Re: Hooking execve for an LD_PRELOAD library

[Florian Weimer <fweimer@redhat.com>]

* Andreas Fink via Libc-help:

> Now I would like the same for execvp to happen. Reading the man page of
> execvp it is mentioned that exec-family functions are just
> frontends to execve, so I replaced in my executable source code the
> explicit call to execve with a call to execvp. I expected that this
> would just work, as execvp would in turn call execve and this would be
> caught by the hook, then logged and forwarded to the real
> implementation. But to my surprise no such thing happened. execvp would
> run successfully, but my hook would never be called.
> Why is the hook not called, what did I miss?

Most internal function calls are implemented as direct function call,
and it is not possible to use symbol interposition to redirect them.
An exception is the malloc family of functions:

  Replacing malloc
  <http://www.gnu.org/software/libc/manual/html_node/Replacing-malloc.html>

If you want to modify the behavior of execve, you should consider a
kernel-based mechanism.  This will likely make it easier to achieve
correct behavior after vfork, too.

Thanks,
Florian
-- 
Red Hat GmbH, https://de.redhat.com/ , Registered seat: Grasbrunn,
Commercial register: Amtsgericht Muenchen, HRB 153243,
Managing Directors: Charles Cachera, Brian Klemm, Laurie Krebs, Michael O'Neill