I need to direct an external library making a system call to a function defined in my userspace application.

• I cannot use LD_PRELOAD because I need static linking.

• I cannot use ftrace/a Linux kernel module to intercept the call because this would require the function be in kernel space and that’s not possible. It’s C++ and quite a lot of code.

What about a kernel module modifying the sys call table to point to an address for the function? My application would locate the function at the same address.

Is it still possible to overwrite the sys call table in the latest linux kernels?

In the past you could locate the table with kallsyms_lookup_name and change the CR0 value to give permissions. However, I think Linux kernel 5 or 6 made changes to stop this. However, I don’t fully understand how much the changes stopped this. I think they stopped exporting kallsyms_lookup_name, so maybe it’s still possible, just more-difficult?

(I’m aware editing the table is frowned upon but this is not for customer usage, there are no security implications/it’s a closed system).