LSM-Howto: Kernelmodule with non exported functions

Question

I'm currently writing a Linux Kernel module which depends on the Linux Security Modules (LSM) at the moment it is nothing really, I just wanted to print out a simple message whenever a file is opened. The problem is: To register to the hook I need the function register_security, which - I found out after googleing - isn't exported anymore and thus can't be used by loadable kernel modules - only by modules which are compiled directly into the kernel. Of course this makes sense for a security module, but it suckes for me developing. So now the question to you: Is there a way of patching my module into the kernel? I mean, I don't want to recompile my kernel after every bugfix or for every minor change. I could live with rebooting my pc for every new try, but recompiling would take a little bit to long I guess..

Edit: Hm, noone yet :( I just had an idea, maybe someone can tell me if it's good or not: Can't I just add the EXPORT_SYMBOL in the kernel source for the functions I need, then recompile it and then add my code as a module? Of course this would be just for testing and debugging

Does this answer your question? [Proper way of getting the address of non-exported kernel symbols in a Linux kernel module](https://stackoverflow.com/questions/70930059/proper-way-of-getting-the-address-of-non-exported-kernel-symbols-in-a-linux-kern) — Marco Bonelli, Jun 15 '22 at 22:16

score 0 · Answer 1 · answered Mar 11 '11 at 08:32

0

Can't you just use fsnotify in kernel, or fanotify from user space?

It's not generally a good idea to export functions that the author didn't think it would be a good idea to export. If you call a function that isn't part of the public interface and that function has a side effect, you will probably break things. Besides, your module won't work on other machines, but maybe you don't care about this.

answered Mar 11 '11 at 08:32

rlibby

5,931
20
25

Yea, I know that it would be kind of a workaround. But I'd do it just for testing purposes. And as I'm testing within a VM breaking things is not a problem – michael Mar 11 '11 at 10:01

score 0 · Answer 2 · edited Apr 04 '11 at 16:10

No, there is not. When a symbol is not exported, the in-kernel linker will not be able to find it. But adding the export to the kernel you use for testing should be OK. You can add your module to the export list by adding it to ./include/linux/Kbuild.

Also if testing in (user-mode-linux)[http://user-mode-linux.sourceforge.net/] or in virtual box, recompiling whole kernel might not be that big problem.

score 0 · Answer 3 · answered May 05 '11 at 16:30

This may be a bit late as I see your question a while back. What I found to be a good solution is to write a module that you compile into the kernel and just exports the couple of functions you what to play with.

For example

//REGISTER FILE_PERMISSION
static void k_register_file_permission(int (*my_file_permission) (struct file *file, int mask)) {
  my_file_permission_func = my_file_permission;
}
EXPORT_SYMBOL(k_register_file_permission);

Then you can just call k_register_file_permission from your kernel module, handy durring the development process.

You would also need a function like

int k_file_permission (struct file *file, int mask) {
  if(my_file_permission_func == NULL) 
  {
    //do nothing
  }
  else
  {
    return my_file_permission_func(file, mask);
  }
  return 0;
}

That you would register with the LSM at boot time.

LSM-Howto: Kernelmodule with non exported functions

3 Answers3