[Dazuko-devel] Re: Syscall hooks for Linux 2.6

[John Ogness]

Kevin Kofler wrote:
> I just looked at the 2.3.1-pre3 code and xp_sys_unhook has this:
> #ifdef SYSCALL_TABLE_READONLY
>       /* protect the syscall table */
>       change_page_attr(virt_to_page(sys_call_table), 1, PAGE_KERNEL);
>       global_flush_tlb();
> #endif
> This should be PAGE_KERNEL_RO (as this code is supposed to turn the write
> protection on the syscall table back on). xp_sys_hook has the correct code:
> #ifdef SYSCALL_TABLE_READONLY
>       /* protect the syscall table */
>       change_page_attr(virt_to_page(sys_call_table), 1, PAGE_KERNEL_RO);
>       global_flush_tlb();
> #endif

You're right! Thanks. I have made the change in CVS. It will be included in
the 2.3.1 official release.


> Oh, and what's the rationale for requiring --sct-readonly to be given
> explicitly? Forgetting it will completely lock up the system. I know there is
> a warning, but is there some reason the information in System.map cannot be
> trusted?

On several distributions (Gentoo, SUSE), the information in System.map lies.
Unfortunately there is no way to poll the running kernel to investigate the
truth at runtime.

John Ogness

-- 
Dazuko Maintainer