Downloadable kernel module programming and intercepting system calls

Question

Suppose we want to intercept the exit system call and print a message to the console when any process calls it. To do this, we must write our own fake exit system call, and then force the kernel to call our fake exit function instead of the original exit call. At the end of our fake exit call, we can call the original exit call. To do this, we must manipulate the array of system call tables (sys_call_table). Armed with the sys_call_table array, we can manipulate it to make the sys_exit entry point into our new fake exit call. We must save the pointer to the original sys_exit call and call it when we finish printing our message to the console. Source:

#include <linux/kernel.h> #include <linux/module.h> #include <sys/syscall.h> extern void *sys_call_table[]; asmlinkage int (*original_sys_exit)(int); asmlinkage int our_fake_exit_function(int error_code) { /*print message on console every time we *are called*/ printk("HEY! sys_exit called with error_code=%d\n",error_code); /*call the original sys_exit*/ return original_sys_exit(error_code); } /*this function is called when the module is *loaded (initialization)*/ int init_module() { /*store reference to the original sys_exit*/ original_sys_exit=sys_call_table[__NR_exit]; /*manipulate sys_call_table to call our *fake exit function instead *of sys_exit*/ sys_call_table[__NR_exit]=our_fake_exit_function; } /*this function is called when the module is *unloaded*/ void cleanup_module() { /*make __NR_exit point to the original *sys_exit when our module *is unloaded*/ sys_call_table[__NR_exit]=original_sys_exit; } 

When I compile this program, I got a warning:

WARNING: "sys_call_table" [/home/roiht/driver/one.ko] undefined!

As I did the search, I found that the kernel version after 2.5 changed the concept of the sys_call table. So my question is, is this an alternative method for this in the new kernel version?

Answer 1

Any kernel variable can be used in a module if it is explicitly exported to the kernel using EXPORT_SYMBOL (). Starting with kernel version 2.6, the sys_call_table export is deleted. Therefore, if you want to use this approach, explicitly export the variable. As a convention, theis export is executed immediately after the variable is declared, but I assume that export from any file where this variable will be defined will also be performed. To check if the approach works, just look at the output of "cat / proc / kallsyms".

Another approach to capturing syscall output would be to include in the sysenter part of the syscall run. See here http://articles.manugarg.com/systemcallinlinux2_6.html for more details.

Answer 2

You can read the sys_call_table address from the System.map-xxx file corresponding to your kernel. Usually the file is located in the / boot directory, and the name is System.map-<kernel-version> , where kernel-version is the result of the uname -r command. You can use the module parameter to pass the address to your module.