set_thread_area¶

Intro¶

set_thread_area - Sets the area in which a thread's registers are saved

Description¶

The set_thread_area() system call sets the thread-local storage (TLS) area for the calling thread via the ldt_entry structure passed in the u_info argument. The TLS area stores the segment registers (fs and gs). This area is found on the user stack of the thread and is initialized after a thread is created. The size of the area is implementation-defined, but at least 28 bytes of space must be provided.

Using this system call, the user can specify which segment descriptor should be used for fs/gs. This is mostly useful for thread libraries.

Arguments¶

u_info:struct user_desc*[KU] - Pointer to a user_desc structure which contains the information about the TLS area that the system call should set.

Available Tags¶

K - Originated from kernel-space.
U - Originated from user space (for example, pointer to user space memory used to get it)
TOCTOU - Vulnerable to TOCTOU (time of check, time of use)
OPT - Optional argument - might not always be available (passed with null value)

Hooks¶

do_set_thread_area¶

Type¶

Kprobe + Kretprobe

Purpose¶

To track when the set_thread_area syscall is called and to inspect the arguments.

Example Use Case¶

The set_thread_area syscall can be used when implementing thread-local storage (TLS) for a thread library and setting the memory area for storing the segment registers.

Issues¶

None.

set_tid_address, get_thread_area, clone, rt_sigaction

This document was automatically generated by OpenAI and needs review. It might not be accurate and might contain errors. The authors of Tracee recommend that the user reads the "events.go" source file to understand the events and their arguments better.