You're welcome, Igor. I needed to intercept syscalls in a little project that I were implementing, to keep track of filesystem changes, and others. I use that way, but I know that it's a ugly hack that can work only under x86. Overwrite syscalls can slow down the whole system, and a improper wrapper can freeze the system and behave in a unexpected way (imagine a non-freed memory allocation in a sys_read wrapper...), and others. I never planned to use it at production.
If you're trying to do something to be public and widely used, I believe that a better approach is to create a layer to be used in syscalls operations, or something like that (stills ugly, but now it's a "good-programming-practice" thing). For example, from a kernel to other, the way that sys_write works internally may change, and your code can mess with the whole thing. Trap system calls are not a portable and clean way to reach your goals. In fact, there's not a reliable way yet. (that I know) I agree that a mechanism to wrap system calls can be very useful. -- # (perl -e "while (1) { print "\x90"; }") | dd of=/dev/evil - To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to [EMAIL PROTECTED] More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/