ftrace-hook | Using ftrace for function hooking in Linux kernel

by ilammy C Version: Current License: GPL-2.0

X-Ray Key Features Code Snippets Community Discussions(1)Vulnerabilities Install Support

kandi X-RAY | ftrace-hook Summary

ftrace-hook is a C library. ftrace-hook has no bugs, it has no vulnerabilities, it has a Strong Copyleft License and it has low support. You can download it from GitHub.

Using ftrace for function hooking in Linux kernel

Support

Quality

Security

License

Reuse

Support

ftrace-hook has a low active ecosystem.

It has 200 star(s) with 60 fork(s). There are 11 watchers for this library.

It had no major release in the last 6 months.

There are 5 open issues and 4 have been closed. On average issues are closed in 204 days. There are no pull requests.

It has a neutral sentiment in the developer community.

The latest version of ftrace-hook is current.

Quality

ftrace-hook has 0 bugs and 0 code smells.

Security

ftrace-hook has no vulnerabilities reported, and its dependent libraries have no vulnerabilities reported.

ftrace-hook code analysis shows 0 unresolved vulnerabilities.

There are 0 security hotspots that need review.

License

ftrace-hook is licensed under the GPL-2.0 License. This license is Strong Copyleft.

Strong Copyleft licenses enforce sharing, and you can use them when creating open source projects.

Reuse

ftrace-hook releases are not available. You will need to build from source code and install.

Top functions reviewed by kandi - BETA

kandi's functional review helps you automatically verify the functionalities of the libraries and avoid rework.
Currently covering the most popular Java, JavaScript and Python libraries. See a Sample of ftrace-hook

Get all kandi verified functions for this library.

ftrace-hook Key Features

No Key Features are available at this moment for ftrace-hook.

ftrace-hook Examples and Code Snippets

No Code Snippets are available at this moment for ftrace-hook.

Community Discussions

Trending Discussions on ftrace-hook

How to get the process ID of the program that called a system function

QUESTION

How to get the process ID of the program that called a system function

Asked 2020-Feb-03 at 15:29

I am writing a small kernel driver that has the job to act as a honeypot and monitor actions taken on a specific file on the system. To start things off, I used the code in this repository, which I then slightly modified for simplicity reasons so that it works only for one system call: sys_open.

Now I need to gather information for the process and the user that run that system call to open this file, but I could not find any way to do it. I thought that I could use the file descriptor to identify which process has it, but after a discussion with my university professor, he told me that file descriptors are NOT unique system-wide, but only process-wide.

To conclude, is there a way that could give me the PID of the process that implicitly called sys_open?

...

ANSWER

Answered 2020-Feb-03 at 15:29

When running in kernel code, information about the currently running process is stored in the current global variable (it's actually a platform specific macro rather than a global variable, to be precise), which is a struct task_struct. If you are inside a syscall handler (or a hook to one), then current will be the process which started the syscall, and you can just check current->pid to get its PID.

To get the current process' UID, GID, EUID, EGID (and so on) you can use the set of macros defined in linux/cred.h. From the the relative kernel documentation page:

There are convenience wrappers for retrieving specific aspects of a task’s credentials (the value is simply returned in each case):

Source https://stackoverflow.com/questions/60041658

Community Discussions, Code Snippets contain sources that include Stack Exchange Network

Vulnerabilities

No vulnerabilities reported

Install ftrace-hook

You can download it from GitHub.

Support

For any new features, suggestions and bugs create an issue on GitHub. If you have any questions check and ask questions on community page Stack Overflow .

Find more information at: