Re: Syscall security

From: Chris Wright
Date: Fri Sep 26 2003 - 11:12:02 EST


* Maciej Zenczykowski (maze@xxxxxxx) wrote:
> I'm wondering if there is any way to provide per process bitmasks of
> available/illegal syscalls. Obviously this should most likely be
> inherited through exec/fork.

A simple LSM module can do this for you. It will have a little
more overhead than denying at the syscall entry point, but it's
certainly going to be more flexible.

-chris
--
Linux Security Modules http://lsm.immunix.org http://lsm.bkbits.net
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/