Re: How to intercept sys_exit()...

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



On Fri, 8 Oct 2004 09:46:21 +1000, Aboo Valappil <aboo@xxxxxxxxxxxxxxx> wrote:

> Can we do something like this to get to sys_call_table ... If it is not
> declared in any header files ...  ( It is defined in entry.S and it is global)

> extern void *sys_call_table;

It's not by default exported however, so this will link in to a module
with an unresolvable symbol at load time.

> long *my_sys_call_table = (long *)sys_call_table;

That's useless.

> void (*old_exit_syscall)( int error_code);

That's a really bad idea though - you don't want to save and restore
the old syscall. This is precisely one of the reasons that it is no
longer exported by default - you might do this unfortunate
manipulation of the syscall table and try to restore at module
shutdown with an old pointer that goes nowhere due to changes in the
meantime.

> In init module session, you could ...

> my_sys_call_table[1]=new_exit_syscall;

That's a bad idea.

> my_sys_call_table[1]= old_exit_syscall;

That's a really really bad idea.
 
> I thought IDT would not have any reference to sys_call_table. It will
> have a pointer to system call entry ( system_call() exception handler ),
> but not the table.

That's true. It's deliberately difficult to get at the table - you
don't want to change system calls within LKMs usually - and if you
ever did then you'd have tonnes of hoops to jump through on the way.
Until someone rewrites the whole framework to use more than an open
table or one with just some simple spinlocks impacting performance, it
won't be exported.

Jon.

--
Kernelnewbies: Help each other learn about the Linux kernel.
Archive:       http://mail.nl.linux.org/kernelnewbies/
FAQ:           http://kernelnewbies.org/faq/


[Index of Archives]     [Newbies FAQ]     [Linux Kernel Mentors]     [Linux Kernel Development]     [IETF Annouce]     [Git]     [Networking]     [Security]     [Bugtraq]     [Yosemite]     [MIPS Linux]     [ARM Linux]     [Linux RAID]     [Linux SCSI]     [Linux ACPI]
  Powered by Linux