How to intercept execve system call...?

From: Prasad (prasad_3483_at_yahoo.co.in)
Date: 09/22/04 

Date: 22 Sep 2004 05:18:35 -0700

Hello everyone !
I'm trying to intercept "execve" system call with the following
function...I am using with linux-2.6.8.1 kernel for it

asmlinkage int new_execve(struct pt_regs my_regs)
{
     printk("%s: user %d is trying to execute ", __FUNCTION__, current
-> uid);
     printk("%s \n",(char *)my_regs.ebx);
     return( old_execve(my_regs) );
}

But after loading my LKM module with above function, I'm getting a
segmentation fault for every external shell command executed .

  Could you pls tell me "What is that I'm missing here..."

 regards
    -Prasad

Relevant Pages

  • RT scheduling and a way to make a process hang, unkillable
    ... The only way to kill the program is to allocate the corresponding user ... that was a case in which a program would hang ... change effective UID to match real UID ... I'm also attaching my kernel configuration. ...
    (Linux-Kernel)
  • Re: [Patch] Support UTF-8 scripts
    ... > whole point of my patch - I would not propose a kernel patch to ... The last time I handed execve() a script as a ... >> kernel config files ever. ... nothing about how to execute a text file - the kernel should return ...
    (Linux-Kernel)
  • Re: task_struct and uid of a task
    ... In my next kernel update I will follow your avice to naming and indentation. ... The uids in task_struct is parents uid ... >>remotely login and runs there jobs, then the user name of those jobs are ... >>started under telnet server as children. ...
    (Linux-Kernel)
  • Re: [PATCH -mm 5/7] add user namespace
    ... File descripters can only be passed over a unix socket, ... Suppose you have user fred uid 1000 outside of any containers, ... and you have user joe uid 1000 inside user uid namespace. ... But not for correct kernel operation. ...
    (Linux-Kernel)
  • Re: [patch 2/3] MAP_NOZERO - implement sys_brk2()
    ... But I've so far failed to find a killer ... Start oprofile and run a kernel ... I don't doubt that it shows real benefits; ... Relying on a uid at this level ...
    (Linux-Kernel)