how to get filename of execve() system call from kernel module which install hook to syscall table to intercept original syscall in kernels before 4.2 and atter 4.2 ? X86_64

[valdis.kletnieks at vt.edu]

On Wed, 08 Mar 2017 15:20:57 +0300, Lev Olshvang said:

> Hi Greg,
>  
> Thank you for a prompt reply. My intention is to build some euristics for
> Intrusion detection of embedded based on sequence of syscalls.
> I am collecting syscall events and send then with netlink to my monitor.
> Since platform may use SELinux or other LSM, I thought the hook of syscall is
> the only point I can use to catch syscalls.
>  
> Is it wrong direction ?

SELinux supports being stacked with a "small" LSM that can do what you want.

Or use the already-provided audit function to track syscalls and send them
to userspace via netlink to your monitor.
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 484 bytes
Desc: not available
Url : http://lists.kernelnewbies.org/pipermail/kernelnewbies/attachments/20170308/b64078e1/attachment.bin