syscalls filtering module

aleaksah

Hello.
I'm new to linux kernel development, and I need to filter file access calls (open syscall, if I understand everything right) and modify passed values, if it necessary.
Is it possible without modification kernel sources, by separate module?
If yes, I would be appreciate if somebody give me some links or other information that could help me to clear that.

nikkej

Hi aleaksah,

have you considered seccomp? More specifically, see f.ex:
https://kernel.org/doc/Documentation/userspace-api/seccomp_filter.rst

and

https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/tools/testing/selftests/seccomp/seccomp_bpf.c

I think seccomp is closest you get without starting from scratch.

aleaksah

Yes, looks like what I need, thanks.