How to disable application run

How to disable application run

[Marcin Głogowski]

Hello guys,
I have to create Linux based solution to prevent running applications 
from the blacklist.
How can I achieve this? Which part of the Linux kernel is needed to 
achieve this?
I think it would be nice to create block device which will store black 
and white list, but I have no idea what part
of the kernel is responsible for this functionality.
It is not possible to kill the application after run - I have to find 
nicer solution.
Thank you much, regards CiN

Re: How to disable application run

[Chény, Yves-Gael]

Mardi 04-10-2016 à 11:51 Marcin Głogowski a écrit:
> Hello guys,
> I have to create Linux based solution to prevent running applications 
> from the blacklist.
> How can I achieve this? Which part of the Linux kernel is needed to 
> achieve this?
> I think it would be nice to create block device which will store black 
> and white list, but I have no idea what part
> of the kernel is responsible for this functionality.
> It is not possible to kill the application after run - I have to find 
> nicer solution.
> Thank you much, regards CiN



Hi,
I do not really understand what you intend to do? On what basis do you intend to blacklist an application?
On his name? It's easy to change it ! Otherwise, to answer your question, I personally will create a patch at the allocation of pid. This placed just before the execution but you still a lot of information about the process asking to be launched. Do a search around "alloc_pid" in the linux kernel sources.

good luck,
Yves.

How to disable application run

[Ilya Guterman]

Hey CiN,

You can write LKM which overrides the execve syscall and checks
wherever the filename is blacklisted, but overriding syscall is
considered bad.
Maybe there is a better solution I am not aware of.

Regards amfern.

Re: How to disable application run

[Raphael Prudencio]

Have you tried selinux?

Sent from my iPhone

> On 4 Oct 2016, at 13:33, Ilya Guterman <iliyagutermann@gmail.com> wrote:
> 
> Hey CiN,
> 
> You can write LKM which overrides the execve syscall and checks
> wherever the filename is blacklisted, but overriding syscall is
> considered bad.
> Maybe there is a better solution I am not aware of.
> 
> Regards amfern.
> --
> To unsubscribe from this list: send the line "unsubscribe linux-c-programming" in
> the body of a message to majordomo@vger.kernel.org
> More majordomo info at  http://vger.kernel.org/majordomo-info.html