Intercepting the openat () system call for GNU tar

Question

I am trying to intercept the openat() system call on Linux using a special shared library that I can load through LD_PRELOAD . The intercept-openat.c has this content:

 #define _GNU_SOURCE #include <sys/types.h> #include <sys/stat.h> #include <unistd.h> #include <stdio.h> #include <dlfcn.h> int (*_original_openat)(int dirfd, const char *pathname, int flags, mode_t mode); void init(void) __attribute__((constructor)); int openat(int dirfd, const char *pathname, int flags, mode_t mode); void init(void) { _original_openat = (int (*)(int, const char *, int, mode_t)) dlsym(RTLD_NEXT, "openat"); } int openat(int dirfd, const char *pathname, int flags, mode_t mode) { fprintf(stderr, "intercepting openat()...\n"); return _original_openat(dirfd, pathname, flags, mode); } 

I will compile it through gcc -fPIC -Wall -shared -o intercept-openat.so intercept-openat.c -ldl . Then, when I run this small sample program:

 int main(int argc, char *argv[]) { int fd; fd = openat(AT_FDCWD, "/home/feh/.vimrc", O_RDONLY); if(fd == -1) return -1; close(fd); return 0; } 

The openat() call is rewritten through the library:

 $ LD_PRELOAD=./intercept-openat.so ./openat intercepting openat()... 

However, the same does not happen with GNU tar, although it uses the same system call:

 $ strace -e openat tar cf /tmp/t.tgz .vimrc openat(AT_FDCWD, ".vimrc", O_RDONLY|O_NOCTTY|O_NONBLOCK|O_NOFOLLOW|O_CLOEXEC) = 4 $ LD_PRELOAD=./intercept-openat.so tar cf /tmp/t.tgz .vimrc 

This way the custom openat() from intercept-openat.so not called. Why is this?

Answer 1

It uses the same system call, but apparently it doesn’t call it through the same C function. Alternatively, it may be so, but it is statically connected.

In any case, I think you have proven that it never dynamically binds the names of openat functions. If you still want to use this option, you might like it if it is associated with a specific version of this function, but this is a long shot.

You can still intercept the system call by writing your program to use ptrace . This is the same interface used by strace and gdb. However, it will have better performance.

http://linux.die.net/man/2/ptrace