This may not be possible, but... I have a 3rd party app (mumble for the curious) that can be told to open a file for write (I provide the name), and dump bytes into it until told to stop. It doesn't open the file for append and if the file already exists it changes the name and tries again. All well, good and fairly standard. It can write for hours (and will happily fill the disk, which is the problem).

I want to intercept everything it writes and read it from another process; ideally it would never get to disk at all, but I'll accept compromises where some of it does.

The obvious solution, to read the file as it's written, truncate() what I read and read again, won't work for me, because the file won't get smaller when I truncate - mumble doesn't specify append, so it will keep writing where it left off. Ideally I need some way to fool it into thinking it created and is writing a normal file, while really it's just piping it all to me. I don't want to write my own filesystem code for this (unless that's much easier than it looks).

Ultimately I want to get the recorded sound, hash it up and feed it to /dev/random. Just pointing mumble to /dev/random doesn't work because /dev/random exists, so it won't use it.

is there a clever trick for this? If not is there any way to write userland code that looks like a directory? If all else fails, is it fairly simple to write a filesystem that can do what I need?

1 Answer 1


You can use LD_PRELOAD to make mumble load a library you specify before all other libraries. You can write a small library with custom open()/stat()/etc which, depending up on the file name, either passes the call along to the standard C library for standard behavior or does something special to trick mumble.

  • oh... that's beautiful. Accepting it untried because I never knew about it and it's so obviously right.
    – Scott M
    Aug 25, 2018 at 10:52

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .