Re: Syscall security

Chris Wright
2003-09-26T16:11:06Z

* Maciej Zenczykowski (maze@cela.pl) wrote:
> I'm wondering if there is any way to provide per process bitmasks of
> available/illegal syscalls. Obviously this should most likely be
> inherited through exec/fork.

A simple LSM module can do this for you. It will have a little
more overhead than denying at the syscall entry point, but it's
certainly going to be more flexible.

-chris
--
Linux Security Modules http://lsm.immunix.org http://lsm.bkbits.net