linux-kernel - Re: why is intercepting system calls considerred bad?

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-Id: <E1G3ph4-0000Z9-VV@be1.lrz>
Date:	Fri, 21 Jul 2006 09:44:46 +0200
From:	Bodo Eggert <7eggert@...tempel.de>
To:	Joshua Hudson <joshudson@...il.com>,
	Irfan Habib <irfan.habib@...il.com>,
	linux-kernel@...r.kernel.org
Subject: Re: why is intercepting system calls considerred bad?

Joshua Hudson <joshudson@...il.com> wrote:
> On 7/20/06, Irfan Habib <irfan.habib@...il.com> wrote:

>> I recently met a kernel janitor, who told me that intercepting system
>> calls is undesirable, why?
> 
> I'll bite.
> 
> You intercept. Somebody else intercepts. You want to stop intercepting.

Use a double-linked list.

Having a mechanism to intercept syscalls will slow down syscall processing,
and there was no legit user in the history of linux. If you need something
like that, there is ptrace.

> For this reason, anybody who intercepts a system call must be compiled
> in,

No, but they may need to be compiled in for other reasons.

> and if two intercept the same system call, than the link order
> dictates behavior.
> 
> Obviously not desirable.

ACK.
-- 
Ich danke GMX dafür, die Verwendung meiner Adressen mittels per SPF
verbreiteten Lügen zu sabotieren.

http://david.woodhou.se/why-not-spf.html
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/