Why do certain Linux x86_64 system calls require a stub?
c, linux-kernel, operating-system, system-calls, x86-64
Solution
From here, it says:
"Certain special system calls that need to save a complete full stack frame."
And I think execve is just one of these special system calls.
From the code of stub_execve, If you want to hook it, at least you can try:
- Get to understand the meaning of those assembly code and do it by yourself, then you can call your own function in your own assembly code.
- From the middle of the assembly code, it has a `call sys_execve`, you can replace the address of sys_execve to your own hook function.
Problem
If one tries to hook certain syscalls via `sys_call_table`-hooking, e.g. `sys_execve` this will fail, because they are indirectly called by a stub. For `sys_execve` this is `stub_execve` (compare assembly code on LXR). But what are these stubs good for? Why do only certain system calls like `execve(2)` and `fork(2)` require a stub and how is this connected to x86_64? Is there a workaround to hook stubbed syscalls (in a Loadable Kernel Module)?