0

I'm currently doing some project of secure the kernel with syscall hooking and logs... Now I've done hooking read, and socket system calls, and when I tried to do the same thing with execve (to follow which file have just executed) I get a kernel ops or just I did something wrong because I can't even open the dmesg to see what error I have (dmesg is also executable, and I just overrided that function of running executable files). I also found out that there is something called stub_execve, and you can't just change the systam call from the systam calls table, because there are system calls that wrapped with another binary or something like that (please fix me if I'm wrong). So at the end, all I need to do is to see what files have just runned and I need to do it through a kernel module, does anybody think of how to do it, or how to jump over the stub_execve or something like this..? Please help me, I'll be very thankful.

closed as too broad by G-Man, Stephen Rauch, Satō Katsura, Archemar, dr01 Oct 19 '17 at 9:07

Please edit the question to limit it to a specific problem with enough detail to identify an adequate answer. Avoid asking multiple distinct questions at once. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

0

Have you looked into kprobes? Or specifically jprobes.

Using jprobe you can hook into execve (or any other kernel function), check its arguments etc just before that function gets executed. The way it works is, caller provides a function with same signature as the one which it wants to trace, and registers it with a call to jprobe_register. Let's call that function my_execve. Then just before executing the actual function, kernel would first save all its context (parameters, register values etc) on stack and pass control to my_execve, passing in a copy of that context. When my_execve returns (using jprobe_return instead of return), kernel restores saved context for original function execve and resumes execution. This means any changes you make to the context won't affect execution of original function. You can see an example here: https://github.com/bytefire/esct/blob/master/esct.c.

If instead you want to manipulate the context, e.g. change values in registers, then use kprobes, which follow similar pattern but have slightly more involved semantics.

Not the answer you're looking for? Browse other questions tagged or ask your own question.