Re: Filtering Connect syscalls for af_inet only
On Thu, Feb 5, 2015 at 2:06 PM, F Rafi <farhanible(a)gmail.com> wrote:
I did some digging and now I understand the different size variations
of
sockaddr_storage. I guess I can just filter on a2!=6e then.
I assume 0x6e is the size of sockaddr_un? I would still caution
against filtering on any particular size as you could still use
sockaddr_storage for AF_UNIX. Granted, it's unlikely, but it is
possible.
And we'd have to keep an eye out for x86 systems. I understand
that x86_64
does not use socketcall() but, do you know if multiarch support somehow
allows 32bit apps on x86_64 to use / translate these calls?
32-bit x86 applications running on a x86_64 system use the 32-bit
socketcall() system call; there is no way around that, it's part of
the 32-bit x86 ABI for Linux.
--
paul moore
www.paul-moore.com