Is this is a good way to intercept system calls?

Question

I am writing a tool. A part of that tool will be its ability to log the parameters of the system calls. Alright I can use ptrace for that purpose, but ptrace is pretty slow. A faster method that came to my mind was to modify the glibc. But this is getting difficult, as gcc magically inserts its own built in functions as system call wrappers than using the code defined in glibc. Using -fno-builtin is also not helping there.

So I came up with this idea of writing a shared library, which includes every system call wrapper, such as mmap and then perform the logging before calling the actual system call wrapper function. For example pseudo code of what my mmap would look like is given below.

int mmap(...)
{
 log_parameters(...);
 call_original_mmap(...);
 ...
}

Then I can use LD_PRELOAD to load this library firstup. Do you think this idea will work, or am I missing something?

Answer 1

No method that you can possibly dream up in user-space will work seamlessly with any application. Fortunately for you, there is already support for doing exactly what you want to do in the kernel. Kprobes and Kretprobes allow you to examine the state of the machine just preceeding and following a system call.

Documentation here: https://www.kernel.org/doc/Documentation/kprobes.txt