Re: System call wrapping

[Alan Cox]

On Mon, 2002-10-21 at 18:42, Henrý Þór Baldursson wrote:
> In our Windows product we have something called "Realtime protector"
> which monitors file access on Windows running machines and scans them
> before allowing access. 

So what you want to do is get notification of new file creations ?

> sys_call_table[__NR_open]. We did realize that this is a bad idea if a
> user loads another module doing the same, and then unloads in the wrong
> order. And also that this is not a very pretty method. But it worked. 

Its also useless because I can switch paths around under your analyser
and fool you into missing things. Wrappers dont work, its also why snare
is so limited in value for example.

There are interfaces for monitoring directories for new file creations -
using things like dnotify from user space. They may be sufficient, but
if not the right question is "how do we make a real solution work" not
how do we hack half working tricks into syscall entry points.

> compile a new kernel.  Is there some API for wrapping system calls which
> I am unaware of, or are there plans to provide one? 

In general there isnt, nor should there need to be.