Hooking sycalls from userspace on Linux

Question

Is there any way to catch all syscalls on Linux? The only solution I know of is using LD_PRELOAD à la fakeroot, but that only works for dynamically linked applications. Furthermore, this approach requires enumerating all syscalls which is something I'd like to avoid.

Answer 1

I think you are looking for ptrace(2).

Answer 2

You can trace a program. Think about how strace works. Hint: it doesn't use LD_PRELOAD tricks.