I am grabbing the LSM hooks in my own created module and showing into the securityfs psuedo filesystem which is showing correctly.
The path where these hooks are showing is
Now for example when mmap is called, I can show its number into securityfs.
What I need is I want to know about the PID(Process ID) who called mmap system call and can show into the same filesystem. If someone want I can put the code here.
This thing is happening in SELinux but that need its source code analysis which is a time consuming job, if someone can help here that ill safe lot of my time. I am using Linux kernel 3.2.