tracing AND intercepting syscalls?

[Robert Watson]

On Sat, 2 Dec 2006, Stanislav Ochotnicky wrote:

> trustedbsd's MAC framework: i've read manual, looked at source etc. And I 
> couldn't find a way to stop at every syscall certain process has made. There 
> is mac_syscall() function but as far as I could tell, it only registers new 
> syscall. All in all, it seems that it should have some way to do this, maybe 
> I just couldn't find it.

As discussed elsewhere in the thread, ptrace() has a syscall trapping 
facility, although I've not used it so can't speak to how well it works.

There are patches to add system call entry and exit hooks to the MAC 
Framework, but they've not yet been merged.  I anticipate that they will ship 
in FreeBSD 7.0, and may get MFC'd, depending on schedule, etc.

Robert N M Watson
Computer Laboratory
University of Cambridge