Linux SysCalls: Add/ Del/ Freeze

1. The syscall should have exactly one coherant purpose. What will it do? What are its pre- and post-conditions? Write its man page before proceeding to design the code.
2. What are the new system call's arguments, return value, and error codes? The system call should have a clean and simple interface with the smallest number of arguments possible. The semantics and behavior of a system call are important; they must not change, because existing applications will come to rely on them.

Multiplexing syscalls (a single system call that does wildly different things depending on a flag argument) is not a good thing. Look at ioctl() of Linux as an example of what not to do.

1. Designing the interface with an eye toward the future is important. Are you needlessly limiting the function? Design the system call to be as general as possible. Do not assume its use today will be the same as its use tomorrow. The purpose of the system call will remain constant but its uses may change. Is the system call portable? Do not make assumptions about an architecture's word size or endianness. Make sure you are not making poor assumptions that will break the system call in the future. Remember the Unix motto: "provide mechanism, not policy."

1. What is a Table of Pointers to Functions? If f(…) { …} is a C function, then f, without parentheses, is the address (pointer) of function f. Any address can be cast to void *.
2. Invariant Assertion: All pointers in the SysCall Table are valid pointers to syscall functions. The index is known as the syscall number.
3. All the syscall functions have the same prototype signatures.
4. To add a syscall:
   1. Write the code for the new system call.
   2. Add the pointer to this function into the table.
5. Delete: delete the pointer [set it to the address of no-op()]

1. Encrypt a file
2. Decrypt a file
3. Freeze a few syscalls.
4. ./sysCallRedir Example with src code

1. Deleting SysCalls. In the syscall table, set the syscalltable[nrdel] = syscalltable[not-implemented];
2. Freezing SysCalls. In the syscall table, save the syscalltable[nrdel] value, and then set the syscalltable[nrdel] = syscalltable[not-implemented];
3. Unfreezing the syscall restores the saved value.

1. Sowgandh S. Gadi, {\sl Security Hardened Kernels for Linux Servers}, WSU MS Thesis, April 2004. Advisor: Prabhaker Mateti. {Kernels aimed at NFS, FTP and other servers hardened with freezing syscalls.} Reference.
2. Asish Sahadevan, "Security Improvements to the Android Kernel", MTech Thesis, 70pp, Amrita Vishwa Vidyapeetham, Ettimadai, TN, India, Advisor: Prabhaker Mateti, Jul 2015. Implements Add/ Delete/ Freeze of syscalls. Reference.
3. https://linux-kernel-labs.github.io/master/ Linux Kernel Teaching, 201x. This is a collection of lectures and labs Linux kernel topics. Reference.
4. http://learnlinuxconcepts.blogspot.com/2014/03/memory-layout-of-userspace-c-program.html Memory Layout of Kernel and UserSpace in Linux. Reference.