Messages in this thread |  | | Date | Fri, 9 May 2003 22:07:08 +0300 | From | Muli Ben-Yehuda <> | Subject | Re: The disappearing sys_call_table export. |
| |
On Fri, May 09, 2003 at 01:08:08AM -0700, Greg KH wrote: > On Fri, May 09, 2003 at 10:42:08AM +0300, Muli Ben-Yehuda wrote: > > > > For example, a rogue process is calling settimeofday() on your router > > once a month(!). How are you going to find it? There's no LSM hook for > > settimeofday() > > Yes there is. Check the capable hook for CAP_SYS_TIME. LSM modules can > get that info quite easily.
Indeed, I missed the fact that LSM modules have a capable hook. Nonetheless, my original point stands: LSM and hooking kernel objects are great for security and auditing, hijacking system calls can be quite useful for debugging, both kernel and userspace.
Thanks, Muli. -- Muli Ben-Yehuda http://www.mulix.org
[unhandled content-type:application/pgp-signature] |  |