我想杀死一个子进程，如果它执行除读写之外的其他系统调用（甚至也过滤这些调用，但这是一个不同的故事），但默认情况下会执行一些系统调用。
我已经编译了一个空的测试子程序（立即退出），并且我还有一个父进程，它可以分叉、启用 ptracing 并执行子程序。父进程使用 PTRACE_SYSCALL 并每次检查 orig_eax。我的测试程序报告孩子被停止了 49 次（我认为这意味着 48 / 2 + 1 系统调用）。
我想知道系统调用序列是否始终相同（初始化）和/或是否可以知道何时可以启动以及何时停止父级中的kill-on-syscall？
I want to kill a child process if it does other system calls than read and write (and even filter these calls as well, but it's a different story) but there some system calls done by default.
I have compiled an empty test child (exits instantly) program and I also have a parent process which forks, enables ptracing and executes the child program. Parent process uses PTRACE_SYSCALL and checks orig_eax every time. My test program reports that the child was stopped 49 times (which, I assume, means 48 / 2 + 1 system calls).
I wanted to know whether the system calls sequence is always the same (initialization) and/or it's possible to know when I can start and when to stop kill-on-syscall in my parent?
发布评论
评论（1）
我曾经遇到过类似的问题（请参阅我关于该主题的问题） 。当程序启动时，它会在调用
main()之前初始化应用程序（例如加载共享库）时执行大量系统调用。我所做的只是允许更多的系统调用并使用另一种安全方法（例如 chroot）来防止应用程序访问不需要的文件。更好的选择是以某种方式找到程序的
main()函数的入口点（请参阅 本教程用于编写调试代码）并在此之后禁用系统调用。我不知道在一般情况下是否可以这样做，但这就是我开始搜索的方式。找到入口点后，还有另一种方法可以限制程序进行某些系统调用。不要使用 PTRACE_SYSCALL 来检查程序完成的每个系统调用，而是注入
prctl(PR_SET_SECCOMP, ...)调用程序（使用ptrace()）然后让程序继续运行。I had a similar problem once (see my question on the topic). When a program starts, it executes a lot of system calls when initializing the application (such as loading shared libraries) before calling
main(). What I did is to simply allow somewhat more system calls and use another means of security (such aschroot) to prevent the application from accessing undesired files.A better option would be to somehow find the entry point of the
main()function of the program (see this tutorial for writing debugging code) and disable system calls after that point. I don't know if it's possible to do in general case, but that's the way I would start to search.After finding the entry point, there is another way of restricting the program from making certain system calls. Instead of using
PTRACE_SYSCALLto check each system call done by the program, inject aprctl(PR_SET_SECCOMP, ...)call to the program (usingptrace()) then just leave the program running.