Use LD_PRELOAD to intercept system calls from library which is statically linked?

Question

I have an application statically linked with a third party library. The third party library makes system calls (presumably via glibc).

I would like to intercept these system calls by writing a "wrapper" library and loading it first via LD_PRELOAD. However, I have read LD_PRELOAD does not work with static-linking.

Does this linkage requirement only apply to the "wrapper" library? It's okay to still have the third party library statically-linked with my application?

Answer 1

Use LD_PRELOAD to intercept system calls

It is not possible to use LD_PRELOAD to intercept system calls. With LD_PRELOAD you may override symbol resolved from an external library, for example a function. That's very separate and unrelated to system call.

If the code makes a system call without ever calling an external symbol, it's impossible to intercept it with LD_PRELOAD.

It is possible to override function resulting in system calls with LD_PRELOAD, however there is no clear relationship between them. For example, open() C function may result in open or openat system call, it can only be known in advance by analyzing the source code. Or, I think like pthread_create will result in several of system calls. Because there is no clear relationship and functions are unrelated to system calls, bottom line it is not possible to intercept system calls with LD_PRELOAD