cn="`ps -ef|grep bin/icsfilesec | grep -v grep |wc -l`"
if [ $cn -gt 0 ]; then
pgrep icsfilesec | xargs kill -9 >/dev/null 2>&1
fi
sleep 1
unload_vmsecmod
echo "Done."
;;
status)
cn="`ps -ef|grep bin/icsfilesec | grep -v grep |wc -l`"
if [ $cn -gt 0 ]; then
echo $"ics-agent-file is running..."
retval=0
else
echo $"ics-agent-file is stopped"
fi
;;
restart)
echo -n "Stopping ics-agent-file: "
kill `cat /opt/nubosh/vmsec-host/file/bin/icsfilesec.pid` > /dev/null 2>&1
for j in `seq 20`
do
sleep 1
if test $( pgrep -f bin/icsfilesec | wc -l ) -eq 0
then
break
fi
done
sleep 2
echo "Done."
echo -n "Starting ics-agent-file: "
check_syshook
load_syshook
if [ $? -ne 0 ]; then
echo "Load syshook kernel failed."
echo "Load self define hook kernel"
#exit 1
fi
export_kallsyms
load_vmsecmod
ulimit -c 0
if [ -f /opt/nubosh/vmsec-host/file/bin/icsfilesec.pid ]; then
/bin/rm -f /opt/nubosh/vmsec-host/file/bin/icsfilesec.pid
fi
/opt/nubosh/vmsec-host/file/bin/icsfilesec
echo "Done."
;;
reload)
echo -n "Not work currently"
;;
*)
echo "Usage: {start|stop|status|reload}" >&2
exit 1
;;
esac
exit 0