Question about = ld.so.preload vs strace

ekstrah · 01-16-2019, 08:16 AM

Background
I have been working on ld.so.preload to capture open and fopen. Following code is my own c code that is compiled to .so

Code:

#define _GNU_SOURCE
#include <stdio.h>
#include <stdlib.h>
#include <dlfcn.h>
#include <limits.h>
#include <errno.h>
#include <sys/stat.h>
#include <fcntl.h>
#include <string.h>
#include <stdarg.h>
#include <sys/syscall.h>
#include <unistd.h>

//this will be used for logging to a file
static void log_it(const char *fmt, ...) {
    int test_val = 0;
    static int initialized;
    static int logfd = -1;
    va_list ap;
    static int (*open_orig)(const char *, int, mode_t);
    if (access("/usr/filelog.txt", F_OK) != -1) {
        if (logfd == -1 && !initialized) {
	    open_orig = dlsym(RTLD_NEXT, "open");
	    initialized = 1;
	    if(test_val == 1) {
		logfd = open_orig("./filelog.txt", O_WRONLY|O_APPEND|O_CREAT, 0666);
	    } else {
		logfd = open_orig("/usr/filelog.txt", O_WRONLY|O_APPEND|O_CREAT, 0666);
	    }
	}
	if (logfd != -1) {
	    va_start(ap, fmt);
	    vdprintf(logfd, fmt, ap);
	    va_end(ap);
	}
    }
}


static const char *redirect_name(const char *name) {
    return name;
}


int open(const char *pathname, int flags, ...){
    static int (*open_orig)(const char *, int, mode_t);
    int ret;
    va_list ap;
    mode_t mode;
    extern char *program_invocation_name;
    extern char *program_invocation_short_name;

    if (!open_orig) {
        open_orig = dlsym(RTLD_NEXT, "open");
    }

    va_start(ap, flags);
    mode = va_arg(ap, mode_t);
    va_end(ap);
    ret = open_orig(redirect_name(pathname), flags, mode);

    log_it("%s is being opened by %s\n", pathname, program_invocation_short_name);

    return ret;
}


FILE *fopen(const char *pathname, const char *mode) {
    extern char *program_invocation_name;
    FILE *(*original_fopen)(const char*, const char*);
    original_fopen = dlsym(RTLD_NEXT, "fopen");

    log_it("%s is being fopened by %s\n", pathname, program_invocation_name);
    return (*original_fopen)(pathname, mode);
}

Furthermore I moved this compiled .so file into /lib64/ and created ld.so.preload inside of /etc/ folder
However, When I run following command

Code:

$openstack server create --flavor m1.tiny --image cirros-0.3.6-x86_64-disk --nic net-id=9453c04e-d739-403e-b5e5-06fed3f4e7e2 --security-group default vm

and looks at the /usr/filelog.txt (since my custom ld.so.preload will capture open and fopen call and save process name inside of the filelog.txt.
I wanted to to be sure so I also ran following line to verify that my ld.so.preload actually loads up and captures all the open and fopen calls

Code:

$strace -f -o ./log.txt openstack server create --flavor m1.tiny --image cirros-0.3.6-x86_64-disk --nic net-id=9453c04e-d739-403e-b5e5-06fed3f4e7e2 --security-group default vm

I also did following command to extract only the open system call from strace output ./log.txt

Code:

$cat ./log.txt | grep "open" >> ./log_open.txt

I compared ./log_open.txt and filelog.txt (created by ld.so.preload) seems like ld.so.preload doesn't actually captures open and fopen calls. It is missing out a lot of the calls.

Question

So the question is that why ld.so.preload can't capture some of the open call but strace can?