Monitor sigprocmask calls with Syscall User Dispatch?
09:18 27 Nov 2025

I'm using prctl(PR_SET_SYSCALL_USER_DISPATCH, ...) to enable Syscall User Dispatch with a SIGSYS handler that gets called when the application issues any syscall. The prctl() call also marks the code region that includes the SIGSYS handler as excepted from syscall redirection.

The SIGSYS handler calls the syscall that was originally issued by the application, and stores the syscall result in the uc_mcontext.gregs array it received. This doesn't work for syscalls like rt_sigprocmask because when the SIGSYS handler returns, sa_restorer restores the application's signal mask from before the rt_sigprocmask syscall, reverting any changes made by the SIGSYS handler.

Is there a way to make the changes to the signal mask persist after the SIGSYS handler returns control to the application ?

Are rt_sigprocmask syscalls intended to be monitored differently ?

linux signals system-calls glibc