Overview

Added a new feature to the Linux kernel called process syscall banning — the ability to ban processes from using certain system calls.

New System Calls Implemented

• set_ban — sets bans for the current process (requires root)
• get_ban — checks if the current process is banned from a syscall
• check_ban — checks if any process has a specific ban
• flip_ban_branch — inverts a ban across a process's parent tree

Banned Syscalls Supported

• getpid()
• pipe()
• kill()

Key Concepts

• Kernel module development
• PCB (task_struct) modification
• Process tree traversal
• Privilege level checking

Environment

• Linux Kernel 4.15.18
• Ubuntu VM
• x86-64 architecture

Tech

C · Linux Kernel · System Calls · x86-64 · Kernel Space Development