I have a program that requires presence of specific device in system (afaik it checks /proc/bus/pci/devices for against list of hardcoded vendor_id:device_id pairs). How could I fool this software to think that device is present without having it physically connected? Is there any way to add a line to /proc/bus/pci/devices or intercept syscall from specific program and change it?
You should run
strace on your program to figure out what "presence of specific device" means, exactly.
If it's really just reading that "file" as a normal file: well, easy, then just don't show the right file to that program!
That's what filesystem namespaces are for: isolating a program's view of the filesystem. (it's part of what container engines (think docker) tick.)
unshare -m might help, after which you can mess around with your /proc mount to your heart's delight (hint: mount it somewhere else, use that as lower layer in an overlayfs to fake a "better" /proc/bus/pci/devices, comes with a caveat).
Also: this sounds like a rather straightforward thing to runtime-patch into your program. Run to startup, open() a text file that contains the desired line, giving you a new file descriptor to that, watchpoint on the "open()" syscall, catch when it opens /proc/bus/pci/devices, and if it's that, instead of returning the file descriptor of that, give the file descriptor to the text file.