LinuxQuestions.org
Welcome to the most active Linux Forum on the web.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Newbie
User Name
Password
Linux - Newbie This Linux forum is for members that are new to Linux.
Just starting out and have a question? If it is not in the man pages or the how-to's this is the place!

Notices


Reply
  Search this Thread
Old 01-16-2019, 08:16 AM   #1
ekstrah
LQ Newbie
 
Registered: Nov 2018
Posts: 6

Rep: Reputation: Disabled
Question Question about = ld.so.preload vs strace


Background
I have been working on ld.so.preload to capture open and fopen. Following code is my own c code that is compiled to .so
Code:
#define _GNU_SOURCE
#include <stdio.h>
#include <stdlib.h>
#include <dlfcn.h>
#include <limits.h>
#include <errno.h>
#include <sys/stat.h>
#include <fcntl.h>
#include <string.h>
#include <stdarg.h>
#include <sys/syscall.h>
#include <unistd.h>

//this will be used for logging to a file
static void log_it(const char *fmt, ...) {
    int test_val = 0;
    static int initialized;
    static int logfd = -1;
    va_list ap;
    static int (*open_orig)(const char *, int, mode_t);
    if (access("/usr/filelog.txt", F_OK) != -1) {
        if (logfd == -1 && !initialized) {
	    open_orig = dlsym(RTLD_NEXT, "open");
	    initialized = 1;
	    if(test_val == 1) {
		logfd = open_orig("./filelog.txt", O_WRONLY|O_APPEND|O_CREAT, 0666);
	    } else {
		logfd = open_orig("/usr/filelog.txt", O_WRONLY|O_APPEND|O_CREAT, 0666);
	    }
	}
	if (logfd != -1) {
	    va_start(ap, fmt);
	    vdprintf(logfd, fmt, ap);
	    va_end(ap);
	}
    }
}


static const char *redirect_name(const char *name) {
    return name;
}


int open(const char *pathname, int flags, ...){
    static int (*open_orig)(const char *, int, mode_t);
    int ret;
    va_list ap;
    mode_t mode;
    extern char *program_invocation_name;
    extern char *program_invocation_short_name;

    if (!open_orig) {
        open_orig = dlsym(RTLD_NEXT, "open");
    }

    va_start(ap, flags);
    mode = va_arg(ap, mode_t);
    va_end(ap);
    ret = open_orig(redirect_name(pathname), flags, mode);

    log_it("%s is being opened by %s\n", pathname, program_invocation_short_name);

    return ret;
}


FILE *fopen(const char *pathname, const char *mode) {
    extern char *program_invocation_name;
    FILE *(*original_fopen)(const char*, const char*);
    original_fopen = dlsym(RTLD_NEXT, "fopen");

    log_it("%s is being fopened by %s\n", pathname, program_invocation_name);
    return (*original_fopen)(pathname, mode);
}
Furthermore I moved this compiled .so file into /lib64/ and created ld.so.preload inside of /etc/ folder
However, When I run following command


Code:
$openstack server create --flavor m1.tiny --image cirros-0.3.6-x86_64-disk --nic net-id=9453c04e-d739-403e-b5e5-06fed3f4e7e2 --security-group default vm
and looks at the /usr/filelog.txt (since my custom ld.so.preload will capture open and fopen call and save process name inside of the filelog.txt.
I wanted to to be sure so I also ran following line to verify that my ld.so.preload actually loads up and captures all the open and fopen calls


Code:
$strace -f -o ./log.txt openstack server create --flavor m1.tiny --image cirros-0.3.6-x86_64-disk --nic net-id=9453c04e-d739-403e-b5e5-06fed3f4e7e2 --security-group default vm
I also did following command to extract only the open system call from strace output ./log.txt

Code:
$cat ./log.txt | grep "open" >> ./log_open.txt
I compared ./log_open.txt and filelog.txt (created by ld.so.preload) seems like ld.so.preload doesn't actually captures open and fopen calls. It is missing out a lot of the calls.


Question

So the question is that why ld.so.preload can't capture some of the open call but strace can?
 
  


Reply

Tags
ld.so.preload, strace


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
[SOLVED] strace question poll taking a long time on an open command ALB Linux - Server 4 04-23-2012 07:06 PM
strace question ronopolis Linux - Software 0 01-19-2005 10:41 AM
Squid: how to preload cached objects & can restrict size of logs? dravya Linux - General 0 06-04-2004 09:23 AM
Library problem..ld.so.preload not found bruce1271 Linux - Software 1 09-25-2003 03:46 PM
JavaScript PreLoad Image andrewt Programming 1 08-25-2003 03:12 AM

LinuxQuestions.org > Forums > Linux Forums > Linux - Newbie

All times are GMT -5. The time now is 03:36 AM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration