Problems doing syscall hooking

Question

I use the following module code to hooks syscall, (code credited to someone else, e.g., Linux Kernel: System call hooking example).

#include <linux/kernel.h>
#include <linux/module.h>
#include <linux/moduleparam.h>
#include <linux/unistd.h>
#include <asm/semaphore.h>
#include <asm/cacheflush.h>

void **sys_call_table;

asmlinkage int (*original_call) (const char*, int, int);

asmlinkage int our_sys_open(const char* file, int flags, int mode)
{
   printk(KERN_ALERT "A file was opened\n");
   return original_call(file, flags, mode);
}

int set_page_rw(long unsigned int _addr)
{
   struct page *pg;
   pgprot_t prot;
   pg = virt_to_page(_addr);
   prot.pgprot = VM_READ | VM_WRITE;
   return change_page_attr(pg, 1, prot);
}

int init_module()
{
    // sys_call_table address in System.map
    sys_call_table = (void*)0xffffffff804a1ba0;
    original_call = sys_call_table[1024];
    set_page_rw(sys_call_table);
    sys_call_table[1024] = our_sys_open;
    return 0;
}

void cleanup_module()
{
   // Restore the original call
   sys_call_table[1024] = original_call;
}

When insmod the compiled .ko file, terminal throws "Killed". When looking into 'cat /proc/modules' file, I get the Loading status.

my_module 10512 1 - Loading 0xffffffff882e7000 (P)

As expected, I can not rmmod this module, as it complains its in use. The system is rebooted to get a clean-slate status.

Later on, after commenting two code lines in the above source sys_call_table[1024] = our_sys_open; and sys_call_table[1024] = original_call;, it can insmod successfully. More interestingly, when uncommenting these two lines (change back to the original code), the compiled module can be insmod successfully. I dont quite understand why this happens? And is there any way to successfully compile the code and insmod it directly?

I did all this on Redhat with linux kernel 2.6.24.6.

Quentin Casasnovas · Answer 1 · 2011-11-28T22:23:27.803

I think you should take a look to the kprobes API, which is well documented in Documentation/krpobes.txt. It gives you the ability to install handler on every address (e.g. syscall entry) so that you can do what you want. Added bonus is that your code would be more portable.

If you're only interested in tracing those syscalls you can use the audit subsystem, coding your own userland daemon which will be able to receive events on a NETLINK socket from the audit kthread. libaudit provides a simple API to register/read events.

If you do have a good reason with not using kprobes/audit, I would suggest that you check that the value you are trying to write to is not above the page that you set writable. A quick calculation shows that:

offset_in_sys_call_table * sizeof(*sys_call_table) = 1024 * 8 = 8192

which is two pages after the one you set writable if you are using 4K pages.

Problems doing syscall hooking

1 Answers1