Rewriting Every Syscall in a Linux Binary at Load Time
amitlimaye1.substack.com
Rewriting Every Syscall in a Linux Binary at Load Time
1–10 of 50 posts
Re: Rewriting Every Syscall in a Linux Binary at Load Time
#2I assume this would break observability through existing methods, right? If you were to strace a process that has been patched, would you see regular syscall data (as if it wasnt patched) or would your syscall replacement appear along the way?
Re: Rewriting Every Syscall in a Linux Binary at Load Time
#3I assume this would break observability through existing methods, right? If you were to strace a process that has been patched, would you see regular syscall data (as if it wasnt patched) or would your syscall replacement appear along the way?
Good question. I didn't cover this in the post — the binary doesn't run on the host kernel directly. It runs inside a lightweight KVM-based VM with no operating system. The shim is the only thing handling syscalls inside the guest. So strace on the host wouldn't see anything — no syscalls reach the host kernel from the guest. From the host side, the only visible activity is the hypervisor process making syscalls on behalf of the guest.
Inside the guest, there's no kernel to attach strace to — the shim IS the syscall handler. But we do have full observability: every syscall that hits the shim is logged to a trace ring buffer with the syscall number, arguments, and TSC timestamp. It's more complete than strace in some ways — you see denied calls too, with the policy verdict, and there's no observer overhead because the logging is part of the dispatch path.
So existing tools don't work, but you get something arguably better: a complete, tamper-proof record of every syscall the process attempted, including the ones that were denied before they could execute. I'll publish a follow-on tomorrow that details how we load and execute this rewritten binary and what the VMM architecture looks like.
Re: Rewriting Every Syscall in a Linux Binary at Load Time
#4You mentioned SECCOMP_RET_TRACE, but there is also SECCOMP_RET_TRAP[1] which appears to perform better. There is also KVM. Both of these are options for gVisor: https://github.com/google/gvisor>
[1] https://github.com/google/gvisor/blob/master/pkg/sentry/plat...>
Re: Rewriting Every Syscall in a Linux Binary at Load Time
#5Hah, I've been looking into something amusingly similar to track mmap syscalls for a process :)
Re: Rewriting Every Syscall in a Linux Binary at Load Time
#6You mentioned SECCOMP_RET_TRACE, but there is also SECCOMP_RET_TRAP[1] which appears to perform better. There is also KVM. Both of these are options for gVisor: https://github.com/google/gvisor > [1] https://github.com/google/gvisor/blob/master/pkg/sentry/plat... >
There's also SECCOMP_RET_USER_NOTIF, which is typically used by container runtimes for their sandboxing.
Re: Rewriting Every Syscall in a Linux Binary at Load Time
#7You mentioned SECCOMP_RET_TRACE, but there is also SECCOMP_RET_TRAP[1] which appears to perform better. There is also KVM. Both of these are options for gVisor: https://github.com/google/gvisor > [1] https://github.com/google/gvisor/blob/master/pkg/sentry/plat... >
There's also SECCOMP_RET_USER_NOTIF, which is typically used by container runtimes for their sandboxing.
SECCOMP_RET_USER_NOTIF seems to involve sending a struct over an fd on each syscall. Do they really use it? Performance ought to suffer.
Also gVisor (aka runsc) is a container runtime as well. And it doesn't gatekeep syscalls but chooses to re-implement them in userland.
Re: Rewriting Every Syscall in a Linux Binary at Load Time
#8This might be a very dumb question, but if the process is being run under KVM to catch `int 0x03` then couldn't you also use KVM to catch `syscall` and execute the original binary as-is? I don't understand what value the instruction rewriting is providing here.
Re: Rewriting Every Syscall in a Linux Binary at Load Time
#9Really informative writing thank you.
How secure does this make a binary? For example would you be able to run untrusted binary code inside a browser using a method like this?
Then can websites just use C++ instead of javascript for example?
Re: Rewriting Every Syscall in a Linux Binary at Load Time
#10[dead]