Date: Mon, 30 Oct 2006 00:21:02 -0500 From: Dave Clausen <dave@endlessdream.org> To: freebsd-hackers@freebsd.org Subject: Process arguments Message-ID: <45458BBE.6030103@endlessdream.org>
next in thread | raw e-mail | index | archive | help
Hello list,
I'm a n00b to the FreeBSD kernel and I'm trying to log all commands run
on the command line from within the kernel for security purposes by
loading a kernel module which redefines execve(). I've successfully
created the KLD and have it working, but am having problems saving the
command's arguments.
Could anyone point me to where in the kernel I should be looking for the
arguments sent to the process? p->p_args gives me the parent process's
cmdname only (sh, in this case), and uap->argv is just the relative
pathname of uap->fname. Ideally, I'd like the user, full command line,
and cwd logged for each command entered.
Here's an example of what I've been working away on:
int
new_execve (struct thread *td, struct execve_args *uap)
{
char *user;
struct proc *p = td->td_proc;
user = p->p_pgrp->pg_session->s_login;
if (p->p_ucred->cr_ruid == 1001) {
printf("%s %d %s\n", user, p->p_pid, uap->fname);
}
return (execve(td,uap));
}
Running 'ls -al' with the above, I get the username, pid, and absolute
filename printed such as, but can't find the actual arguments:
dave 6689 /bin/ls
Any help would be appreciated.
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?45458BBE.6030103>