From mboxrd@z Thu Jan  1 00:00:00 1970
From: greg@kroah.com (Greg KH)
Date: Sat, 8 Jul 2017 17:20:39 +0200
Subject: Query regarding kernel modules intercepting system call.
In-Reply-To: <CANoRqo=eDAJaojtQLQS4L4s9WBGM4AUkYtWK7vWNQVFHvrG4mQ@mail.gmail.com>
References: <CANoRqo=3Ect=Qb7Cqz==1aZn6vy4D0ndh=8jaWn_2wivUycGRQ@mail.gmail.com>
	<20170708141309.GA23183@kroah.com>
	<CANoRqo=eDAJaojtQLQS4L4s9WBGM4AUkYtWK7vWNQVFHvrG4mQ@mail.gmail.com>
Message-ID: <20170708152039.GA16796@kroah.com>
To: kernelnewbies@lists.kernelnewbies.org
List-Id: kernelnewbies.lists.kernelnewbies.org

On Sat, Jul 08, 2017 at 07:53:31PM +0530, Ajinkya Surnis wrote:
> Actually, I've been given an assignment to write a kernel module such that
> whenever a certain system call (e.g. open()) is executed, the control should
> come to my new module; then it will do some processing on the parameters and
> then call the actual syscall function (sys_open()).

Horrible assignment, please pass along my regards to the professor that
this is not anything that should ever be assigned.  Seriously, do you
want me to email them this?

> I only found the way of intercepting 'sys_call_table'. I know this kind of
> hacking is probably not a good idea.
> Can you suggest any alternative way?
> I would really appreciate.

Don't do it.

Really, this is not a valid thing to do in Linux.

Feel free to quote me.

Also, the assignment said nothing about 2 modules, so are you sure you
are even doing this right?  :)

thanks,

greg k-h