Messages in this thread | | | Date | Mon, 12 May 2008 20:06:17 -0400 | From | Mathieu Desnoyers <> | Subject | System call audit |
| |
Hi David,
As I am looking into the system-wide system call tracing problem, I start to wonder how auditsc deals with the fact that user-space could concurrently change the content referred to by the __user pointers.
This would be the case for execve. If we create a program with two thread; one is executing execve syscalls and the other thread would be modifying the userspace string containing the name of the program to execute. Since we have two copy_from_user, one in auditsc and one in the real execve() function, the string passed to the OS could differ from the string seen by auditsc.
Regards,
Mathieu
-- Mathieu Desnoyers OpenPGP key fingerprint: 8CD5 52C3 8E3C 4140 715F BA06 3F25 A8FE 3BAE 9A68
| |