So we said we want the kernel to avoid writting the RET execve in the
trace. It seems it should be done in kern_ktrace.c:ktrsysret(), testing
on the code parameter.

But how can we know what is execve's code? seeking sys_execve address in
sysent[] seems a very bad idea to me: it's not emulation friendly, and
it's time consuming to do it each time. Is there any other way?

-- 
Emmanuel Dreyfus.  
Avec Windows 3.1 ils etaient au bord du gouffre...
Avec Windows 95 ils ont fait un grand bon en avant.
p99dreyf@criens.u-psud.fr