Messages in this thread | | | Subject | Re: [PATCH 2.6.9] fork: add a hook in do_fork() | From | Guillaume Thouvenin <> | Date | Tue, 23 Nov 2004 15:14:28 +0100 |
| |
So I tried to implement a solution using LSM hook and I have a strange behavior. Here is the code of the module. It is just to test if I can get the pid of the parent and its new created child.
--- fork_hook_module.c [BEGIN] ---
#include <linux/module.h> /* for all modules */ #include <linux/kernel.h> /* for KERN_ALERT */ #include <linux/init.h> /* for the macros */ #include <linux/sched.h> /* for task_struct */ #include <linux/security.h> /* for LSM hook */
static int elsa_task_alloc_security(struct task_struct *p);
struct security_operations elsa_ops = { .task_alloc_security = elsa_task_alloc_security, };
static int elsa_task_alloc_security(struct task_struct *p) { printk(KERN_ALERT "intercept a fork: %d created by %d\n", p->pid, p->parent->pid);
return 0; }
static int __init fh_init(void) { printk(KERN_ALERT "fh: fork hook added\n"); if (register_security(&elsa_ops)) panic(KERN_ALERT "fh: Unable to register fork hook\n");
return 0; }
static void __exit fh_exit(void) { if (unregister_security(&elsa_ops)) printk(KERN_ALERT "fh: Unable to un-register with fork hook\n");
printk(KERN_ALERT "fh: fork hook removed\n"); }
module_init(fh_init); module_exit(fh_exit);
MODULE_AUTHOR("Guillaume Thouvenin"); MODULE_DESCRIPTION("Fork Hook"); MODULE_LICENSE("GPL");
--- fork_hook_module.c [END] ---
When I load the module, the hook is well registered. Now, if I run a command from a shell, like a 'top', the message in the kernel log like indicates a wrong parent ID. Here is the output of the top command:
PID PPID USER %CPU CPU COMMAND 2009 2008 guill 0.0 0 bash 2109 2108 guill 0.0 0 bash 2704 2109 guill 0.0 0 top
and here is the message found in the kernel log:
intercept a fork: 2704 created by 2108
It should be 2109... not 2108 I think that the problem occurs because the security_task_alloc() is called, the field p->parent is not set.
Is it true? and if it is, is it possible to move the hook after the initialization of the variable p->parent?
Regards, Guillaume
- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
| |