Re: Capturing System Calls

[ofriedrichs () SECURITYFOCUS COM (Oliver Friedrichs)]

If you only want to see what a program is doing, use 'truss' on solaris,
'ktrace' on bsd.

DESCRIPTION
     The truss  utility executes the specified command  and  pro-
     duces  a  trace of the system calls it performs, the signals
     it receives, and the machine faults it incurs. Each line  of
     the  trace output reports either the fault or signal name or
     the system call name with its arguments and return value(s).
     System call arguments are displayed symbolically when possi-

If you want to interactively trace the process, use the 'ptrace()' system
call.

- Oliver

> -----Original Message-----
> From: Green Charles Contr AFRL/IFGB [mailto:Charles.Green () RL AF MIL]
> Sent: Thursday, June 22, 2000 9:23 AM
> To: VULN-DEV () SECURITYFOCUS COM
> Subject: Capturing System Calls
>
>
> On UNIX Systems, (FreeBSD, Linux, Solaris) is there a way to
> capture/modify
> system calls calls from an application with out modifying the
> kernel (or
> using kernel modules) - preferably in userspace? The reason I
> ask is that a
> group of us are being asked to evaluate a piece of software
> for my company
> but they've put some heavy restrictions on how we do it. One of the
> restriction is that we're not allowed to modify the kernel.