lkml.org 
[lkml]   [2003]   [May]   [7]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    SubjectRe: The disappearing sys_call_table export.
    From
    Date
    On Wed, 2003-05-07 at 18:59, Richard B. Johnson wrote:
    > On Wed, 7 May 2003, petter wahlman wrote:
    >
    > > On Wed, 2003-05-07 at 18:00, Richard B. Johnson wrote:
    > > > On Wed, 7 May 2003, petter wahlman wrote:
    > > >
    > > > >
    > > > > It seems like nobody belives that there are any technically valid
    > > > > reasons for hooking system calls, but how should e.g anti virus
    > > > > on-access scanners intercept syscalls?
    > > > > Preloading libraries, ptracing init, patching g/libc, etc. are
    > > > ^^^^^^^^^^^^^^^^^^^
    > > > |________ Is the way to go. That's how
    > > > you communicate every system-call to a user-mode daemon that
    > > > does whatever you want it to do, including phoning the National
    > > > Security Administrator if that's the policy.
    > > >
    > > > > obviously not the way to go.
    > > > >
    > > >
    > > > Oviously wrong.
    > >
    > >
    > > And how would you force the virus to preload this library?
    > >
    > > -p.
    > >
    >
    > The same way you would force a virus to not be statically linked.
    > You make sure that only programs that interface with the kernel
    > thorugh your hooks can run on that particular system.
    >

    Can you please elaborate.
    How would you implement the access control without modifying the
    respective syscalls or the system_call(), and would you'r
    solution be possible to implement run time?

    Regards,

    -p.

    -
    To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
    the body of a message to majordomo@vger.kernel.org
    More majordomo info at http://vger.kernel.org/majordomo-info.html
    Please read the FAQ at http://www.tux.org/lkml/

    \
     
     \ /
      Last update: 2005-03-22 13:35    [W:0.020 / U:31.488 seconds]
    ©2003-2016 Jasper Spaans. hosted at Digital OceanAdvertise on this site