Reputation: 714
i am new in assembly and in Linux kernel. i want to show 100 recently used for all processes.(strace
just shows for one process.).
to do this i want to declare an array with 100 index in arch/kernel/entry_64.s
then send it's memory address to C function of my system call and show them to user, but i can not declare array in assembly. how can i do it?
Upvotes: 0
Views: 150
Reputation: 58822
If you can't use auditing as-is, then I would suggest you tweak the auditing code path.
1) make the call unconditional,such as by inserting a jmp auditsys
before system_call_fastpath
2) change audit_syscall_entry
to your liking (that's C code in kernel/auditsc.c)
Upvotes: 1