title: Is this is a good way to intercept system calls?
body: <p>I am writing a tool. A part of that tool will be its ability to log the parameters of the system calls. Alright I can use <code>ptrace</code> for that purpose, but <code>ptrace</code> is pretty slow. A faster method that came to my mind was to modify the glibc. But this is getting difficult, as gcc magically inserts its own built in functions as system call wrappers than using the code defined in glibc. Using <code>-fno-builtin</code> is also not helping there.</p>
  
  <p>So I came up with this idea of writing a shared library, which includes every system call wrapper, such as <code>mmap</code> and then perform the logging before calling the actual system call wrapper function. For example pseudo code of what my <code>mmap</code> would look like is given below.</p>
  
  <pre><code>int mmap(...)
  {
   log_parameters(...);
   call_original_mmap(...);
   ...
  }
  </code></pre>
  
  <p>Then I can use LD_PRELOAD to load this library firstup. Do you think this idea will work, or am I missing something?</p>