Syscall table AKA hijacking syscalls

Libor Vanek
2004-01-02T12:59:18Z

Hi,
I'm writing some project which needs to hijack some syscalls in VFS
layer. AFAIK in 2.6 is this "not-wanted" solution (even that there are
some very nasty ways of doing it - see
http://mail.nl.linux.org/kernelnewbies/2002-12/msg00266.html )

Also I've found out that Linus stated that intercepting syscalls is "bad
thing" (load module a, load module b, unload module b => crash) but I
think that there are some very good reasons (and ways) to do it (see
http://syscalltrack.sourceforge.net ). My main reason to do it is that I
want my GPLed module to be able to modify some VFS syscalls without
patching and recompiling whole kernel and rebooting the machine.

So what is proper (Linus recommanded) way to do such a things? Create
patches for specific syscalls like "if this_module_installed then
call_this_function;" or try to force things like syscalltrack to go into
vanilla kernel some time? Because what I've found out there are more
projects which suffer from this restriction.

--

Libor Vanek