Re: tracing AND intercepting syscalls?

2006-12-03 Thread Stanislav Ochotnicky
-BEGIN PGP SIGNED MESSAGE- Hash: SHA256 Robert Watson wrote: > As discussed elsewhere in the thread, ptrace() has a syscall trapping > facility, although I've not used it so can't speak to how well it works. As I mentioned earlier, I didn't find any info about ptrace() syscall trapping fa

Re: tracing AND intercepting syscalls?

2006-12-03 Thread Robert Watson
On Sat, 2 Dec 2006, Stanislav Ochotnicky wrote: trustedbsd's MAC framework: i've read manual, looked at source etc. And I couldn't find a way to stop at every syscall certain process has made. There is mac_syscall() function but as far as I could tell, it only registers new syscall. All in all

Re: tracing AND intercepting syscalls?

2006-12-02 Thread Stanislav Ochotnicky
-BEGIN PGP SIGNED MESSAGE- Hash: SHA256 Kostik Belousov wrote: > On Sat, Dec 02, 2006 at 05:32:06PM +0100, Stanislav Ochotnicky wrote: >> -BEGIN PGP SIGNED MESSAGE- >> Hash: SHA256 >> >> Hi >> >> I'm doing some research concerning tracing and intercepting of syscalls. >> Ideally

Re: tracing AND intercepting syscalls?

2006-12-02 Thread Kostik Belousov
On Sat, Dec 02, 2006 at 05:32:06PM +0100, Stanislav Ochotnicky wrote: > -BEGIN PGP SIGNED MESSAGE- > Hash: SHA256 > > Hi > > I'm doing some research concerning tracing and intercepting of syscalls. > Ideally this would be done in userspace. It doesn't have to be > system-wide. It would be

tracing AND intercepting syscalls?

2006-12-02 Thread Stanislav Ochotnicky
-BEGIN PGP SIGNED MESSAGE- Hash: SHA256 Hi I'm doing some research concerning tracing and intercepting of syscalls. Ideally this would be done in userspace. It doesn't have to be system-wide. It would be enough if I could fork/exec new process, and somehow be noticed every time it makes s