Re: Kernel module that catches a syscall (i/o event)

[Andrea Gasparini <gaspa@xxxxxxxxxxx>]

Liran spiffera, alle Sunday 25 February 2007 11:05 circa:
> I will examine the LD_PRELOAD idea, seems like it could work.
> Regarding the kernel module idea by replacing an existing function,
> doing some stuff and then restoring the original system call - is
> this a normal way of approaching it? Would it be considered ok?

note that LD_PRELOAD is not a "total" solution: if a program calls 
syscall() directly, that function will not pass through the preloaded 
library.
(and glibc makes that in printf and other functions )

IMHO ptrace is better from this point of view.

Bye!
-- 
-gaspa-
-----------------------------------------------
--------- Powered by Debian GNU/Linux ---------
------ HomePage: iogaspa.altervista.org -------
-Il lunedi'dell'arrampicatore: www.lunedi.org -

--
To unsubscribe from this list: send an email with
"unsubscribe kernelnewbies" to ecartis@xxxxxxxxxxxx
Please read the FAQ at http://kernelnewbies.org/FAQ