Does strace output the actual system calls name or the name of the wrapper functions that perform them?

Question

Just asking to confirm that the strace output is the name of system calls and not the name of wrapper functions that perform these actual system calls

Answer 1

Generally yes; strace works by using ptrace(2) to trace system-calls specifically, using PTRACE_SYSCALL to ask the kernel to stop at the next system call.

So strace only finds out what's going on in terms of the tracee actually entering the kernel, and it decodes based on the register values. (And on x86-64 with recent kernels and strace, whether user-space used the 64-bit syscall ABI or the 32-bit int 0x80 ABI, which have different call numbers and arg-passing registers but the 32-bit ABI is available in 64-bit code.)

Unlike ltrace, it doesn't read user-space library symbol-tables.

---

But strace might have special decoding for the 32-bit x86 socketcall system call which is one kernel function that wraps socket(2), bind(2), listen(2), etc. (See an answer on a related Q&A).

In that case it would maybe still print listen(...) instead of the socketcall(SYS_LISTEN, ...) raw system call that user-space actually made. But I haven't checked.

But asm/unistd_32.h on my system (Linux kernel 6.7) now has entries for __NR_listen and so on, so modern 32-bit builds of glibc might these days use those instead of socketcall. In that case the glibc wrapper name does correspond to the actual system call. Those call numbers are lower than __NR_membarrier which was added in Linux kernel version 4.3, so presumably soon before that.