[PATCH 1/2] x86: Prevent syscall hooking

[Elly I. Esparza]

Kprobes can be used by rootkits to find the address of x64_sys_call(),
x32_sys_call() and ia32_sys_call(). This in turn allows for the rootkits
to find an specific syscall handler and hook it.

Add x64_sys_call(), x32_sys_call() and ia32_sys_call() to the kprobes
blacklist.

Signed-off-by: Elly I. Esparza <ellyesparza8@xxxxxxxxx>
---
 arch/x86/entry/syscall_32.c | 2 ++
 arch/x86/entry/syscall_64.c | 3 +++
 2 files changed, 5 insertions(+)

diff --git a/arch/x86/entry/syscall_32.c b/arch/x86/entry/syscall_32.c
index 2b15ea17bb7c..75d34d2c8067 100644
--- a/arch/x86/entry/syscall_32.c
+++ b/arch/x86/entry/syscall_32.c
@@ -1,6 +1,7 @@
 // SPDX-License-Identifier: GPL-2.0-only
 /* 32-bit system call dispatch */
 
+#include <linux/kprobes.h>
 #include <linux/linkage.h>
 #include <linux/sys.h>
 #include <linux/cache.h>
@@ -48,6 +49,7 @@ long ia32_sys_call(const struct pt_regs *regs, unsigned int nr)
 	default: return __ia32_sys_ni_syscall(regs);
 	}
 }
+NOKPROBE_SYMBOL(ia32_sys_call)
 
 static __always_inline int syscall_32_enter(struct pt_regs *regs)
 {
diff --git a/arch/x86/entry/syscall_64.c b/arch/x86/entry/syscall_64.c
index b6e68ea98b83..1e8045a499d4 100644
--- a/arch/x86/entry/syscall_64.c
+++ b/arch/x86/entry/syscall_64.c
@@ -1,6 +1,7 @@
 // SPDX-License-Identifier: GPL-2.0-only
 /* 64-bit system call dispatch */
 
+#include <linux/kprobes.h>
 #include <linux/linkage.h>
 #include <linux/sys.h>
 #include <linux/cache.h>
@@ -39,6 +40,7 @@ long x64_sys_call(const struct pt_regs *regs, unsigned int nr)
 	default: return __x64_sys_ni_syscall(regs);
 	}
 }
+NOKPROBE_SYMBOL(x64_sys_call)
 
 #ifdef CONFIG_X86_X32_ABI
 long x32_sys_call(const struct pt_regs *regs, unsigned int nr)
@@ -48,6 +50,7 @@ long x32_sys_call(const struct pt_regs *regs, unsigned int nr)
 	default: return __x64_sys_ni_syscall(regs);
 	}
 }
+NOKPROBE_SYMBOL(x32_sys_call)
 #endif
 
 static __always_inline bool do_syscall_x64(struct pt_regs *regs, int nr)
-- 
2.43.0