5 ms·
Why not just write a FUSE module?
by DrCatbox 15y ago
Why not just write a FUSE module?
- KonradKlause 15y ago1. A kernel module is more 1337 ;) 2. Using FUSE you would have to guaranty that your fs overlaps all other mounted filesystems.
- marbu 15y agoMaybe because the author prefers to play with kernel. Other option is create a wrapper library and enforce it's usage with LD_PRELOAD.
- KonradKlause 15y agoUsing LD_PRELOAD you cannot hook a syscall like open().
- mhansen 15y agoHow does strace hook it?
- waitwhat 15y agoDoesn't pretty much everything call into libc to open() things rather than invoke the syscall directly?
- KonradKlause 15y agoWith LD_PRELOAD you can hook any _function_ call. A syscall is something different. It depends how the syscall wrapper within the libc is coded. Some can be hooked...
- waitwhat 15y agoBut open(3) is a function call, so it can be hooked.
- KonradKlause 15y agoIt's open(2). Yes, here on my x86_64 it can be hooked. But I've seen lots of setups where this was not doable. As I said it depends how the libc's wrapper is written.
- waitwhat 15y agoOn Linux, there's typically both an open(3) and an open(2). The former is implemented by glibc and calls the latter which is implemented by the kernel. So an app calls the open() function. This results in an unresolved symbol which the run-time linker matches up with the open() exported by glibc. glibc then does the open() syscall.
- KonradKlause 15y agoopen(2) is the wrapper within the libc. There is no open(3) on Linux.
- waitwhat 15y agoSection 2 of the unix manual is for syscalls. Section 3 is for C library functions. http://en.wikipedia.org/wiki/Man_page#Manual_sections http://en.wikipedia.org/wiki/Man_page#Manual_sections If libc implements it, then it is by definition in section 3. EDIT: (signing out of this sub-thread)
- exDM69 15y agoNo. Assembly code invokes kernel syscalls by invoking an interrupt or using a syscall opcode. No libc or function calls involved, so LD_PRELOAD can't hook in. You might even have several libc's in your system. You might have a uClibc + Busybox based initrd and a full glibc based root system. Btw. how does LD_PRELOAD act together static binaries?
- waitwhat 15y agoI know apps can invoke kernel syscalls directly, and I'm sure you could name a handful of apps that do this all time. But are you really doing that in your mp3 player?
- marbu 15y agoSince static binaries don't use shared libraries, LD_PRELOAD has no effect - it is the same as with assembly code you mentioned.
- burke 15y agoI'm kind of suspecting this started off as "I want to make a simple kernel module", not "I wonder how I can make my computer rickroll me more often".