On Wed, Nov 23, 2011 at 6:05 PM, Geraint Yang <geraint0923@gmail.com> wrote:
Hi, I have tried the LSM framework,but when I make my module , I got "waining:'register_security' undefined", then I check security/security.c and found out that register_security is not exported ! So if I want to use this function ,I must hack kernel by exporting and recompiling kernel which is allowed for me. So ...well, it seems that LSM doesn't work for module without modifying the kernel source.
On Thu, Nov 24, 2011 at 12:59 AM, Alexandru Juncu <alex.juncu@rosedu.org> wrote:
On Wed, Nov 23, 2011 at 6:50 PM, Geraint Yang <geraint0923@gmail.com> wrote:
Hi, Thank all of you for helping me with problem! I don't want to modify my kernel source so I am trying to learn to use LSM security hook even though it seems that it couldn't hook all the system calls, I think it should be enough for me. Thanks again!
I know that AppArmor can hock syscalls like read, write and memory mapping and can deny or accept them. I am not sure if you can make it do something else when hocked, but I know it has a script-like configuration, so maybe you can take some other actions.
If you can hook the system calls, you could try KProbes, is a dynamic instrumentation, that is used in Linux Kernel. You could use a JProbe to "capture" the function parameters of the instrumented function. If you have KProbes in your kernel, you can create a module to instrument the syscall that you want. Maybe it can be a starting point for you ... Other projects that use KProbes are DProbes and SystemTap, you can also give it a look.
-- Geraint Yang Tsinghua University Department of Computer Science and Technology
_______________________________________________ Kernelnewbies mailing list Kernelnewbies@kernelnewbies.org http://lists.kernelnewbies.org/mailman/listinfo/kernelnewbies
-- Nuno Martins