I would like to catch all syscalls coming from a forked process, modify them, send them to the kernel, and then pass them back to the forked process. Is this possible, and if so, how might I go about this?
I've done some research, and found ptrace, but it seems a bit heavy weight because it does so many things (modifying registers, etc...). Correct me if I am incorrect, however.

1 Answer 1


If you can wait for version 5.11 of the kernel, it will have a new system call interception mechanism designed for fast (or less slow) emulation of system calls. The initial use case is for Wine but it is usable for other purposes, as long as a signal handler can work (it relies on SIGSYS).

  • Thanks! I think for now I'll stick with ptrace, and then once 5.11 is out for a good amount of time, I'll upgrade my laptop and do that instead. Dec 29, 2020 at 17:22

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .