Start application in userland from Kernelland

E

eyebone

Hello folks,

I coded in the past quite a bit in FreeBSD Kernelland. Creating my own modules for my systems at work. One thing I am searching for quite some time is the ability to start a userland process from kernelland. :stud
For instance when a device like usb/firewire is connected to the system. I do not need a walkthrough but an idea where to look at to conduct this.

Thanks,
eyebone.
 
If you need kernel-to-userland interaction you have different choices:
1) write a module that writes some data to a device and
2) have a userland process that is already running and that consumes such data

but this assumes you already have a userland process.
Another way is placing an event in a kernel event queue, from a userland process use kqueue(2). This also assumes you already have a process running in userspace.

Or you can do what the kernel does to start init, the first userland process, and do the same, but I guess this is not a good way of working. Have a look at sys/kern/init_main.c and the create_init function, that uses the fork(2) to spawn another process that auto-adjusts itself.
 
There is also the execve(2) system call as well. If you are calling from kernel space, you'll have to dig through the kernel source, but I would probably start with a name like sys_execve or kern_execve since the former is usually a wrapper function for the latter. This generally follows the naming conventions that I have observed, but I could be wrong.
 
Kernel / Userland interaction is something I'm working on at the moment myself.

I've been looking at using Unix sockets to do this, although this might cause some overheads.

What I've done, is based on an implementation of the SeND protocol, I have a kernel module that creates a hook, and the kernel checks if this hook is not null, and sends data to the module. The module then sends the data to the userland daemon through a Unix socket, although this part I have yet to get working. I may have to change to raw sockets so I can define my own protocol IPPROTO_MYPROTO for example.

The userland daemon connects to this socket and can read/write to it. So from my understanding, the kernel will be writing to the socket (as long as the module is loaded and hook initiated) , even if the daemon is not running.
 
perleo said:
Kernel / Userland interaction is something I'm working on at the moment myself.

I've been looking at using Unix sockets to do this, although this might cause some overheads.

What I've done, is based on an implementation of the SeND protocol, I have a kernel module that creates a hook, and the kernel checks if this hook is not null, and sends data to the module. The module then sends the data to the userland daemon through a Unix socket, although this part I have yet to get working. I may have to change to raw sockets so I can define my own protocol IPPROTO_MYPROTO for example.

The userland daemon connects to this socket and can read/write to it. So from my understanding, the kernel will be writing to the socket (as long as the module is loaded and hook initiated) , even if the daemon is not running.
Click to expand...

What is the advantage of using a raw socket over a classical device file approach? For me this seems like it is adding unnecessary complexity.
 
I don't think there is, and this is something I'm trying to figure out myself as a method for kernel/userspace interaction (like the OP is), where to use IPC sockets, dev char devices, ioctl, and so on.

For the OP, I'm making my way through Designing BSD Rootkits , it runs through character devices, hooking, and others with code examples. I'd recommend it!
 
You must log in or register to reply here.
Back
Top