Download List

Project Description

The system call tracker is a Linux kernel module and supporting user space applications which allow interception of and possibly taking action upon system calls that match user-defined criteria. It allows you to set such rules as "tell me when someone tries to open /etc/passwd" and "if user '500' tries to connect to the network, fail the system call". It can also be thought of as strace on steroids.

System Requirements

System requirement is not defined
Information regarding Project Releases and Project Resources. Note that the information here is a quote from Freecode.com page, and the downloads themselves may not be hosted on OSDN.

2003-02-06 02:36
0.82

This release adds support for matching and logging the current working directory, so that you can know if 'open("passwd", ...)' relates to '/etc/passwd' rather than '/home/joe/tmp/passwd'." It also contains a bugfix when detecting whether the kernel modules are loaded in the user space libraries, and a fix for sctrace where sctracing a program with command line arguments could fail to find the program to trace.
Tags: Minor feature enhancements

2003-01-28 14:37
0.81

This release includes support for matching against void pointers (addresses) and re-enables support for tracking the shmat and msgrcv calls. sctrace now supports strace's 'follow forks' mode, and tracking was implemented for the last two remaining syscalls, sys_vfork and sys_bdflush. The userspace tools now behave sensibly when the kernel modules aren't loaded and complain. The '-h' and '--help' command line flags for sct_logctrl were added. This release also includes assorted other bugfixes for kernel modules, so an upgrade is recommended.
Tags: Major bugfixes

2002-11-23 21:30
0.80

This release contains support for multiple readers of the
log device. It is now possible to have two (or more)
different log device readers. Each log device reader can set
its own log device parameter, such as the log format and
the log buffer size. See sct_logctrl(1) and sctlog(1) for
further details. This release disables support for the
'shmat', 'semctl', and 'msgrecv' system calls (muxed
functions of the sys_ipc system call, to be precise). This
will be fixed and included in the next release.
Tags: Major feature enhancements

2002-09-14 01:11
0.75

This release contains complete autotools support for the entire syscalltrack system: kernel modules, libraries, and applications. It also contains support for 'kill process' and 'suspend process' actions. Now you can set rules to kill any process that matches a rule, or to suspend it. This release also contains two major bugfixes, one for an SMP race and the other for the bdflush() system call, and many more supported system calls. Upgrading is recommended.
Tags: Major feature enhancements

2002-09-01 03:26
0.74

The major change in this release is the addition of support for over 100 system calls. It includes infrastructure support for 64 bit system call parameters, such as long long and loff_t. This release also fixes bugs in various areas. Most notable are the bugfixes to the syscall data file parser (which is used by sctrace and sct_config), and to sctrace and the logging mechanism. This release has been extensively tested on 2.4 kernels. It should work on 2.5 kernels. It does not work on 2.2 kernels, due to technical difficulties.
Tags: Major feature enhancements

Project Resources