Hooking exec system call | kernelnewbies | Ratatoskr

Hooking exec system call · Abhijit Pawar <hidden> · 2011-09-22
Hooking exec system call · Christophe Hauser <hidden> · 2011-09-22
Hooking exec system call · rohan puri <hidden> · 2011-09-22
Hooking exec system call · Rajat Sharma <hidden> · 2011-09-23
Hooking exec system call · Abhijit Pawar <hidden> · 2011-09-23
Hooking exec system call · rohan puri <hidden> · 2011-09-23
Hooking exec system call · Abhijit Pawar <hidden> · 2011-09-23
Hooking exec system call · rohan puri <hidden> · 2011-09-23
Hooking exec system call · Abhijit Pawar <hidden> · 2011-09-26
Hooking exec system call · rohan puri <hidden> · 2011-09-26
Hooking exec system call · Abhijit Pawar <hidden> · 2011-09-26
Hooking exec system call · rohan puri <hidden> · 2011-09-26
Hooking exec system call · Abhijit Pawar <hidden> · 2011-09-26
Hooking exec system call · rohan puri <hidden> · 2011-09-26
Hooking exec system call · Mulyadi Santosa <hidden> · 2011-09-22

Hooking exec system call

From: Christophe Hauser <hidden>
Date: 2011-09-22 08:50:01

On Thu, Sep 22, 2011 at 01:53:44PM +0530, Abhijit Pawar wrote:

hi list,
Is there any way to hook the exec system call on Linux box apart from 
replacing the call in System Call table?

Regards,
Abhijit Pawar

 
Hi,

you can do that with LSM (CONFIG_SECURITY) using the bprm_set_creds hook (see
include/linux/security.h).

-- 
Christophe