Explanation: fork system call interception

Asked Jul 07 '16 at 08:38

Active Jul 07 '16 at 08:38

Viewed 133 times

I am not able to understand the working of the following code that basically intercept the fork system call

pid_t fork(void)
{
    pid_t result;
    if (!actual_fork) {
        const int saved_errno = errno;

        *(void **)&actual_fork = dlsym(RTLD_NEXT, "fork");
        if (!actual_fork) {
            errno = EAGAIN;
            return (pid_t)-1;
        }

        errno = saved_errno;
    }

    result = (*actual_fork)();
    if (!result && commfd != -1) {
        struct message msg;
        notify(TYPE_FORK, &msg, sizeof msg);
    }

    printf("\n%d",result);
    fflush(stdout);
    return result;
}

when exporting the following intercepted code with LD_PRELOAD, then any process that calls for nested fork throws Segmentation fault

asked Jul 07 '16 at 08:38

Rohit Sehgal

2

It's unclear what you're asking - are you referring to the `Segmentation fault` or how the hijack is done? – Ishay Peled Jul 07 '16 at 08:43
2

Is `actual_fork` correctly initialized? – Mathieu Jul 07 '16 at 09:42
Why can `actual_fork` not be assigned without the cast ? It seems like now it would have to be a pointer to a NULL pointer, so the guard would not be `!actual_fork`, but `!*actual_fork` – marcolz Jul 07 '16 at 09:45
1

I think the main problem is that `&actual_fork` in your `dlsym` line should be `(&actual_fork)` – tofro Jul 07 '16 at 09:51
@IshayPeled i am not able to understand the working of the code ... which implies the reason for seg fault. – Rohit Sehgal Jul 07 '16 at 10:08
How is actual_fork defined? You should just use: `pid_t (*actual_fork)(); actual_fork = dlsym(...); actual_fork();` – Ctx Jul 07 '16 at 11:17
Is your code the same as http://stackoverflow.com/a/17366235/2554472 or did you change anything? – Mark Plotnick Jul 07 '16 at 21:48
The code entirely is not the same ... I have used its fork method only – Rohit Sehgal Jul 07 '16 at 21:52
@ctx both the definitions are same .. – Rohit Sehgal Jul 07 '16 at 21:53

Explanation: fork system call interception

0 Answers0