LinuxQuestions.org
Share your knowledge at the LQ Wiki.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Newbie
User Name
Password
Linux - Newbie This Linux forum is for members that are new to Linux.
Just starting out and have a question? If it is not in the man pages or the how-to's this is the place!

Notices


Reply
  Search this Thread
Old 12-17-2008, 03:38 PM   #1
knewb
LQ Newbie
 
Registered: Dec 2008
Posts: 1

Rep: Reputation: Disabled
procfs task struct look up


Hi,
I am a kernel newbie. To better understand the proc filesystem implementation and how the kernel root kits work, I am trying to modify the fs/proc code to hide a pid to be displayed under /proc. I have created a system call to pass a flag(to task struct for that process), to temporarily hide a process to be displayed. The next step as I understand would be to modify the proc fs code so that when I scan the task list to display /proc/<pid> entries, it should check my flag and not display a directory for that pid if the flag is set.

Now, my problem is, I am not able to figure out how/where the proc fs scans the task structure list in order to display /proc/<pid> entry. Does somebody have any suggestions to me? Any help will be greatly appriciated.

This is the first time I am modifying the kernel and also adding new modules to the kernel. Please excuse if the question is very trivial..

Thanks a lot,
Nisha
 
Old 12-21-2008, 09:21 AM   #2
unSpawn
Moderator
 
Registered: May 2001
Posts: 29,361
Blog Entries: 55

Rep: Reputation: 3547Reputation: 3547Reputation: 3547Reputation: 3547Reputation: 3547Reputation: 3547Reputation: 3547Reputation: 3547Reputation: 3547Reputation: 3547Reputation: 3547
Quote:
Originally Posted by knewb View Post
Does somebody have any suggestions to me?
"The processes' directories (...) are added dynamically, and presented to the VFS layer if readdir (...) is called." (Palmers) But rootkit study, even if thwarted by recent kernel developments, really isn't a suitable topic for Linuxquestions.org.
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
GCC compile problem:struct A have a member variable which is just a struct type name? leon.zcom Programming 3 04-18-2008 05:40 PM
g++ and wrong struct member addresses / struct size misreporting sonajiso Linux - General 5 05-22-2004 11:16 PM
switch statement converting struct char to struct int oceaneyes2 Programming 2 12-10-2003 05:30 PM
using struct type X as pointer in struct X. worldmagic Programming 1 10-28-2003 03:06 PM
Accessing a struct inside struct cxel91a Programming 1 09-17-2003 05:24 PM

LinuxQuestions.org > Forums > Linux Forums > Linux - Newbie

All times are GMT -5. The time now is 04:18 PM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration