Re: prevent module unloading

[fche at redhat dot com (Frank Ch. Eigler)]

arkady.miasnikov wrote:

> Modifying syscall arguments in the SystemTap probe will not impact the
> system call itself.  [...]

I'm not sure under in what context you mean.  We can definitely modify
system call parameters (or local variables generally) by writing to the
$context variables carrying function parameters via code like in
https://sourceware.org/systemtap/examples/#process/noptrace.stp :

[...]
probe syscall.ptrace {
   [...]
   # changing it to an invalid request number works too
   $request=0xbeef # anything invalid should do
   [...]
}
[...]

If you were referring to the script-level variables:

% stap -L syscall.ptrace
syscall.ptrace name:string request:long pid:long addr:long data:long
argstr:string $request:long int $pid:long int $addr:long int $data:long int

Then yes, modifying "name" or "request" won't do anything.  But the
underyling $context variables - yeah!


- FChE