Query regarding kernel modules intercepting system call.

[greg@kroah.com (Greg KH)]

On Sat, Jul 08, 2017 at 07:53:31PM +0530, Ajinkya Surnis wrote:
> Actually, I've been given an assignment to write a kernel module such that
> whenever a certain system call (e.g. open()) is executed, the control should
> come to my new module; then it will do some processing on the parameters and
> then call the actual syscall function (sys_open()).

Horrible assignment, please pass along my regards to the professor that
this is not anything that should ever be assigned.  Seriously, do you
want me to email them this?

> I only found the way of intercepting 'sys_call_table'. I know this kind of
> hacking is probably not a good idea.
> Can you suggest any alternative way?
> I would really appreciate.

Don't do it.

Really, this is not a valid thing to do in Linux.

Feel free to quote me.

Also, the assignment said nothing about 2 modules, so are you sure you
are even doing this right?  :)

thanks,

greg k-h