Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

It there reliable method of "wrapping" system calls under Linux ? (Like LD_PRELOAD for wrapping shared library function calls.)

Is there reliable, secure method of "wrapping" system calls (and, maybe receiving signals), that process can not break (assuming proper Linux implementation) ?

share|improve this question

3 Answers 3

Yes. You use system call interposition. One portable method is to use ptrace, though this can introduce a non-trivial performance overhead as it forces a context switch on every system call. On Solaris, you can use /proc; /proc lets you specify the subset of system calls that you are interested in wrapping, which lets you achieve better performance at the cost of compatibility.

Take a look at Plash, Systrace, and Subterfugue, to see some worked systems that use these sorts of methods. Also look at Chrome's sandbox, which uses a variety of mechanisms (including seccomp on Linux).

share|improve this answer
1  
Thanks, your tips sounds interesting. I knew some of them, I'd like to add about PinkTrace - I've found it interesting programming library. What is missing puzzle to me in all those solutions : how to change brk calls in NOP, and reserve proper amount of memory before it is run. –  Grzegorz Wierzowiecki Nov 11 '11 at 22:45
    
Thanks for info about Solaris /proc. I haven't knew about this feaure. :) –  Grzegorz Wierzowiecki Nov 11 '11 at 22:46

I would use one of the many virtualization technologies available. If you only want to restrict what resources are available to a particular process, a jail mechanism such as cgroups should be enough. For more fine-tuning of what happens when the process executes a system call, check out User Mode Linux.

share|improve this answer
    
Thanks for pointing out cgroups - You've encouraged me to read more deeply about them :). –  Grzegorz Wierzowiecki Nov 11 '11 at 22:46

http://cacheprint.wordpress.com/2011/04/16/wrapping-system-calls/

Check out this link.

share|improve this answer
    
Hello William and welcome to IT Security StackExchange. Please write a summary of the content you linked to. –  Hendrik Brummermann Dec 10 '11 at 11:04
1  
This is not a secure way to wrap system calls. If the process is malicious, it can bypass your wrappers and invoke the OS directly. The method you describe (library interposition) is useful for debugging, but not for security applications where the program may be malicious/untrusted. –  D.W. Dec 11 '11 at 4:10
    
Please check out this : My answer for : Create a wrapper function for malloc and free in C. Thanks @D-W for stressing out what's the problem with proposed solution. :) –  Grzegorz Wierzowiecki Jan 14 '12 at 11:54

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.