Re: intercepting syscalls

[Arjan van de Ven <arjan@infradead.org>]

On Mon, 2005-04-18 at 20:56 +0200, Terje Malmedal wrote:
> [Arjan van de Ven]
> >> > but also about doing things at the right layer. The syscall layer is
> >> > almost NEVER the right layer.
> >> > 
> >> > Can you explain exactly what you are trying to do (it's not a secret I
> >> > assume, kernel modules are GPL and open source after all, esp such
> >> > invasive ones) and I'll try to tell you why it's wrong to do it at the
> >> > syscall intercept layer... deal ?
> >> 
> >> now, when I need someone to tell I do something wrong, I know where to go :)
> 
> > ok i'll spice things up... I'll even suggest a better solution ;)
> 
> Hi. The promise wasn't made to me, but I'm hoping you will find a nice
> and clean solution:
> 
>   Every so often there is bug in the kernel, by patching the
>   syscall-table I have been able to fix bugs in ioperm and fsync without
>   rebooting the box. 
> 

>   What do I do the next time I need to do something like this? 

use kprobes or so to actually replace the faulty lower level function..
you don't know from how many different angles the lower level function
is called, so you're really best of by replacing it at the lowest
possible level, eg closest to the bug. That *very* seldomly is the
actual syscall function.