.\"	$OpenBSD: systrace.9,v 1.6 2007/05/31 19:20:01 jmc Exp $
.\"
.\" Copyright (c) 2003 Michael Shalayeff
.\"
.\" Redistribution and use in source and binary forms, with or without
.\" modification, are permitted provided that the following conditions
.\" are met:
.\" 1. Redistributions of source code must retain the above copyright
.\"    notice, this list of conditions and the following disclaimer.
.\" 2. Redistributions in binary form must reproduce the above copyright
.\"    notice, this list of conditions and the following disclaimer in the
.\"    documentation and/or other materials provided with the distribution.
.\"
.\" THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
.\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
.\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
.\" ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
.\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
.\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
.\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
.\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
.\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
.\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
.\" SUCH DAMAGE.
.\"
.Dd $Mdocdate: May 31 2007 $
.Dt SYSTRACE 9
.Os
.Sh NAME
.Nm systrace_redirect ,
.Nm systrace_fork ,
.Nm systrace_exit
.Nd "enforce policies for system calls"
.Sh SYNOPSIS
.Fd #include <dev/systrace.h>
.Ft int
.Fn systrace_redirect "int code" "struct proc *p" "void *args" "register_t *retval"
.Ft void
.Fn systrace_fork "struct proc *oldproc" "struct proc *p"
.Ft void
.Fn systrace_exit "struct proc *p"
.Sh DESCRIPTION
These functions are used to enforce policy on the system calls as described in
.Xr systrace 1 .
.Pp
.Fn systrace_redirect
should be used to perform a system call number
.Fa code
with arguments
.Fa args
for the process
.Fa p .
The result is then put into the
.Fa retval
pointer.
A typical code sequence would be:
.Bd -literal -offset indent
#include "systrace.h"

\&...

#if NSYSTRACE > 0
	if (ISSET(p->p_flag, P_SYSTRACE))
		error = systrace_redirect(code, p, args, rval);
	else
#endif
		error = (*callp->sy_call)(p, args, rval);
.Ed
.Pp
.Fn systrace_fork
is called from the
.Xr fork1 9
function to inherit policy for the child process.
.Pp
.Fn systrace_exit
is called during the death cycle of the process to
detach the policy from the exiting process.
.Sh CODE REFERENCES
A subsystem for enforcing system call policies is implemented in
.Pa sys/dev/systrace.c .
.Sh SEE ALSO
.Xr systrace 1 ,
.Xr systrace 4 ,
.Xr syscall 9
.Sh HISTORY
The
.Nm
section manual page appeared in
.Ox 3.4 .