> Luckily for us Linux provides exceptionally easy way to intercept some specific library functions using simple dynamically linked library: LD_PRELOAD
Doesn't LD_PRELOAD only work for non-statically linked executables?
These days the default is to dynamically link to libc, because a few parts of the standard library either fundamentally need to use libc, or have benefits from such linking (like supporting NSS based user/group lookup).
However, if you don't need to pull in any c libraries, you can use `CGO_ENABLED=0 go build` to build completely without linking to libc on linux. It is pretty common that applications will do that if they are not using the parts of the go standard library that need libc, and don't pull in C libraries.
Yes, static binaries would require a different hack.
I think something like the tampering feature of strace or a kprobe to intercept the syscall would work.
Doesn't LD_PRELOAD only work for non-statically linked executables?