tracing AND intercepting syscalls?
rwatson at FreeBSD.org
Sun Dec 3 02:08:42 PST 2006
On Sat, 2 Dec 2006, Stanislav Ochotnicky wrote:
> trustedbsd's MAC framework: i've read manual, looked at source etc. And I
> couldn't find a way to stop at every syscall certain process has made. There
> is mac_syscall() function but as far as I could tell, it only registers new
> syscall. All in all, it seems that it should have some way to do this, maybe
> I just couldn't find it.
As discussed elsewhere in the thread, ptrace() has a syscall trapping
facility, although I've not used it so can't speak to how well it works.
There are patches to add system call entry and exit hooks to the MAC
Framework, but they've not yet been merged. I anticipate that they will ship
in FreeBSD 7.0, and may get MFC'd, depending on schedule, etc.
Robert N M Watson
University of Cambridge
More information about the freebsd-hackers