On Sat, 2 Dec 2006, Stanislav Ochotnicky wrote:
trustedbsd's MAC framework: i've read manual, looked at source etc. And I couldn't find a way to stop at every syscall certain process has made. There is mac_syscall() function but as far as I could tell, it only registers new syscall. All in all, it seems that it should have some way to do this, maybe I just couldn't find it.
As discussed elsewhere in the thread, ptrace() has a syscall trapping facility, although I've not used it so can't speak to how well it works.
There are patches to add system call entry and exit hooks to the MAC Framework, but they've not yet been merged. I anticipate that they will ship in FreeBSD 7.0, and may get MFC'd, depending on schedule, etc.
Robert N M Watson Computer Laboratory University of Cambridge _______________________________________________ freebsd-hackers@freebsd.org mailing list http://lists.freebsd.org/mailman/listinfo/freebsd-hackers To unsubscribe, send any mail to "[EMAIL PROTECTED]"
