I am writing an application that will detect any application calling listen(2) to open a socket for incoming connections and look up with a table of rules. It is much like ApplicationFirewall in macOS. So my primary approach is to override the listen call using some loadable kernel module. Is it possible in linux, provided syscall table is readonly in kernel above 2.6? What else approach is preferable?

1 Answer 1


The preferable way is probably to use eBPF, see for instance;


Don't let the "Packet Filter" part fool you, BPF is not only about packet filtering any more. It has a quite steep learning curve but it's worth it.

  • eBPF can modify call from vm, but I'm asking for a solution to modify system-wide calls, be it any program on a system.
    – ynidpl
    Jun 3, 2021 at 7:06

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .