sys_unameをフックして書き換えた場合の注意事項


恐らく誰の問題も解決しないであろう記事です。

rootkitを試してみようと思ってシステムコールを書き換えることがあります。
例として `uname` をよく見かけるので、試した人も多いかと思います。

```console
$ uname -a
Linux vagrant-centos65.vagrantup.com 2.6.32-431.3.1.el6.x86_64 #1 SMP Fri Jan 3 21:39:27 UTC 2014 x86_64 x86_64 x86_64 GNU/Linux
$ sudo insmod uname_replace.ko
$ uname -a
Windows vagrant-centos65.vagrantup.com 2.6.32-431.3.1.el6.x86_64 #1 SMP Fri Jan 3 21:39:27 UTC 2014 x86_64 x86_64 x86_64 GNU/Linux
```

こんな感じで `uname` が書き換わるんだなぁってやってたとします。

その後、忘れて `yum` でインストールしようとすると、以下みたいなエラーが出ます。

```shell-session
$ sudo yum -y install wget
Loaded plugins: fastestmirror, versionlock
Setting up Install Process
Loading mirror speeds from cached hostfile
 * base: ftp.iij.ad.jp
 * epel: ftp.riken.jp
 * extras: ftp.iij.ad.jp
 * updates: ftp.iij.ad.jp
Resolving Dependencies
--> Running transaction check
---> Package wget.x86_64 0:1.12-8.el6 will be installed
--> Finished Dependency Resolution

Dependencies Resolved

========================================================================================================================================
 Package                       Arch                            Version                              Repository                     Size
========================================================================================================================================
Installing:
 wget                          x86_64                          1.12-8.el6                           base                          484 k

Transaction Summary
========================================================================================================================================
Install       1 Package(s)

Total size: 484 k
Installed size: 1.8 M
Downloading Packages:
Running rpm_check_debug
Running Transaction Test


Transaction Check Error:
  package wget-1.12-8.el6.x86_64 is intended for a linux operating system

Error Summary
-------------

```


>package wget-1.12-8.el6.x86_64 is intended for a linux operating system

って言われるけどこれLinuxだし正しいよな...と思っていたのですが、ふと `uname` のシステムコールをいじったことを思い出しまして、 `uname` を元に戻してみました。

```
$ sudo rmmod uname_replace
$ uname -a
Linux vagrant-centos65.vagrantup.com 2.6.32-431.3.1.el6.x86_64 #1 SMP Fri Jan 3 21:39:27 UTC 2014 x86_64 x86_64 x86_64 GNU/Linux
```

この状態でインストールしてみます。

```shell-session
$ sudo yum -y install wget
Loaded plugins: fastestmirror, versionlock
Setting up Install Process
Loading mirror speeds from cached hostfile
 * base: ftp.iij.ad.jp
 * epel: ftp.riken.jp
 * extras: ftp.iij.ad.jp
 * updates: ftp.iij.ad.jp
Resolving Dependencies
--> Running transaction check
---> Package wget.x86_64 0:1.12-8.el6 will be installed
--> Finished Dependency Resolution

Dependencies Resolved

========================================================================================================================================
 Package                       Arch                            Version                              Repository                     Size
========================================================================================================================================
Installing:
 wget                          x86_64                          1.12-8.el6                           base                          484 k

Transaction Summary
========================================================================================================================================
Install       1 Package(s)

Total size: 484 k
Installed size: 1.8 M
Downloading Packages:
Running rpm_check_debug
Running Transaction Test
Transaction Test Succeeded
Running Transaction
  Installing : wget-1.12-8.el6.x86_64                                                                                               1/1
  Verifying  : wget-1.12-8.el6.x86_64                                                                                               1/1

Installed:
  wget.x86_64 0:1.12-8.el6

Complete!
```


はい。ということでシステムコール書き換えたLinux使い続けるなよ...という内容でしたが、yumではunameを使ってOSを確認してるんだなーと知りました。