拦截Linux中执行的命令

Question

I need to know is it possible to intercept user executed command in loadable kernel module. I know that system calls can be intercepted such as open(). But what i need to do is intercepts user entered command/ process and add some validations. for example, if user enters cp command, before executing the command i need to perform some validations against it. If we cannot do this in LKM, what are the alternative approaches?

Answer 1

You need to look up how many actual system calls there are for execvp() and friends (probably 1, maybe 2 — it could be more, but probably isn't), and then intercept those system calls. You might need to worry about posix_spawn() and friends too. They're the only ways that new processes can be run. There isn't any other way to intercept them.

Answer 2

You could try using an LKM or a systemtap plugin(which compiles to an LKM). The kernel functions that you should hook are execve and execveat . In case you are doing this for programming fun and want to write hooking code by yourself, you might want to look at kprobes and know that you can get kernel function addresses from /proc/kallsyms .

Of course, recompiling the kernel with your own hooking code is another option if that is a possibility.

In both the cases above you probably want to intercept the execve calls made by a specific uid; if so, you should filter calls from that uid.

A userspace approach might be to try writing a seccomp filter. Here is a tutorial on how to go about writing one.