What about int 80h?
Rewriting Every Syscall in a Linux Binary at Load Time
11–20 of 50 posts
Re: Rewriting Every Syscall in a Linux Binary at Load Time
#12Love the detailed write up, thanks!
This is the kind of foundation that I would feel comfortable running agents on. It’s not the whole solution of course (yes agent, you’re allowed to delete this email but not that email can’t be solved at this level)… let me know when you tackle that next :-)
Re: Rewriting Every Syscall in a Linux Binary at Load Time
#13I've been thinking of making a kernel patch that disables eBPF for certain processes as a privacy tool. Everyone is using eBPF now.
Re: Rewriting Every Syscall in a Linux Binary at Load Time
#14You either have a writing style that is uncannily similar to what an LLM generates, or this article was substantially written by an LLM. I don't know what it is about the style, but I just find it a bit exhausting, like an overfit on "engaging writing" that strips away sincerity.
Re: Rewriting Every Syscall in a Linux Binary at Load Time
#15Really informative writing thank you. How secure does this make a binary? For example would you be able to run untrusted binary code inside a browser using a method like this? Then can websites just use C++ instead of javascript for example?
They already can use C++ if they want to. Emscripten? Jslinux?
Re: Rewriting Every Syscall in a Linux Binary at Load Time
#16Really informative writing thank you. How secure does this make a binary? For example would you be able to run untrusted binary code inside a browser using a method like this? Then can websites just use C++ instead of javascript for example?
They already can use C++ if they want to. Emscripten? Jslinux?
I mean just distributing the regular compiled x86_64 binary and then running it as a normal executable on the client side but just using that syscall shim so it is safe.
Re: Rewriting Every Syscall in a Linux Binary at Load Time
#17This might be a very dumb question, but if the process is being run under KVM to catch `int 0x03` then couldn't you also use KVM to catch `syscall` and execute the original binary as-is? I don't understand what value the instruction rewriting is providing here.
Yes, that seems unneccessary. The overhead of trapping and rewriting every syscall instruction once can't be (much) greater than that required for rewriting them at the start either.
Even if you disallow executing anything outside of the .text section, you still need the syscall trap to protect against adversarial code which hides the instruction inside an immediate value:
foo: mov eax, 0xc3050f ;return a perfectly harmless constant
ret
...
call foo+1
Re: Rewriting Every Syscall in a Linux Binary at Load Time
#18You either have a writing style that is uncannily similar to what an LLM generates, or this article was substantially written by an LLM. I don't know what it is about the style, but I just find it a bit exhausting, like an overfit on "engaging writing" that strips away sincerity.
It’s clearly LLM written but the idea was interesting enough that I read it. I suspect based on username the writer is cleaning up their voice.
I think the idea of sharing the raw prompt traces is good. Then I can feed that to an LLM and get the original information prior to expansion.
Re: Rewriting Every Syscall in a Linux Binary at Load Time
#19Earlier quoted context omitted.
They already can use C++ if they want to. Emscripten? Jslinux?
I mean just distributing the regular compiled x86_64 binary and then running it as a normal executable on the client side but just using that syscall shim so it is safe.
If you think about the fundamentals involved here, what you actually need is for the OS to refuse to implement any syscalls, and not share an address space.
A process is already a hermetically sealed sandbox. Running untrusted code in a process is safe. But then the kernel comes along and pokes holes in your sandbox without your permission.
On Linux you should be able to turn off the holes by using seccomp.
Re: Rewriting Every Syscall in a Linux Binary at Load Time
#20> It can’t detect the interception
What's stopping the process from reading its own memory and seeing that the syscall was patched?