I'm currently doing some project of secure the kernel with syscall hooking and logs... Now I've done hooking read, and socket system calls, and when I tried to do the same thing with execve (to follow which file have just executed) I get a kernel ops or just I did something wrong because I can't even open the dmesg to see what error I have (dmesg is also executable, and I just overrided that function of running executable files). I also found out that there is something called stub_execve, and you can't just change the systam call from the systam calls table, because there are system calls that wrapped with another binary or something like that (please fix me if I'm wrong). So at the end, all I need to do is to see what files have just runned and I need to do it through a kernel module, does anybody think of how to do it, or how to jump over the stub_execve or something like this..? Please help me, I'll be very thankful.
Have you looked into
kprobes? Or specifically
Using jprobe you can hook into
execve (or any other kernel function), check its arguments etc just before that function gets executed. The way it works is, caller provides a function with same signature as the one which it wants to trace, and registers it with a call to
jprobe_register. Let's call that function
my_execve. Then just before executing the actual function, kernel would first save all its context (parameters, register values etc) on stack and pass control to
my_execve, passing in a copy of that context. When
my_execve returns (using
jprobe_return instead of
return), kernel restores saved context for original function
execve and resumes execution. This means any changes you make to the context won't affect execution of original function. You can see an example here: https://github.com/bytefire/esct/blob/master/esct.c.
If instead you want to manipulate the context, e.g. change values in registers, then use
kprobes, which follow similar pattern but have slightly more involved semantics.