Re: intercepting syscalls

[Timur Tabi <timur.tabi@ammasso.com>]

Igor Shmukler wrote:
> Hello,
> We are working on a LKM for the 2.6 kernel.
> We HAVE to intercept system calls. I understand this could be
> something developers are no encouraged to do these days, but we need
> this.

Too bad.

> Patching kernel to export sys_call_table is not an option. The fast
> and dirty way to do this would be by using System.map, but I would
> rather we find a cleaner approach.

There is none.  And even System.map can be unreliable.  Some distros/kernels only include 
exported symbols in System.map, and sys_call_table is not exported in 2.6.

> I did some research on google and I know this issue has been raised
> before, but unfortunately I could not find a coherent answer.
> Does anyone know of any tutorial or open source code where I could
> look at how this is done? I think that IDT should give me the entry
> point, but where do I get system call table address?

You don't.

You're just going to have to accept that fact that what you want to do, the way you want 
to do it, is just not going to happen.  Sorry.

Your best bet is to design and implement a clean and safe mechanisming for intercepting 
system calls, and submit that to the kernel.  It will probably get rejected, but it still 
might be worth a shot.

-- 
Timur Tabi
Staff Software Engineer
timur.tabi@ammasso.com