Thanks for advice !<br>I am using the LSM framework even though it need recompiling the kernel. But I will also give a try to the kernelroll module.<br>Modifying sys_call_table is easier to get error but it can get more freedom than LSM framework which could only hook on limit hooking points.<br>
<br><br><br><div class="gmail_quote">On Mon, Nov 28, 2011 at 9:12 AM, richard -rw- weinberger <span dir="ltr"><<a href="mailto:richard.weinberger@gmail.com">richard.weinberger@gmail.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex;">
<div class="im">On Sun, Nov 27, 2011 at 11:17 PM, Jonathan Neuschäfer<br>
<<a href="mailto:j.neuschaefer@gmx.net">j.neuschaefer@gmx.net</a>> wrote:<br>
> On Wed, Nov 23, 2011 at 04:40:14PM +0800, Geraint Yang wrote:<br>
>> Hello everyone,<br>
>><br>
>> I am going to hook a system call like 'read' or 'send' by modifying the<br>
>> sys_call_table, but it seems that the sys_call_table is in read only page,<br>
>> how can I set modify the sys_call_table ? Or if there any method that I can<br>
>> use to hook a system call in module without modify the kernel source?<br>
<br>
</div>Please keep in mind that hooking a system call is very bad and error prone.<br>
<span class="HOEnZb"><font color="#888888"><br>
--<br>
Thanks,<br>
//richard<br>
</font></span></blockquote></div><br><br clear="all"><br>-- <br><div style="text-align:left">Geraint Yang <br>Tsinghua University Department of Computer Science and Technology</div>
<div><br></div><br>