The Filtering Module

This module (sct_rules.o) accepts user-control messages via sysctl, to add rules to a given syscall, delete a rule, print the rules into the system's log file, etc.

When a system call is invoked, a stub function for this syscall is executed. This function matches the call against all rules for this syscall, and if a match is found, an action is performed.