I tried to compile the following example in order to replace __NR_open syscall for my linux kernel 2.6.11 : ------------------------------------ #include <linux/module.h> #include <linux/kernel.h> #include <linux/init.h> #include <linux/unistd.h> //System calls list #include <asm/uaccess.h> #include <linux/moduleparam.h> MODULE_LICENSE("GPL"); MODULE_AUTHOR(" "); extern void *sys_call_table[]; static int uid; module_param(uid,int,0644); MODULE_PARM_DESC(uid,"Enter user id:\n"); //Pointer to original call static asmlinkage int (*original_call) (const char *,int,int); asmlinkage int our_sys_open(const char *filename,int flags,int mode) { int i=0; char ch; if (uid == current->uid) { printk(KERN_INFO "Opened file by %d: ",uid); do { get_user(ch,filename+i); i++; printk(KERN_INFO "%c",ch); } while (ch!=0); } return original_call(filename,flags,mode); } static int __init my_init(void) { original_call=sys_call_table[__NR_open]; sys_call_table[__NR_open] = our_sys_open; printk (KERN_INFO "spying ad UID:%d\n",uid); return 0; } static void __exit my_clean(void) { if (sys_call_table[__NR_open] != our_sys_open ) { printk (KERN_ALERT "Entering Unstable state\n"); } sys_call_table[__NR_open]=original_call; } module_init(my_init); module_exit(my_clean); ----------------------------- But when I compile it I get the following message: MODPOST *** Warning: "sys_call_table" [/root/kernel_sko/ex10/as10.ko] undefined! this is because (I think) sys_call_table[] is not exported by my kernel. Is there a patch or a way to export sys_call_table[] ? -- Kernelnewbies: Help each other learn about the Linux kernel. Archive: http://mail.nl.linux.org/kernelnewbies/ FAQ: http://kernelnewbies.org/faq/