kernel: sys_execve_kp remains the preferred choice for the first registration.

This commit is contained in:
ShirkNeko
2025-09-23 21:22:34 +08:00
parent bf4e12ce80
commit 8a14f64964

View File

@@ -516,15 +516,6 @@ static int register_execve_kprobe(void)
{ {
int ret; int ret;
ret = register_kprobe(&bprm_check_kp);
if (ret == 0) {
execve_kprobe = &bprm_check_kp;
pr_info("ksud: registered bprm_check_kprobe\n");
return 0;
}
pr_warn("ksud: failed to register bprm_check_kprobe (%d), falling back to sys_execve_kprobe\n", ret);
ret = register_kprobe(&sys_execve_kp); ret = register_kprobe(&sys_execve_kp);
if (ret == 0) { if (ret == 0) {
execve_kprobe = &sys_execve_kp; execve_kprobe = &sys_execve_kp;
@@ -532,6 +523,13 @@ static int register_execve_kprobe(void)
return 0; return 0;
} }
ret = register_kprobe(&bprm_check_kp);
if (ret == 0) {
execve_kprobe = &bprm_check_kp;
pr_info("ksud: registered bprm_check_kprobe\n");
return 0;
}
pr_err("ksud: failed to register sys_execve_kprobe (%d)\n", ret); pr_err("ksud: failed to register sys_execve_kprobe (%d)\n", ret);
return ret; return ret;
} }