/* chdir_kmod.c by detour@metalshell.com
 *
 * This simple module will recieve system calls
 * to change the directory and log them.  This can
 * be very useful if you want to create a sandbox for
 * users on your system, or just log general activity.
 *
 * Compile:
 *  gcc -Wall -DLINUX -D__KERNEL__ -DMODULE -c chdir_kmod.c
 *
 * Install:
 *  insmod chdir_kmod
 *
 * Note: Do not load it twice, or you could lose the pointer
 *       to the original kernel function and be unable to
 *       change directories.
 *
 * http://www.metalshell.com/
 *
 */
 
#include <linux/kernel.h>
#include <linux/module.h>
#include <sys/syscall.h>
 
#if CONFIG_MODVERSIONS==1
#define MODVERSIONS
#include <linux/modversions.h>
#endif
 
extern void *sys_call_table[];
 
/* Pointer to original chdir function, we must call this
   from our intercept function to allow for normal directory
   changes.  This will also be used to restore the syscall pointer
   when this module is unloaded. */
int (*old_sys_chdir)(const char *);
 
int (*sys_getuid)();
 
int sys_chdir_intercept(const char *path) {
  printk("%d %s\n", sys_getuid(), path);
 
  return old_sys_chdir(path);
}
 
int init_module() {
  // Outputted to your syslog
  printk("Module loaded..\n");
 
  old_sys_chdir = sys_call_table[__NR_chdir];
  sys_call_table[__NR_chdir] = sys_chdir_intercept;
 
  sys_getuid = sys_call_table[__NR_getuid];
 
  return 0;
}
 
void cleanup_module() {
  // Outputted to your syslog
  printk("Module unloaded..\n");
 
  sys_call_table[__NR_chdir] = old_sys_chdir;
}