Interposing library calls
Interposing library calls
- Subject: Interposing library calls
- From: "Jernej Azarija" <email@hidden>
- Date: Fri, 25 Jul 2008 14:17:25 +0200
Hello,
this is a continuation of the previous thread located in darwin-kernel
at : http://lists.apple.com/archives/Darwin-kernel/2008/Jul/msg00015.html
.
I assume my question is more on topic here.
The conclusion reached in the above mentioned thread is that it's
preferred to interpose library calls (in this case open/close) from a
library loaded at runtime. I've therefore created a small example
trying to intercept open, resolve the given path (using realpath()),
print the resolved path and pass the work to open().
The code didn't always work (mostly, it ran out of file descriptors
and/or segfaulted if some "complex" command was executed).
Investigating the issue, I've noticed that the wrapped open function
is recursively trying to open "." and segfaults (presumably after
running out of stack).
After some more investigation, I've noticed that getcwd() is the
"showstopper". Here is a minimal example reassembling the issue :
====
/* gcc -Wall -Wextra -dynamiclib -o lib.dlyb lib.c*/
#include <fcntl.h>
#include <sys/param.h>
#include <stdio.h>
#include <string.h>
#include <errno.h>
#include <unistd.h>
struct interpose {
void *old;
void *new;
};
int our_open(const char *path, int flags, mode_t mode);
static const struct interpose func[] __attribute__((section("__DATA,
__interpose"))) = {
{ (void *) our_open, (void *) open}
};
int our_open(const char *path, int flags, mode_t mode) {
char res_path[PATH_MAX];
fprintf(stderr, "Trying to open `%s'\n", path);
if (getcwd(res_path,sizeof(res_path)) == NULL) {
fprintf(stderr, "getcwd() failed. (%s)\n", strerror(errno));
}
return open(path,flags,mode);
}
====
And here the output :
$ export DYLD_INSERT_LIBRARIES=lib.dlyb
... thousand of messages ....
Trying to open `.'
Trying to open `.'
Segmentation fault
I'm clueless about what is causing this issue. As far as I've checked
libc' implementation, getcwd() is not using open() (at last not
directly). I'd be glad to hear a hint on how to overcome this issue.
Ps. I'm aware that this method is not officially "supported" by Apple,
neither is any kernel "hacking" of this type. All this makes me
wonder, how is someone able to deploy applications if it can't use
internal information - in my opinion, forcing people not to mess with
this stuff is just encouraging bad design of applications.
Thanks,
Jernej Azarija.
_______________________________________________
Do not post admin requests to the list. They will be ignored.
Darwin-dev mailing list (email@hidden)
Help/Unsubscribe/Update your Subscription:
This email sent to email@hidden