Re: [filemon] CVS commit: htdocs/support/security

[Paul Goyette <paul%whooppee.com@localhost>]

Please note that we do have a way of installing new syscalls (via the
syscall_{,dis}establish() mechanism), but that only works for syscalls
that are not currently in use.  We don't have a (clean) way to replace
an already-installed syscall (no way to retrieve the current function
pointer).


On Tue, 17 Dec 2019, Kamil Rytarowski wrote:

> On 17.12.2019 15:44, Andrew Doran wrote:
> > > > > Typically with a character device, the kmod can get unloaded while an ioctl
> > > > > is being executed on it.
> >
> > That's solvable.  Conceptually I think the main stumbling block is that
> > there are two layers at play which need to reconciled: specfs and devsw.  It
> > could also be an opportunity to lessen the distinction between block and
> > character devices, there's no real need for cached access from userspace,
> > that would simplify things too.
> >
> > > > > When it comes to syscalls, I haven't looked
> > > > > closely, but the issue is likely the same.
> >
> > It's atomic and side effect free if done correctly.  We have pleasing
> > examples of this.  This is hard to get right though, so naturally mistakes
> > are made.
>
> It would be nice to have at least an example of doing it right.
>
> > Andrew
>
>
> !DSPAM:5df8f070102259202610505!

+--------------------+--------------------------+-----------------------+
| Paul Goyette       | PGP Key fingerprint:     | E-mail addresses:     |
| (Retired)          | FA29 0E3B 35AF E8AE 6651 | paul%whooppee.com@localhost     |
| Software Developer | 0786 F758 55DE 53BA 7731 | pgoyette%netbsd.org@localhost   |
+--------------------+--------------------------+-----------------------+