Patent ID: 8230399

Claim:
A method for interposing on a system call from user space, the method comprising: facilitating intercepting the system call in a process executing in user space of a computer by: setting up in the executing process of the computer, before execution of the system call to be intercepted, a signal handler comprising code for executing operations in relation to the system call to be intercepted, the code allowing the executing process to interpose itself from user space on the executing process' own system call; performing in the executing process, before execution of the system call to be intercepted, a SELF PTRACE request which sets a system trace flag and a self trace flag in an operating system kernel of the computer, the operating system kernel of the computer supporting ptrace system calls, including a system trace, the self ptrace flag facilitating self-notifying the executing process itself whenever the executing process executes the system call; and intercepting the system call of the executing process by executing processing in relation with the system call, the executing comprising: upon execution of the system call, the operating system kernel verifying that the system trace flag and the self trace flag, indicative of prior execution of the SELF PTRACE request in the executing process, are set; the operating system kernel saving system call information and sending a signal to the corresponding signal handler set-up in the executing process, the signal conveying system call information to user space; upon reception of the signal by the executing process, starting execution of the signal handler of the executing process in user space; at the end of signal handler execution in user space, restarting execution in the executing process at the next instruction following the intercepted system call while providing system call return information to calling code of the executing process making the system call.