Messages in this thread | | | From | Gaurav Saxena <> | Date | Fri, 23 Dec 2011 14:52:14 +0530 | Subject | Re: Intercepting system calls |
| |
Hello Richard
On Fri, Dec 23, 2011 at 2:46 PM, richard -rw- weinberger <richard.weinberger@gmail.com> wrote: > On Fri, Dec 23, 2011 at 10:08 AM, Gaurav Saxena <grvsaxena419@gmail.com> wrote: >> Ok I have seen details of KPROBES, I think it will suit to my >> requirements, I just wanted to know a few things, >> Can I use probes to prevent unlink of certain files? Also is >> CONFIG_KPROBES set to "y" on linux kernels available with distros like >> ubuntu? > > Kprobes allow you to instrument the kernel. > AFAIK it enabled by most distros. Can I use probes to return immediately ie. without execution of original system call. For example I put a entry probe on unlink and then on the probe return value unlink code is executed or not. Is that possible ? Also can I call a userspace function from kernel code? Would that be insecure ? > > -- > Thanks, > //richard
-- Thanks and Regards , Gaurav
| |