[lkml]   [2000]   [Aug]   [21]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
SubjectRe: intercepting sys_execve fails
On Sat, Aug 19, 2000 at 03:37:07AM +0200, Julien Oster wrote:

> int new_execve (struct pt_regs regs) {
> return real_execve (regs);
> }
> real_execve is a function pointer initialized from the old entry in the
> sys_call_table. Everything seems correct.

execve manipulates the struct pt_regs on the stack but you're passing a
copy of the struct pt_regs to it, so sys_execve will manipulate that one
and leave the real stackframe unchanged. As the result the syscall
will return to the address it got called from - but in the new program -
and not to the entry of the new process.

Fix: don't call sys_execve() yourself, instead copy it's code into your
function new_execve. Have fun because you're tampering with architecture
dependant code, so you'll have to fix that once for every architecture.
But how about using ptrace(2) insted? No kernel changes ...

To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to
Please read the FAQ at

 \ /
  Last update: 2005-03-22 12:37    [W:0.036 / U:0.024 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site