使用LD_PRELOAD重定向system（）函数调用

Question

I want to replace the calls to system() function made by my program using LD_PRELOAD.

So I created the following wrapper functions in a shared library for testing.

// syshook.c

int system(const char * command)
{
    printf("system() called for %s ************************************\n", command);
    return 55;
}

char * getenv (const char* name)
{
    printf("my getenv() *********************");
    return 0;
}

And compiled and linked to a shared object libsyshook.so with gcc.

gcc -Wall -fPIC -c *.c
gcc -shared -Wl,-soname,libsyshook.so -o libsyshook.so.1.0
ln -s libsyshook.so libsyshook.so.1.0

However, when I run the program with with LD_PRELOAD as shown below, my wrapper function for system() is not called, but the wrapper for getenv() called.

LD_PRELOAD="libsyshook.so" myprog

When I attach the debugger, I can see that system() call, calls the implementation in libpthread.so. So why is redirecting system() not working. I don't think there is any limitation on that ??

Edit: My test program compiled to myprog above looks like this. Comments indicate my observations.

void TestClass::testMethod()
{
    string cmdLine = "date";
    if (!mainWin) cmdLine = "time";

    int retFromSys = system(cmdLine.c_str());   // goes into libpthread when stepped in.
    cout << "return from system " << retFromSys << endl; // prints 0, not 55  
    getenv("DEBUG_SYS");  // Wrapper function called for this. Prints "my getenv ****** ..."

Answer 1

The most usual case of bad linking with LD_PRELOAD is when GCC replace your function by another one, when he think it can make your code faster to execute.

For instance, if GCC read this line in your code :

printf("%d", strlen("toto"));

It will replace with this line before compiling it :

puts("4");

Because it knows the printf and strlen functions, and think the output would be the same with puts function.

In this example, if you made your own printf or strlen function in a library loaded with LD_PRELOAD, your function won't be called after compilation, because GCC would have replaced function calls.

I think your problem is for the same reason. system is a very heavy function, and GCC may replaced your function call by another. For instance, if you tried :

system("ls");

GCC might replaced your line by :

execlp("ls", "ls");

That would do the same, but in less heavy. It couldn't know that you wanted to use your own system function. Try to disassemble your code to check if this is the problem.

As solution, I suggest you to try to call system with a more "random" parameter, to make GCC think it should not try to replace it. Maybe something like :

int main(int argc, char** argv)
{
    char* line = NULL;

    // Useless condition to make GCC think the parameter is variable
    if (argc == 1)
        line = "ls";

    return (system(line));
}