Re: Syscall table AKA hijacking syscalls

Ragnar Kjørstad
2004-01-02T13:57:52Z

On Fri, Jan 02, 2004 at 01:59:08PM +0100, Libor Vanek wrote:
> Hi,
> I'm writing some project which needs to hijack some syscalls in VFS
> layer. AFAIK in 2.6 is this "not-wanted" solution (even that there are
> some very nasty ways of doing it - see
> http://mail.nl.linux.org/kernelnewbies/2002-12/msg00266.html )
>
> Also I've found out that Linus stated that intercepting syscalls is "bad
> thing" (load module a, load module b, unload module b => crash) but I
> think that there are some very good reasons (and ways) to do it (see
> http://syscalltrack.sourceforge.net ). My main reason to do it is that I
> want my GPLed module to be able to modify some VFS syscalls without
> patching and recompiling whole kernel and rebooting the machine.

As part of the openxdsm-project we wrote an syscall-intercept module
that "solves" the (load module a, load module b, unload module b =>
crash) part by providing a common infrastructure for intercepting
syscalls.

It's available at:
http://cvs.sourceforge.net/viewcvs.py/openxdsm/openxdsm/eventmodule/module/events.c?rev=1.1.1.1&view=auto

--
Ragnar Kjørstad