RE: [Dazuko-devel] system call hooking for Linux 2.6?

[Tikka, Sami]

>-----Original Message-----
>From: address@hidden 
>[mailto:address@hidden
>] On Behalf Of John Ogness
>Sent: Tuesday, August 30, 2005 11:40 AM
>To: address@hidden
>Subject: [Dazuko-devel] system call hooking for Linux 2.6?
>
>Should Dazuko switch back to hooking the system call table for 
>Linux 2.6 until DazukoFS is ready?

IMHO the LSM has been more trouble than its worth, be it frowned upon or not.
Frankly, our application has had far more installation issues with 2.6
kernels than with 2.4 kernels (= no problems at all).

>Should it be an option which method of hooking is used?

That would be nice, but I would suspect it makes the code too complicated. If
that's not the case, then why not. Choice is good.

>Should LSM be a fallback in case system call hooking doesn't 
>work (or vice versa)?

Like I said, I have always had problems with LSM. We can use some magic to
find the syscall table or even find it from System.map for the cases when it
is not exported. I am not aware of other problems with syscall hooking.

>Our final decision will not have any affect on the 2.1.0 
>release. I am not willing to delay the 2.1.0 release in order 
>to add system call hooking.

Looking forward to it.
-- 
Sami Tikka                tel. +358 9 2520 5115 
senior software engineer  fax. +358 9 2520 5014
                          mobile +358 40 7379388
F-Secure Corporation      http://www.f-secure.com
BE SURE