|
From: Muli Ben-Y. <mu...@mu...> - 2004-04-15 06:09:28
|
On Tue, Apr 13, 2004 at 04:17:21PM +0400, Sergey V. Burchu wrote: > Hello where! >=20 > I have some troubles using syscalltrack: > 1) using rules file (in attachment) I have "syscall 4 busy" message. > I think it becouse of atfer rule "write_a". Probably.=20 > 2) using the same rule as above I have trouble unloading modules: > sct_hijack: Device or resource busy > # lsmod=20 > Module Size Used by Not tainted > sct_hijack 139296 1 That's a feature, not a bug :-)=20 If the ssycall is busy, the hijack module cannot be safely removed.=20 > That all. You can wait until the syscall becomes unbusy (the specific invocation that was in it at the time of the unload has returned) and then try to remove the module again.=20 Cheers,=20 Muli=20 --=20 Muli Ben-Yehuda http://www.mulix.org | http://mulix.livejournal.com/ |