LD_PRELOAD for open() hooking only works on proc fs

Programming
, ,
1

I am trying to map all the files created and opened by my program. To do this, I have implemented my own open() function, which writes the filepath parameter to an output file and then calls the original open() function.

Using LD_PRELOAD, I am successfully hooking the proc file system open() call, but not the direct open() call in my code.

For example, this code is successfully hooked by LD_PRELOAD:

system("echo text > /user/prog");

However, this code, which is located right next to it, is not hooked:

open("/user/prog", O_RDWR, O_CREAT);

What could be the reason for this?

2

The reason for this is because system() uses the exec() system call, which ultimately calls open() from the proc file system. Therefore, LD_PRELOAD hooks the open() call from the proc file system and thus intercepts the call made by system(). However, the open() call in the second code snippet is a direct call to the open() function in your code and is not intercepted by LD_PRELOAD. To hook this call, you need to use a different method, such as function pointers or dynamic linking.