I'm interested to write a kernel program that can have all possible controls on syscalls, such as intersection, filtering, and make changes in their arguments.

I look up for two goals:

  1. read system calls and their arguments and decide to block or allow them according to a policy.
  2. have access to change their argument and pass them to the user.

In fact (I do not know if this allegory is true or not?), I want to do something like simple virtualization for a process that can change its view to the kernel and its system calling (like it requested a file in "/tmp/new_folder/foo.txt" by open syscall and we return "/tmp/another_folder/foo2.txt" instead).

I insist that this be done with ebpf. But if there is another way, I would welcome it.

Also, I should say, I know the usage of bcc in this case. it seems to designed for tracing but not filtering and influencing. as well as I tried seccomp and it is better than bcc, but seccomp can't be used for access arguments and it is an important factor for me. so I think my answer may be in something like lsm. but I don't know how and didn't find any good doc for it.

Thanks for any help.

  • Seccomp relies on cBPF, not eBPF. But it looks like your best pick if you're really after syscalls. I don't think seccomp on its own can modify the arguments for the syscalls, but if you search a little, you quickly find solutions like this one involving seccomp + ptrace.
    – Qeole
    May 12, 2021 at 13:58

1 Answer 1


You can do this with ptrace(2) using PTRACE_GETREGSET and PTRACE_SETREGSET.

Note that strings (such as filesystem paths) passed to syscalls are actually passed by reference as pointers to a userspace buffer. If you intercept the syscall, you have to not only change the pointer in the argument, but you have to put your new string in memory somewhere, if it doesn't already exist.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .