rootkit
rootkit copied to clipboard
Kernel API Modernization: Refactor Deprecated File Operations.
Summary
This PR updates the file handling code to use modern kernel APIs by replacing the deprecated filp_close() function with fput() and improving error handling.
Changes Made
- Replaced
filp_close(file, 0)withfput(file)- Thefilp_close()function has been deprecated/removed in newer kernel versions. - Improved error handling - Changed from NULL check to
IS_ERR()for proper error detection withfilp_open() - Maintained backward compatibility - Changes work across multiple kernel versions.
Why This Change is
- Kernel Compatibility:
filp_close()was removed in Linux 4.9+ kernels, causing compilation failures. - Memory Safety:
fput()properly handles reference counting, preventing use-after-free vulnerabilities. - Stability: Using deprecated APIs can cause kernel panics and instability.
- Future-proofing: Ensures compatibility with current and future kernel versions.
Security Impact
- Improves stability of core file hiding functionality.
- Prevents potential kernel crashes from deprecated API usage.
- Maintains stealth capabilities while using proper kernel APIs.
Files Changed
rootkit.c- Updated get_fop() function with modern file handling.