Intercepting stat()

Question

I have successfuly intercepted calls to read(),write(),open(),unlink(),rename(), creat() but somehow with exactly the same semantics intercepting stat() is not taking place. I have changed the execution environmnet using LD_PRELOAD.

Am I missing something?

The code is quite huge, which part of it will be most helpful to post so you can help?

Thanks.

Edit: I kept the interposed stat() wrapper simple to check if it works.

int stat(const char *path,struct stat *buff)
{
    printf("client invoke: stat %s",path);
    return 1;
}

Answer 1

Compile a function that calls stat(); see what reference(s) are generated (nm -g stat.o). Then you'll have a better idea of which function(s) to interpose. Hint: it probably isn't called stat().

Answer 2

If you are compiling with 64 bit file offsets, then stat() is either a macro or a redirected function declaration that resolves to stat64(), so you will have to interpose on that function too.

Answer 3

Well it was not very simple when running in linux. Gnu libc does some tricks. You need to intercept the __xstat and if you want to call the original save the call.

Here is how I got it to work

gcc -fPIC -shared -o stat.so stat.c -ldl


#define _GNU_SOURCE

#include <stdio.h>
#include <dlfcn.h>
#include <string.h>
#include <sys/types.h>
#include <sys/stat.h>
#include <unistd.h>

static int (*old_xstat)(int ver, const char *path, struct stat *buf) = NULL;
static int (*old_xstat64)(int ver, const char *path, struct stat64 *buf) = NULL;

int __xstat(int ver, const char *path, struct stat *buf)
{
  if ( old_xstat == NULL ) {
    old_xstat = dlsym(RTLD_NEXT, "__xstat");
  }

  printf("xstat %s\n",path);
  return old_xstat(ver,path, buf);
} 

int __xstat64(int ver, const char *path, struct stat64 *buf)
{
  if ( old_xstat64 == NULL ) {
    old_xstat64 = dlsym(RTLD_NEXT, "__xstat64");
  }

  printf("xstat64 %s\n",path);
  return old_xstat64(ver,path, buf);
}