Messages in this thread |  | | Subject | Re: The disappearing sys_call_table export. | From | Arjan van de Ven <> | Date | 10 May 2003 18:50:31 +0200 |
| |
On Sat, 2003-05-10 at 16:38, Ahmed Masud wrote:
> Case in point, I wrote a security module for Linux that overrides _all_ > 237 systemcalls to audit and control the use of the system calls on a per > uid basis. (i.e. if the user was actually allowed to make the system call > or not) and return -EPERM or jump to system call proper.
I'm pretty sure that auditing by your module can easily be avoided.
examle: pseudocode for the unlink syscall
long your_wrapped_syscall(char *userfilename) { char kernelpointer[something]; copy_from_user(kernelpointer, usefilename, ...); audit_log(kernelpointer); return original_syscall(userfilename); }
now.... the original syscall does ANOTHER copy_from_user(). Eg I can easily fool your logging by having a second thread change the filename between the time your code copies it and the time the original syscall copies it again. The chances of getting the timing right are 50% at least (been there done that ;)
The only solution for this is to check/audit/log things after the ONE copy. Eg not by overriding the syscall but inside the syscall. [unhandled content-type:application/pgp-signature] |  |