Re: The disappearing sys_call_table export.

[daw@mozart.cs.berkeley.edu (David Wagner)]

Yoav Weiss  wrote:
>The solution is to have only ONE REAL copy, done by the wrapper.  The
>original syscall will copy from a kernel ptr, unknowingly.  Consider
>the following modified pseudo-code:

Let's see you do sys_execve()...  sys_socketcall() and sys_ioctl() are
fun, too.  (And, I worry about doubly-indirected pointers, for instance.)
It's probably do-able, but you'd better stock up on the Advil in advance:
we're in major headache country, folks.

>Now, don't get me wrong - I still think intercepting the syscall is not
>the right thing to do in this case, since LSM provides hooks in better
>locations.

Right.  LSM seems like a better answer for security applications.