OpenBSD Journal

pinning all system calls

Contributed by rueda on from the pincall-wizard dept.

Theo de Raadt (deraadt@) posted to tech@ regarding restrictions on the addresses from which system calls can be made.

In addition to providing background, the post contains information (and a patch) for an imminent change - the introduction of a new syscall, pinsyscalls(2) [link not working at the time of writing because change not yet committed], which specifies the addresses from which individual system calls are permitted.

pinsyscalls(2) will be called only from the shared library linker,

(Comments are closed)

  1. By Jorden Verwer ( on

    Actually, it's pinsyscall, not pinsyscalls. That's also why the link to the man page doesn't work.

    1. By brynet (Brynet) on

      No, pinsyscall(2) was the previous iteration that was for execve(2) only. The new system call is pinsyscalls(2), and is for all system calls. It has not been committed, hence no man page, but it in the mail sent by deraadt@.

      +.Sh NAME
      +.Nm pinsyscalls
      +.Nd pin system call entry to precise positions in the address space

    2. By Jorden Verwer ( on

      Ah yes, you are both right. I only read the running text of the email, not the patch. The patch mentions pinsyscalls, but the description only mentions pinsyscall. Obviously the patch is what really matters. Apologies for the confusion!


Copyright © - Daniel Hartmeier. All rights reserved. Articles and comments are copyright their respective authors, submission implies license to publish on this web site. Contents of the archive prior to as well as images and HTML templates were copied from the fabulous original with Jose's and Jim's kind permission. This journal runs as CGI with httpd(8) on OpenBSD, the source code is BSD licensed. undeadly \Un*dead"ly\, a. Not subject to death; immortal. [Obs.]