SyscallGuard Plugin

[kiwidoggie]

At this point a complete rewrite of the SyscallGuard system will need to be written. What is SyscallGuard you ask? This is something that will be enabled by default for Mira users that will prevent other code from calling arbitrary syscalls that could be used for escalation of privileged, effectively disabling syscall11 or sys_kexec.

This means that all usermode programs will not have the ability to execute code as kernel without going through the Mira device driver.

This will help to curve the malicious payloads that are currently available, and hopefully prevent people from bricking their units as often.

The way that the SyscallGuard plugin originally worked, which will need modification/variant.

• Iterate through all of the syscalls
• Hook all syscalls to jump to a common stub
• Check the rax and other registers/stack for what was called, what the arguments are
• Determine if the rax syscall number matches one we explicitly deny and handle accordingly.

BTW: All syscall error codes must be a positive error number. Returning a negative number causes the IOCTL handler to crash, just don't do it. Return proper error codes from errno.h.