From: jmfriedt <jmfriedt@femto-st.fr>
To: linux-kernel@vger.kernel.org
Subject: why is the sys_close symbol exported ?
Date: Fri, 18 Nov 2016 09:56:52 +0100 [thread overview]
Message-ID: <20161118095652.11933ecf@labo> (raw)
Following the various rootkit and system call redirection developments, the current
way of identifying the location of the system call table seems to be brute force scanning
the memory for the location of one of the system calls. This is only possible from a module
if the symbol is exported: I see that only one system call symbol is still exported, that
is sys_close. Removing this symbol export would hinder one of the ways of finding the
systam call table: I have not been able to find the reason for exporting this particular
symbol (while sys_open for example is not exported). Can anyone justify why that is ?
Thank you, Jean-Michel
--
JM Friedt, FEMTO-ST Time & Frequency/SENSeOR, 26 rue de l'Epitaphe, 25000 Besancon, France
next reply other threads:[~2016-11-18 9:08 UTC|newest]
Thread overview: 2+ messages / expand[flat|nested] mbox.gz Atom feed top
2016-11-18 8:56 jmfriedt [this message]
2016-11-18 13:49 ` why is the sys_close symbol exported ? One Thousand Gnomes
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20161118095652.11933ecf@labo \
--to=jmfriedt@femto-st.fr \
--cc=linux-kernel@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).