lkml.org 
[lkml]   [2003]   [May]   [10]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
SubjectRe: The disappearing sys_call_table export.
From
Date
On Sat, 2003-05-10 at 16:38, Ahmed Masud wrote:

> Case in point, I wrote a security module for Linux that overrides _all_
> 237 systemcalls to audit and control the use of the system calls on a per
> uid basis. (i.e. if the user was actually allowed to make the system call
> or not) and return -EPERM or jump to system call proper.

I'm pretty sure that auditing by your module can easily be avoided.

examle: pseudocode for the unlink syscall

long your_wrapped_syscall(char *userfilename)
{
char kernelpointer[something];
copy_from_user(kernelpointer, usefilename, ...);
audit_log(kernelpointer);
return original_syscall(userfilename);
}

now.... the original syscall does ANOTHER copy_from_user().
Eg I can easily fool your logging by having a second thread change the
filename between the time your code copies it and the time the original
syscall copies it again. The chances of getting the timing right are 50%
at least (been there done that ;)

The only solution for this is to check/audit/log things after the ONE
copy. Eg not by overriding the syscall but inside the syscall.
[unhandled content-type:application/pgp-signature]
\
 
 \ /
  Last update: 2005-03-22 13:35    [W:0.063 / U:0.316 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site