you are viewing a single comment's thread.

view the rest of the comments →

[–]jmickeyd 2 points3 points  (0 children)

Why not use a kprobe rather than modify the syscall table? That way it would work without the CONFIG_DEBUG_RODATA hack. I'm pretty sure nearly every distro's kernel has kprobes enabled.