In Linux kernel mode, how to execute a user space command

Question

I hook execve in kernel mode(change system_call_table entry __NR_execve to my function). I want to check the ELF's assembly code. If it harmful, I'll return directly without executing it.

I am writing a linux module. In Linux kernel mode, I want to use objdump to disassembly the ELF file. I want to go user mode to execute objdump, and go back to kernel mode. Is this possible? Thank you.

Sounds strange. What do you need this for? Maybe it can be done in another way, without running user-space application from kernel. So please explain us the whole task so perhaps we can come up with some more appropriate and elegant solution. — Sam Protsenko
Sam Protsenko, I hook execve in kernel mode(change system_call_table entry __NR_execve to my function). I want to check the ELF's assembly code. If it harmful, I'll return directly without executing it. Do you have any other idea to do this? — siyuan
It would be much more better if you can do the same in user-space. Just doesn't sound like kernel task to me. But I may be mistaken. — Sam Protsenko
How to hijack execve in user space? LD_PRELOAD doesn't work. — siyuan

Sam Protsenko Sam Protsenko · Accepted Answer · 2015-10-24T13:17:50

Maybe you can split your project into two parts: kernel module and user-space application. So you can hook execve() in kernel, then tell your application about hook triggered, then do disassembling and checking in your application, send computed result back to kernel module, and then either continue or break execve() execution.

If you still want to run objdump from kernel -- check out call_usermodhelper().

In Linux kernel mode, how to execute a user space command

1 Answers