7

Is it possible for a user to run their own program in kernel mode? How could a user accomplish this? What weakness in the system's protection mechanism would they have to bypass?

I'm thinking that a user program can switch the mode bit from user mode to kernel mode in the interrupt vector and then it can execute any interrupt handlers that it wants. Am I on the right track?

| improve this question | |
  • 1
    Something that started here: linuxjournal.com/article/6516 and ended up here: freecode.com/projects/kml might be interesting to you. I don't think you are going to get anything that can "execute any interrupt handlers that it wants", tho. – goldilocks Sep 18 '13 at 15:57
  • @goldilocks why not writing this as an answer? As for interrupt handlers - once you have kernel memory access, what's preventing you from just calling the interrupt handler? Apart from that it's nothing one should do without knowing exactly what he's doing. – peterph Sep 18 '13 at 16:46
  • @peterph : Because I haven't used it, and I'm not going to give it a whirl today, lol. WRT the interrupt handlers, they're not called, they're callbacks -- so you'd have to have a means of triggering the IRQ (?) and unless you can also use the kernel ABI in the program code, you couldn't really examine or work with the handlers. Seems to me it would just be easier to write an LKM with a userspace interface to do whatever you want. But I'm getting out of my depth ;) – goldilocks Sep 18 '13 at 17:01
  • @goldilocks I still think it would qualify as a good answer. Interrupts - no matter what they are, the code is there (as well as the symbol). If nothing else, you could just jump to the address referred by the architecture dependent interrupt machinery. It would be rather silly though. The reason for running in kernel mode is summarized in the project description - performance drops on context switches. For large HPC applications it can make perfect sense. – peterph Sep 18 '13 at 17:14
3

Users cannot run their own code in kernel mode. Kernel mode gives the program control over every aspect of the machine (of the virtual machine, if this is one). Running code in kernel mode would bypass every security measure.

You can run code in kernel mode by loading a module. Only root can load a module, of course (and this can be disabled for certain static, high-security configurations).

I don't know what you mean by “a user program can switch the mode bit from user mode to kernel mode in the interrupt vector”. User programs have no control over the interrupt vector, the kernel reserves that for itself.

| improve this answer | |
0

you can hook the system call and add onc that will be your program your program run it in kernel mode to add "systme call" you need to add line to the file /boot/system.map-kernel version to find your kernel version /proc/version LKM tool can help you do that

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.