As part of auditing purpose I need to intercept/hook open/read/write system calls.<br><br>I tried with below sample program. When I do a insmod of the module that was built, my system was hanged. On some re-search I came to know that we can not modify system call table as it is read only.<br>
<br>void **sys_call_table;<br><br>asmlinkage int (*original_call) (const char*, int, int);<br><br>asmlinkage int our_sys_open(const char* file, int flags, int mode)<br>{<br> printk("A file was opened\n");<br> return original_call(file, flags, mode);<br>
}<br><br>int init_module()<br>{<br> // sys_call_table address in System.map<br> sys_call_table = (void*)0xc061e4e0;<br> original_call = sys_call_table[__NR_open];<br> sys_call_table[__NR_open] = our_sys_open;<br>
}<br><br>void cleanup_module()<br>{<br> // Restore the original call<br> sys_call_table[__NR_open] = original_call;<br>}<br><br>As I was lack of knowledge into kernel development.Could somebody help me out here ?<br>I'm working on RHEL-5 machine with Linux kernel version 2.6.18<br>
Thanks & Regards,<br>Ravi<br>