<br><br><div class="gmail_quote">On Thu, Sep 22, 2011 at 1:53 PM, Abhijit Pawar <span dir="ltr"><<a href="mailto:apawar.linux@gmail.com">apawar.linux@gmail.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex;">
hi list,<br>
Is there any way to hook the exec system call on Linux box apart from<br>
replacing the call in System Call table?<br>
<br>
Regards,<br>
Abhijit Pawar<br>
<br>
_______________________________________________<br>
Kernelnewbies mailing list<br>
<a href="mailto:Kernelnewbies@kernelnewbies.org">Kernelnewbies@kernelnewbies.org</a><br>
<a href="http://lists.kernelnewbies.org/mailman/listinfo/kernelnewbies" target="_blank">http://lists.kernelnewbies.org/mailman/listinfo/kernelnewbies</a><br>
</blockquote></div><br>Tidy way : -<br><br>You can do that from LSM (Linux security module).<br><br>Untidy way : -<br>Yes, you can do that by registering a new binary format handler. Whenever exec is called, a list of registered binary format handlers is scanned, in the same way you can hook the load_binary & load_library function pointers of the already registered binary format handlers.<br>
<br>Regards,<br>Rohan Puri<br>