lkml.org 
[lkml]   [2004]   [Nov]   [23]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
SubjectRe: [PATCH 2.6.9] fork: add a hook in do_fork()
From
Date
 So I tried to implement a solution using LSM hook and I have a strange
behavior. Here is the code of the module. It is just to test if I can
get the pid of the parent and its new created child.

--- fork_hook_module.c [BEGIN] ---

#include <linux/module.h> /* for all modules */
#include <linux/kernel.h> /* for KERN_ALERT */
#include <linux/init.h> /* for the macros */
#include <linux/sched.h> /* for task_struct */
#include <linux/security.h> /* for LSM hook */

static int elsa_task_alloc_security(struct task_struct *p);

struct security_operations elsa_ops = {
.task_alloc_security = elsa_task_alloc_security,
};

static int elsa_task_alloc_security(struct task_struct *p)
{
printk(KERN_ALERT "intercept a fork: %d created by %d\n",
p->pid, p->parent->pid);

return 0;
}

static int __init fh_init(void)
{
printk(KERN_ALERT "fh: fork hook added\n");
if (register_security(&elsa_ops))
panic(KERN_ALERT "fh: Unable to register fork hook\n");

return 0;
}

static void __exit fh_exit(void)
{
if (unregister_security(&elsa_ops))
printk(KERN_ALERT
"fh: Unable to un-register with fork hook\n");

printk(KERN_ALERT "fh: fork hook removed\n");
}

module_init(fh_init);
module_exit(fh_exit);

MODULE_AUTHOR("Guillaume Thouvenin");
MODULE_DESCRIPTION("Fork Hook");
MODULE_LICENSE("GPL");

--- fork_hook_module.c [END] ---

When I load the module, the hook is well registered. Now, if I run a
command from a shell, like a 'top', the message in the kernel log like
indicates a wrong parent ID. Here is the output of the top command:

PID PPID USER %CPU CPU COMMAND
2009 2008 guill 0.0 0 bash
2109 2108 guill 0.0 0 bash
2704 2109 guill 0.0 0 top

and here is the message found in the kernel log:

intercept a fork: 2704 created by 2108

It should be 2109... not 2108
I think that the problem occurs because the security_task_alloc() is
called, the field p->parent is not set.

Is it true? and if it is, is it possible to move the hook after the
initialization of the variable p->parent?

Regards,
Guillaume

-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/

\
 
 \ /
  Last update: 2005-03-22 14:08    [W:1.203 / U:0.060 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site