--- orig/configure
+++ mod/configure
@@ -745,6 +745,11 @@
 		echo "EXTRA_CFLAGS += -DON_RMDIR_SUPPORT" >> Makefile
 	fi
 
+	if [ ${ON_INIT_MODULE} -eq 1 ]
+	then
+		echo "EXTRA_CFLAGS += -DON_INIT_MODULE_SUPPORT" >> Makefile
+	fi
+
 	if [ ${TRUSTED} -eq 1 ]
 	then
 		echo "EXTRA_CFLAGS += -DTRUSTED_APPLICATION_SUPPORT" >> Makefile
@@ -918,6 +923,11 @@
 		echo "KFLAGS += -DON_RMDIR_SUPPORT" >> Makefile
 	fi
 
+	if [ ${ON_INIT_MODULE} -eq 1 ]
+	then
+		echo "KFLAGS += -DON_INIT_MODULE_SUPPORT" >> Makefile
+	fi
+
 	if [ ${ON_CLOSE_MODIFIED} -eq 1 ]
 	then
 		echo "KFLAGS += -DON_CLOSE_MODIFIED_SUPPORT" >> Makefile
@@ -1217,6 +1227,11 @@
 			echo -n " ON_RMDIR"
 		fi
 
+		if [ ${ON_INIT_MODULE} -eq 1 ]
+		then
+			echo -n " ON_INIT_MODULE"
+		fi
+
 		if [ ${ON_CLOSE_MODIFIED} -eq 1 ]
 		then
 			echo -n " ON_CLOSE_MODIFIED"
@@ -1336,6 +1351,7 @@
 ON_UNLINK=0
 ON_RMDIR=0
 ON_CLOSE_MODIFIED=0
+ON_INIT_MODULE=0
 COMPAT1=1
 TRUSTED=1
 DEVFS=0
@@ -1400,6 +1416,12 @@
 		--enable-event-rmdir)
 			ON_RMDIR=1
 			;;
+		--disable-event-init-module)
+			ON_INIT_MODULE=0
+			;;
+		--enable-event-init-module)
+			ON_INIT_MODULE=1
+			;;
 		--enable-event-close-modified)
 			ON_CLOSE_MODIFIED=1
 			;;


--- orig/dazuko_core.c
+++ mod/dazuko_core.c
@@ -55,7 +55,7 @@
 
 #define NUM_SLOT_LISTS	5
 #define NUM_SLOTS	25
-#define NUM_EVENTS	7
+#define NUM_EVENTS	8
 
 #define AMC_UNSET	255
 
@@ -331,6 +331,8 @@
 			return 5;
 		case DAZUKO_TRUST_REQUEST:
 			return 6;
+		case DAZUKO_ON_INIT_MODULE:
+			return 7;
 	}
 
 	return -1;
@@ -354,6 +356,8 @@
 			return DAZUKO_ON_RMDIR;
 		case 6:
 			return DAZUKO_TRUST_REQUEST;
+		case 7:
+			return DAZUKO_ON_INIT_MODULE;
 	}
 
 	return 0;
@@ -1977,8 +1981,9 @@
 		if (sl == skip_slotlist)
 			continue;
 
-		if (!dazuko_should_scan(dfs, sl))
-			continue;
+		if (event != DAZUKO_ON_INIT_MODULE)
+			if (!dazuko_should_scan(dfs, sl))
+				continue;
 
 		error = dazuko_run_daemon_on_slotlist(event, dfs->filename, dfs->filename_length, event_p, &(dfs->file_p), rc, sl);
 
@@ -2514,7 +2519,8 @@
 
 	dazuko_clear_replybuffer(request);
 	dazuko_add_keyvalue_to_replybuffer(request, "\nEV=", &(s->event), 'd');
-	dazuko_add_esc_to_replybuffer(request, "\nFN=", &(s->filename));
+	if (s->filename)
+		dazuko_add_esc_to_replybuffer(request, "\nFN=", &(s->filename));
 
 	if (s->event_p.set_uid)
 		dazuko_add_keyvalue_to_replybuffer(request, "\nUI=", &(s->event_p.uid), 'd');


--- orig/dazuko_events.h
+++ mod/dazuko_events.h
@@ -43,6 +43,7 @@
 #define	DAZUKO_ON_UNLINK		16
 #define	DAZUKO_ON_RMDIR			32
 #define	DAZUKO_TRUST_REQUEST		64
+#define	DAZUKO_ON_INIT_MODULE		128
 
 /* trusted flags */
 #define	DAZUKO_TRUST_CHILDREN		1


--- orig/dazuko_linux.c
+++ mod/dazuko_linux.c
@@ -167,6 +167,16 @@
 	#endif
 #endif
 
+#if defined(ON_INIT_MODULE_SUPPORT)
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,0)
+	static asmlinkage long (*original_sys_init_module)(void __user *umod, unsigned long len, const char __user *uargs);
+#elif LINUX_VERSION_CODE >= KERNEL_VERSION(2,4,0)
+	static asmlinkage long (*original_sys_init_module)(const char *name_user, struct module *mod_user);
+#else
+#warning "init_module syscall hook not supported on this kernel version"
+#endif
+#endif
+
 
 static struct file_operations	fops = {
 #if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,0)
@@ -1984,6 +1994,76 @@
 }
 #endif
 
+#ifdef ON_INIT_MODULE_SUPPORT
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,0)
+asmlinkage long linux_dazuko_sys_init_module(void __user *umod, unsigned long len, const char __user *uargs)
+#elif LINUX_VERSION_CODE >= KERNEL_VERSION(2,4,0)
+asmlinkage long linux_dazuko_sys_init_module(const char *name_user, struct module *mod_user)
+#endif
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,4,0)
+{
+	struct dazuko_file_struct	*dfs = NULL;
+	int				error = 0;
+	int				check_error = 0;
+	struct event_properties		event_p;
+	struct xp_daemon_id		xp_id;
+
+	xp_id.pid = current->pid;
+	xp_id.file = NULL;
+	xp_id.current_p = current;
+	xp_id.files = dazuko_get_files_struct(current);
+
+	check_error = dazuko_check_access(DAZUKO_ON_INIT_MODULE, 0, &xp_id, NULL);
+
+	if (xp_id.files != NULL)
+		dazuko_put_files_struct(xp_id.files);
+
+	if (!check_error)
+	{
+		dazuko_bzero(&event_p, sizeof(event_p));
+		event_p.pid = current->pid;
+		event_p.set_pid = 1;
+		event_p.uid = current->uid;
+		event_p.set_uid = 1;
+
+		dfs = (struct dazuko_file_struct *)xp_malloc(sizeof(struct dazuko_file_struct));
+		if (dfs != NULL)
+		{
+			dazuko_bzero(dfs, sizeof(struct dazuko_file_struct));
+
+			dfs->extra_data = (struct xp_file_struct *)xp_malloc(sizeof(struct xp_file_struct));
+			if (dfs->extra_data != NULL)
+			{
+				dazuko_bzero(dfs->extra_data, sizeof(struct xp_file_struct));
+
+				dfs->extra_data->user_filename = NULL;
+
+				error = dazuko_process_access(DAZUKO_ON_INIT_MODULE, dfs, &event_p, NULL);
+
+				dazuko_file_struct_cleanup(&dfs);
+			}
+			else
+			{
+			    xp_free(dfs);
+			    dfs = NULL;
+			}
+		}
+	}
+
+	if (error)
+	{
+		return -EPERM;
+	}
+
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,0)
+	error = original_sys_init_module(umod, len, uargs);
+#elif LINUX_VERSION_CODE >= KERNEL_VERSION(2,4,0)
+	error = original_sys_init_module(name_user, mod_user);
+#endif
+	return error;
+}
+#endif /* KERNEL_VERSION >= 2.4.0 */
+#endif /* ON_INIT_MODULE_SUPPORT */
 
 /* system hook */
 
@@ -2194,6 +2274,10 @@
 	DAZUKO_HOOK(rmdir);
 #endif
 
+#ifdef ON_INIT_MODULE_SUPPORT
+	DAZUKO_HOOK(init_module);
+#endif
+
 #ifdef SYSCALL_TABLE_READONLY
 	/* protect the syscall table */
 	change_page_attr(virt_to_page(sys_call_table), 1, PAGE_KERNEL_RO);
@@ -2264,6 +2348,10 @@
 	DAZUKO_UNHOOK(rmdir);
 #endif
 
+#ifdef ON_INIT_MODULE_SUPPORT
+	DAZUKO_UNHOOK(init_module);
+#endif
+
 #ifdef SYSCALL_TABLE_READONLY
 	/* protect the syscall table */
 	change_page_attr(virt_to_page(sys_call_table), 1, PAGE_KERNEL);


--- orig/example_c/example.c
+++ mod/example_c/example.c
@@ -93,6 +93,9 @@
 		case DAZUKO_ON_RMDIR:
 			printf("RMDIR ");
 			break;
+		case DAZUKO_ON_INIT_MODULE:
+			printf("INIT_MODULE ");
+			break;
 		default:
 			printf("????   event:%d ", acc->event);
 			break;
@@ -173,7 +176,7 @@
 	signal(SIGINT, sigterm);
 
 	/* set access mask */
-	if (dazukoSetAccessMask(DAZUKO_ON_OPEN | DAZUKO_ON_CLOSE | DAZUKO_ON_CLOSE_MODIFIED | DAZUKO_ON_EXEC | DAZUKO_ON_UNLINK | DAZUKO_ON_RMDIR) != 0)
+	if (dazukoSetAccessMask(DAZUKO_ON_OPEN | DAZUKO_ON_CLOSE | DAZUKO_ON_CLOSE_MODIFIED | DAZUKO_ON_EXEC | DAZUKO_ON_UNLINK | DAZUKO_ON_RMDIR | DAZUKO_ON_INIT_MODULE) != 0)
 	{
 		printf("error: failed to set access mask\n");
 		dazukoUnregister();



