2011-4-21 Hooking interrupt descriptor table

Hook interrupt descriptor table

Hooking interrupt table is very interesting thing
with it you can dissallow some operations to be made or watch what
happening in system. This article is more like review and more tehnical
description is in link 1

First thing that we should know that it will done trought kernel module
there is 2 commands for loading and unloading modules


insmod


and


rmmod


there is way how we can check system call addresses and position of syscall
table


grep sys_call_table /proc/kallsyms

grep system_call /proc/kallsyms



also we can use it for detecting our module functions and syscall addreses


grep sys_write /proc/kallsyms


or if we whant check out module functions


grep hook_idt /proc/kallsyms


We will now try to hook sys_mkdir. I usualy using some minimalistic
windowmanagers but some browsers or other GUIsh programs like such directories
"Download" or "Desktop" all my directories in ~/ is lowercase and I realy hate
anoying "Download" and "Desktop" directories that are made without my permission
and for my lowercase /home directory style is agly. With this hook they will
be denied to make such thing.

Out kernel module consist of such functions:

static int __init hook_init(void) //stufff on module init,idt hooking
static void __exit hook_exit(void) //stuff on module exit, restore idt table

asmlinkage long hooked_mkdir(const char *filename, mode_t mode) //our hook function

//how works this functions you can find in link number 1 
void *get_writable_sct(void *sct_addr)
void *get_syscall_table(void) 

Basic hooked function is:

asmlinkage long hooked_mkdir(const char *filename, mode_t mode)
{
	return mkdir(filename, mode);
}

but now we need to add check for ("Desktop","Download"). First we need some error
that will returned when some one whant to make bad directory
we will use EACCES error.

here is modified functions for out task:

//hook mkfile command
asmlinkage long hooked_mkdir(const char *filename, mode_t mode)
{
	//it will disallow all files that starts with Desktop&&Download
	if (((strncmp(filename,"Desktop",7) == 0) && (strlen(filename) == 7)) ||
		((strncmp(filename,"Download",8) == 0) && (strlen(filename) == 8)))
	{
		printk(KERN_INFO "Mkdir hook\n");
		return EACCES;
	}
	return real_mkdir(filename, mode);
}

For module compiling:


make


This is tested with kernel version 2.6.38