On Tue, 21 Jan 2025 15:13:52 -0800 Eyal Birger <eyal.birger@xxxxxxxxx> wrote: > Isn't that the case already, or maybe I misunderstood what Jiri wrote [1]: > > > On Sun, Jan 19, 2025 at 2:44 AM Jiri Olsa <olsajiri@xxxxxxxxx> wrote: > > that's correct, uretprobe syscall is installed by kernel to special user > > memory map and it can be executed only from there and if process calls it > > from another place it receives sigill > > Eyal. > > [1] https://lore.kernel.org/lkml/Z4zXlaEMPbiYYlQ8@krava/ Ah, he did. Thanks I missed that: > that's correct, uretprobe syscall is installed by kernel to special user > memory map and it can be executed only from there and if process calls it > from another place it receives sigill -- Steve
