TLDR: you are currently relying on unspecified behaviour of signal(2); use sigaction (carefully) instead. Firstly, SIGCHLD is strange. From the manual page for sigaction; POSIX.1-1990 disallowed setting the action for SIGCHLD to SIG_IGN. POSIX.1-2001 allows this possibility, so that ignoring SIGCHLD can be used to prevent the creation of zombies (see wait(2)). Nevertheless, the historical … Read more
Short Answer: They are different things. A system call is call by software running on the OS to services provided by the OS. An interrupt is usually external hardware component notifying the CPU/Microprocessor about an event that needs handling in software (usually a driver). I say usually external, because some interrupts can be raised by … Read more
A blocking system call is one that must wait until the action can be completed. read() would be a good example – if no input is ready, it’ll sit there and wait until some is (provided you haven’t set it to non-blocking, of course, in which case it wouldn’t be a blocking system call). Obviously, … Read more
From the userspace side, the mechanics are identical to making a syscall on a 32 bit native kernel – all the usermode code, including the 32 bit glibc, works the same way. From the kernel side, the old IA32 entry points from userspace (eg. int 0x80) are set up to call the ia32_syscall assembler routine. … Read more
You can use the wrap feature provided by ld. From man ld: –wrap symbol Use a wrapper function for symbol. Any undefined reference to symbol will be resolved to __wrap_symbol. Any undefined reference to __real_symbol will be resolved to symbol. So you just have to use the prefix __wrap_ for your wrapper function and __real_ … Read more
You can find the answer in man 2 write: It is not an error if this number is smaller than the number of bytes requested; this may happen for example because the disk device was filled. And from the write() man page description: ssize_t write(int fd, const void *buf, size_t count); According to POSIX.1, if … Read more
Libc exposes a function to invoke “custom” syscalls: long syscall(long number, …); syscall() is a small library function that invokes the system call whose assembly language interface has the specified number with the specified arguments. Employing syscall() is useful, for example, when invoking a system call that has no wrapper function in the C library. … Read more
On Linux mmap2 is a sensible system call to use for this at a low level. It takes 6 arguments, so in IA32 you can call it using: mov eax, 192 ; mmap2 xor ebx, ebx ; addr = NULL mov ecx, 4096 ; len = 4096 mov edx, $7 ; prot = PROT_READ|PROT_WRITE|PROT_EXEC mov … Read more
In order to understand these, you have to get familiar with the POSIX system calls. They are the interface a user-space program uses to interact with the kernel. lseek, write, close, mmap, munmap and fstat are all system calls and are documented in section 2 of the linux manual. Briefly, lseek moves the internal pointer … Read more
codepad.org has something based on geordi, which runs everything in a chroot (i.e restricted to a subtree of the filesystem) with resource restrictions, and uses the ptrace API to restrict the untrusted program’s use of system calls. See http://codepad.org/about . I’ve previously used Systrace, another utility for restricting system calls. If the policy is set … Read more