NHacker Next
  • new
  • past
  • show
  • ask
  • show
  • jobs
  • submit
System call instrumentation on Linux/x86‑64 using memory‑indirect calls, part I (humprog.org)
freestanding 16 minutes ago [-]
that is graphomania. syscalls are easy and dont require so much bloat. beside its lefty GNUnix license
quotemstr 2 hours ago [-]
Linux is unusual in OS kernels in that direct system calls from arbitrary userspace code are supported and ABI-stable. This model has always been a terrible idea. It robs the system of an ability to intercept system calls in userspace before doing an expensive privilege-mode transition.

If, instead, as on OpenBSD, the kernel enforced the rule that all system calls had to go through libc (or perhaps a big ntdll.dll-like VDSO), then the whole problem the linked article tries in vain to solve would disappear. If you wanted to hook a system call, you'd just change the libc/VDSO dispatch. No need to rewrite any instructions.

If I were Linus, I'd make a new rule: starting today, all new system calls must go through VDSO. No exceptions. SYSCALL from anywhere else? SIGKILL.

This way, you can just LD_PRELOAD in front of the VDSO and system call interception in userspace Just Works.

yjftsjthsd-h 1 hours ago [-]
> This model has always been a terrible idea. It robs the system of an ability to intercept system calls in userspace before doing an expensive privilege-mode transition.

This model has always been a trade-off. It has downsides, but it also has upsides, including an immense boost in flexibility; decoupling from any particular userspace is useful.

> This way, you can just LD_PRELOAD in front of the VDSO and system call interception in userspace Just Works.

Can you LD_PRELOAD in front of the vDSO? I was under the (possibly mistaken) impression that the kernel injects it directly.

freestanding 18 minutes ago [-]
thats why OpenBSD is unconvinient for development - because it binds to libc bloatware
throwaway7356 49 minutes ago [-]
> all system calls had to go through libc (or perhaps a big ntdll.dll-like

Which makes containers crap on Windows and *BSD as they have to run the currect libc or equivalent. Thus you need to build a different container per OS version which sucks compared to Linux.

Joker_vD 4 minutes ago [-]
Windows doesn't even have its own libc.
Gualdrapo 1 hours ago [-]
> If I were Linus, I'd make a new rule

Or, you know, just propose your idea to him

yjftsjthsd-h 49 minutes ago [-]
Based on https://www.phoronix.com/news/Linus-Torvalds-No-Random-vDSO , I had been under the impression that he wasn't fond of adding more use of vDSO. On rereading, I can't tell if that's a vDSO thing or a preference against fast randomness being provided by the kernel.
Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact
Rendered at 18:03:57 GMT+0000 (Coordinated Universal Time) with Vercel.