4 ms·
LD_PRELOAD and hooking the libc syscall wrappers doesn't seem very reliable. It won't work on static binaries, it depends on the user not clearing the environm
by rnhmjoj 4y ago
LD_PRELOAD and hooking the libc syscall wrappers doesn't seem very reliable.
It won't work on static binaries, it depends on the user not clearing the environment and there are also many programs that use the syscall directly, bypassing the hooks. From playing with file system hooks I remember programs written in Go and sqlite used to do this.
- willbudd 4y agoOnly a very small percentage of Linux binaries in the wild is fully static though (e.g., those that are compiled with musl). This is "thanks" to Glibc, which makes doing so nigh impossible. I also highly doubt "many" programs make syscalls directly, but I could be wrong. I know I haven't done so since the days I dabbled in assembly, at least.
- chc4 4y agoAnything in Go will.