1

Is there a possibility to access the sys_call_table from my own module for Linux kernel 2.6+?

What are some links to articles or how-tos? I need a method without the necessity to modify the kernel source code. I know it was easy on the Linux 2.4 kernel, and you could use the external symbol. However, this ability was removed from kernel 2.6.

Improve this question
11
  • 2
    This ability was removed because it's usually the wrong way to do whatever it is you're trying to do, and because it makes things too easy for rootkits. What are you actually trying to do, in the end? Commented Jan 12, 2012 at 18:33
  • Trying to replace system calls with my own methods. Commented Jan 12, 2012 at 18:36
  • Module is always the wrong way to modify syscalls... Commented Jan 12, 2012 at 18:38
  • possible duplicate of sys_call_table in linux kernel 2.6.18 Commented Jan 12, 2012 at 18:39
  • 1
    @Roman Then kprobes (and particularly jprobes if all you need is tracing) are a particularly good fit for this job. It works by registering a handler with the same prototype of the function (or syscall in your case) that you want to trace. Each time the syscall will be hit, your handler will be called with the same arguments as the syscall just before. If you only want to do tracing, you could do everything in userland with the ftrace API. Commented Jan 14, 2012 at 11:00

3 Answers 3

Reset to default
2

As what you are really trying to do is replace a system call by your own function, I would recommend using kprobes for this kind of job, you can easily break on any kernel address (or symbol (e.g., sys_exit and sys_whateversyscall) and alter the execution path, all of this at runtime, with a kernel module if you need to :) It has a very low overhead.

Kprobes (or jprobes if you only to add your code to the system call as opposed to replace it completely) work by dynamically replacing an instruction (e.g. first instruction of your system call entry) by a break (e.g., int3 on x86). Inside the do_int3 handler, a notifier notifies kprobes, which in turn passes the execution to your registered function, from which point you can do almost anything.

A very good documentation is given in Documentation/kprobes.txt so as a tiny example in file samples/kprobes/kprobes_example.c (in this example, they break on do_fork to log each fork on the system). It has a very simple API and is very portable nowadays.

Improve this answer
Sign up to request clarification or add additional context in comments.

Comments

1

I've answered a few other questions similar to this one:

An in-depth explanation of my TPE LKM module that does this, see this explanation on my blog

NOTE: As mentioned in the comments to your question, this is not the proper way to do things. It's best if you recompile the kernel, though I do understand that there are situations where that is not an option.

Improve this answer

Comments

0

Since kernel 2.6.*, the system call table is not exported anymore. Here you can find how to reexport it:

Linux kernel rootkits: protecting the system's

Take a look on page 144.

Improve this answer

Comments

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.