From: Adhemerval Zanella Netto <adhemerval.zanella@linaro.org>
To: Adhemerval Zanella via Libc-help <libc-help@sourceware.org>
Subject: Re: What are the option for overriding system calls GNU libc calls?
Date: Mon, 26 Sep 2022 08:57:59 -0300 [thread overview]
Message-ID: <86291bcc-22cb-5d6b-9056-3bea450e6dec@linaro.org> (raw)
In-Reply-To: <CAB4+JYKdVW2WxzA=Pij_C1xbOHdxh4qj6=nnueNdJcHcAUZ+KA@mail.gmail.com>
On 22/09/22 09:31, Godmar Back via Libc-help wrote:
> Hi,
>
> I have a question. Say I wanted to override the `write()` system call in an
> application so that when I compile and link it, my version of `write()` is
> called by both the application program as well as by GNU libc, for
> instance, from puts or printf. To what extent is this supported?
>
> I'm aware of the following options:
> - (a) link statically. In this case, if I provide a strong definition of
> `write()`, the application will pick it up. GNU libc, otoh, uses
> `__write()` Overriding `__write` with a strong definition works and gets
> libc to call my __write.
>
> - (b) link dynamically and use `LD_PRELOAD`. In this case, I can get the
> application to call my `write`, but libc will continue to call `__write`; I
> believe; I haven't tried if I can provide a __write and have libc pick up
> on it since (I thought) that libc resolves these symbols internally or from
> a dynamic library on its link chain.
Unfortunately this is done intentionally and although the usual double underscore
is used on mot symbol, some also uses different internal nomenclature (for
instance __libc_sigaction). For internal libc usage, we explicit avoid PLT usage
so you will need to either use a dynamic runtime tool to rewrite the text segment
(DynamicRIO, etc.), a probe tools (uprobes, systemtap, etc. which might not fit
the model you are aiming since it might not run in the process namespace), or
recompile glibc to remove the hidden_def definition on the symbol (so PLT are
generated for internal calls and LD_PRELOAD can override it).
>
> In any event, my question is: is there a sanctioned or semi-sanctioned way
> to override system calls for both the static and dynamic linking process?
>
> - Godmar
prev parent reply other threads:[~2022-09-26 11:58 UTC|newest]
Thread overview: 2+ messages / expand[flat|nested] mbox.gz Atom feed top
2022-09-22 12:31 Godmar Back
2022-09-26 11:57 ` Adhemerval Zanella Netto [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=86291bcc-22cb-5d6b-9056-3bea450e6dec@linaro.org \
--to=adhemerval.zanella@linaro.org \
--cc=libc-help@sourceware.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).