Re: System Call Interception

[Anthony Liguori <aliguori@us.ibm.com>]

Neha Sood wrote:
> 
> Hi there,
> 
> I have a question related to intercepting guest OS system calls in Xen 
> to provide logging mechanism. As a part of my project, i have to log all 
> the system calls issued by the guest OS in the Xen hypervisor for secure 
> logging. I am new to Xen and have been reading the source code. I have 
> read about Fast Handler for system call. What is the fast handler and 
> how the system call works in Xen. Could you please provide me some 
> starting point how to do that?

On i386 at least, syscalls are delivered directly to the guest (they 
aren't intercepted by Xen).

I'm not sure if the same is true on x86-64 but at any rate, the first 
thing to do would be to make sure Xen intercepts syscalls.  You will 
have to find some mechanism to "log" these events which will likely 
involved a ring queue and some sort of daemon in dom0.

However, as Mats suggests, are you sure this is really what you want to 
do?  The audit infrastructure in Linux is designed just to do this sort 
of thing...

Regards,

Anthony Liguori

> Will it be a very difficult to log guest OS system calls in Xen ? If no, 
> how to start with and what are files have to be changed.
> 
> I would really appreciate your help.
> 
> Thanks,
> Neha
> 
> ------------------------------------------------------------------------
> Sponsored Link
> 
> Mortgage rates near 39yr lows. $510,000 Mortgage for $1,698/mo - 
> Calculate new house payment 
> <http://www.lowermybills.com/lre/index.jsp?sourceid=lmb-9134-16416&moid=4119> 
> 
> 
> 
> ------------------------------------------------------------------------
> 
> _______________________________________________
> Xen-devel mailing list
> Xen-devel@lists.xensource.com
> http://lists.xensource.com/xen-devel