Messages in this thread | | | Date | Fri, 15 Apr 2005 13:10:49 -0700 | From | Daniel Souza <> | Subject | Re: intercepting syscalls |
| |
You're welcome, Igor. I needed to intercept syscalls in a little project that I were implementing, to keep track of filesystem changes, and others. I use that way, but I know that it's a ugly hack that can work only under x86. Overwrite syscalls can slow down the whole system, and a improper wrapper can freeze the system and behave in a unexpected way (imagine a non-freed memory allocation in a sys_read wrapper...), and others. I never planned to use it at production.
If you're trying to do something to be public and widely used, I believe that a better approach is to create a layer to be used in syscalls operations, or something like that (stills ugly, but now it's a "good-programming-practice" thing).
For example, from a kernel to other, the way that sys_write works internally may change, and your code can mess with the whole thing. Trap system calls are not a portable and clean way to reach your goals. In fact, there's not a reliable way yet. (that I know)
I agree that a mechanism to wrap system calls can be very useful.
-- # (perl -e "while (1) { print "\x90"; }") | dd of=/dev/evil - To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
| |