how could I intercept linux sys calls?

by

Why can’t you / don’t want to use the LD_PRELOAD trick?

Example code here:

/*
 * File: soft_atimes.c
 * Author: D.J. Capelis
 *
 * Compile:
 * gcc -fPIC -c -o soft_atimes.o soft_atimes.c
 * gcc -shared -o soft_atimes.so soft_atimes.o -ldl
 *
 * Use:
 * LD_PRELOAD="./soft_atimes.so" command
 *
 * Copyright 2007 Regents of the University of California
 */

#define _GNU_SOURCE
#include <dlfcn.h>
#define _FCNTL_H
#include <sys/types.h>
#include <bits/fcntl.h>
#include <stddef.h>

extern int errorno;

int __thread (*_open)(const char * pathname, int flags, ...) = NULL;
int __thread (*_open64)(const char * pathname, int flags, ...) = NULL;

int open(const char * pathname, int flags, mode_t mode)
{
    if (NULL == _open) {
        _open = (int (*)(const char * pathname, int flags, ...)) dlsym(RTLD_NEXT, "open");
    }
    if(flags & O_CREAT)
        return _open(pathname, flags | O_NOATIME, mode);
    else
        return _open(pathname, flags | O_NOATIME, 0);
}

int open64(const char * pathname, int flags, mode_t mode)
{
    if (NULL == _open64) {
        _open64 = (int (*)(const char * pathname, int flags, ...)) dlsym(RTLD_NEXT, "open64");
    }
    if(flags & O_CREAT)
        return _open64(pathname, flags | O_NOATIME, mode);
    else
        return _open64(pathname, flags | O_NOATIME, 0);
}

From what I understand… it is pretty much the LD_PRELOAD trick or a kernel module. There’s not a whole lot of middle ground unless you want to run it under an emulator which can trap out to your function or do code re-writing on the actual binary to trap out to your function.

Assuming you can’t modify the program and can’t (or don’t want to) modify the kernel, the LD_PRELOAD approach is the best one, assuming your application is fairly standard and isn’t actually one that’s maliciously trying to get past your interception. (In which case you will need one of the other techniques.)

More Related Contents:

  1. How to write a signal handler to catch SIGSEGV?
  2. Is malloc/free a syscall or a library routine provided by libc?
  3. How do I get a thread ID from an arbitrary pthread_t?
  4. How does a pipe work in Linux?
  5. How do I reimplement (or wrap) a syscall function on Linux?
  6. Is there a better way than parsing /proc/self/maps to figure out memory protection?
  7. getrandom syscall in C not found
  8. How to know if a Linux system call is restartable or not?
  9. Linux system call table or cheatsheet for Assembly [closed]
  10. Where can I find system call source code?
  11. How do I make this Linux program compile? [closed]
  12. Given an executable file, display its complete path [closed]
  13. Undefined reference to pthread_create in Linux
  14. Where is the header file on Linux? Why can’t I find ? [duplicate]
  15. What is the behavior of printing NULL with printf’s %s specifier?
  16. What does malloc(0) return? [duplicate]
  17. Convert a Static Library to a Shared Library?
  18. How to get the current time in milliseconds from C in Linux?
  19. When to use pthread_exit() and when to use pthread_join() in Linux?
  20. Execute program from within a C program
  21. Beep on Linux in C
  22. Why does forking my process cause the file to be read infinitely
  23. What does a dot before the variable name in struct mean?
  24. How to do an atomic increment and fetch in C?
  25. Is this possible to customize printf?
  26. Creating your own syntax highlighting in GEdit?
  27. /proc/[pid]/pagemaps and /proc/[pid]/maps | linux
  28. Sharing same variable between more than one independent programs in Linux [closed]
  29. argv: Sanitizing wildcards
  30. WaitForSingleObject and WaitForMultipleObjects equivalent in Linux?

Leave a Comment