Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

It there reliable method of "wrapping" system calls under Linux ? (Like LD_PRELOAD for wrapping shared library function calls.)

Is there reliable, secure method of "wrapping" system calls (and, maybe receiving signals), that process can not break (assuming proper Linux implementation) ?

share|improve this question

Yes. You use system call interposition. One portable method is to use ptrace, though this can introduce a non-trivial performance overhead as it forces a context switch on every system call. On Solaris, you can use /proc; /proc lets you specify the subset of system calls that you are interested in wrapping, which lets you achieve better performance at the cost of compatibility.

Take a look at Plash, Systrace, and Subterfugue, to see some worked systems that use these sorts of methods. Also look at Chrome's sandbox, which uses a variety of mechanisms (including seccomp on Linux).

share|improve this answer
Thanks, your tips sounds interesting. I knew some of them, I'd like to add about PinkTrace - I've found it interesting programming library. What is missing puzzle to me in all those solutions : how to change brk calls in NOP, and reserve proper amount of memory before it is run. – Grzegorz Wierzowiecki Nov 11 '11 at 22:45
Thanks for info about Solaris /proc. I haven't knew about this feaure. :) – Grzegorz Wierzowiecki Nov 11 '11 at 22:46

I would use one of the many virtualization technologies available. If you only want to restrict what resources are available to a particular process, a jail mechanism such as cgroups should be enough. For more fine-tuning of what happens when the process executes a system call, check out User Mode Linux.

share|improve this answer
Thanks for pointing out cgroups - You've encouraged me to read more deeply about them :). – Grzegorz Wierzowiecki Nov 11 '11 at 22:46

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.