title: Is there a way to modify Linux syscall table in a proprietary kernel module?
body: <p>I wrote an kind of SELinux clone that supervises system call execution such as open and execve.</p>
  
  <p>The result is proven by SELinux as a secure way to monitor all disk access made by users.</p>
  
  <p>The code modifies the syscall table in the following way:</p>
  
  <blockquote>
    <ol>
    <li>Change the name->address relationship of a syscall</li>
    <li>After the change, the syscall name is my own function, which then calls the original syscall.</li>
    <li>the original syscall address is protected by address space layout randomization which requires scanning 16 exabytes of data, and the
    address changes with every reboot.</li>
    </ol>
  </blockquote>
  
  <p>Old trick, but the only way I found to achieve this is via a service routine exported only to GPL modules with the following code:</p>
  
  <pre><code>MODULE_LICENSE("GPL");
  </code></pre>
  
  <p>Is there a way to discover either the syscall table or the syscall address without a GPL kernel module?</p>