Re: The disappearing sys_call_table export.

David Wagner
2003-05-10T21:01:51Z

Yoav Weiss wrote:
>The solution is to have only ONE REAL copy, done by the wrapper. The
>original syscall will copy from a kernel ptr, unknowingly. Consider
>the following modified pseudo-code:

Let's see you do sys_execve()... sys_socketcall() and sys_ioctl() are
fun, too. (And, I worry about doubly-indirected pointers, for instance.)
It's probably do-able, but you'd better stock up on the Advil in advance:
we're in major headache country, folks.

>Now, don't get me wrong - I still think intercepting the syscall is not
>the right thing to do in this case, since LSM provides hooks in better
>locations.

Right. LSM seems like a better answer for security applications.