There was a good discussion last week about getting the pointer to
sys_call_table ...... just see that in archive.
In short, there are three methods
- Export deliberatly the required system call ("sys_" related function)
or the sys_call_table in Kernel sources and then compile the kernel
again.
- Get the address of sys_call_table or specific system call function
from System.map and pass it to your module at load time.
- Get the address of sys_call_table dynamically in kernel module with
the help of IDT help.
Cheers !!
Gaurav
-----Original Message-----
From: kernelnewbies-bounce@xxxxxxxxxxxx
[mailto:kernelnewbies-bounce@xxxxxxxxxxxx] On Behalf Of Prasad
Sent: Thursday, October 07, 2004 3:50 PM
To: kernelnewbies@xxxxxxxxxxxx
Subject: How to intercept sys_exit()...
Hi there !
Can anyone tell me how to intecept exit system call...?
I'm using linux-2.6.8.1 kernel, and need to do it for some auditing
purpose...
--
regards
-Prasad
--
Kernelnewbies: Help each other learn about the Linux kernel.
Archive: http://mail.nl.linux.org/kernelnewbies/
FAQ: http://kernelnewbies.org/faq/
--
Kernelnewbies: Help each other learn about the Linux kernel.
Archive: http://mail.nl.linux.org/kernelnewbies/
FAQ: http://kernelnewbies.org/faq/
