hook the execve system call what is the const __user parmter and how can i extract the file name

danielhaish

hi i hooked the execve system call and when i told it to print log each time that process been execute it worked fine but when i wanted to print the file name parameter it crashed my computer , how can i find the file exe path of the process or the binary code of it
this is my code
``asmlinkage long our_execl( const char __user* filename, const char __user* const __user* argv,const char __user* const __user* envp )
{`

printk(filename);
return orignal_execl( filename, argv, envp );

}

`

Endraya

Im a bit to tired to fully understand your question (5.30 am and a long day..).
But as i understand it you wish to log all usage of the execve and execve_at system calls which the audit framework is quite good at (it's getting it to shut up that's tricky, but it sort of forces you..)

If creating a process, use a simple systemd service and take advantage of the features in systemd.exec and systemd.unit (man pages), and it will, especially combined with audit log any start/stop of the process.

Otherwise, how about using the Audit framework and specify a rule to listen for system calls execve and execve_at?

A rule syntax to use (for 32bit ABI calls and 64) to build upon (this will cause massive spam):
-a always,exit -F arch=b32 -S execve -S execve_at -k EXECVE_USAGE
-a always,exit -F arch=b64 -S execve -S execve_at -k EXECVE_USAGE

-k EXECVE_USAGE can be replaced by any name you wish audit to label the rule with (k = key, EXECVE_USAGE is the name/key i gave in the example).

A more useful (and less spam the hell out of the system) approach would be to add -F success=no and -F uid=0 -F euid 0 to log only failed attempts (even though a better example is below but in order to show the -F field=value concept), by the root user and the auid (real user who used for example sudo) and the execution paths will be reported, a lot.
Logging all use of these syscalls will fill your logs EXTREMELY fast, they are used for any service activation and much else and i tried going down that route once, but perhaps someone can improve upon it...

Another way to go is:
-a always,exit -F arch=b32 -S execve -S execve_at -F exit=-EACCES -k EXECVE_FAIL
-a always,exit -F arch=b32 -S execve -S execve_at -F exit=-EPERM -k EXECVE_FAIL
-a always,exit -F arch=b64 -S execve -S execve_at -F exit=-EACCES -k EXECVE_FAIL
-a always,exit -F arch=b64 -S execve -S execve_at -F exit=-EPERM -k EXECVE_FAIL

This will log any attempt at using the execve syscalls, if they fail due to permission or access failure which may imply an intrusion attempt.

I would suggest adding excluding rules for cwd , Proctitle, sockaddress and seccomp messages as well as some others to avoid logspam (see man pages on audit.rules for information and it also contains loads of examples as do google)
-a exclude,always -F msgtype=CWD
-a exclude,always -F msgtype=SECCOMP
-a always,exclude -F msgtype=PROCTITLE
-a always,exclude -F msgtype=SOCKADDR

Exlude these as well, the goal of audit it to catch relevant data, not all of it (if that is the case, leave the rules blank and until the SSD fails everything is logged).
-a always,exclude -F msgtype=TIME_ADJNTPVAL
-a always,exclude -F msgtype=TIME_INJOFFSET

Time for bed..