title: recording `open` syscalls on mac
body: <p>I would like to know what calls are made to <code>open(2)</code> in a bash script.</p>
  <p>I wrote the following program which intercepts syscalls:</p>
  <pre class="lang-c prettyprint-override"><code>#include &lt;fcntl.h&gt;
  #define _GNU_SOURCE
  #include &lt;dlfcn.h&gt;
  #include &lt;stdio.h&gt;
  #include &lt;stdlib.h&gt;
  
  #define DYLD_INTERPOSE(_replacment,_replacee) \
  __attribute__((used)) static struct{ const void* replacment; const void* replacee; } _interpose_##_replacee \
  __attribute__ ((section (&quot;__DATA,__interpose&quot;))) = { (const void*)(unsigned long)&amp;_replacment, (const void*)(unsigned long)&amp;_replacee };
  
  static
  int
  my_open(const char *filename, int oflag, mode_t mode)
  {
      printf(&quot;$jason$ open: %s\n&quot;, filename);
      return open(filename, oflag, mode);
  }
  DYLD_INTERPOSE(my_open, open)
  </code></pre>
  <p>Which I then ran using:</p>
  <pre class="lang-sh prettyprint-override"><code>clang -dynamiclib libfile.c -o libfile.dylib
  export DYLD_INSERT_LIBRARIES=libfile.dylib
  touch /tmp/testingtesting
  </code></pre>
  <p>It doesn't work.</p>
  <p>I tried it with a program that I compiled and it works fine. I tried it with programs compiled by brew and it works fine. I read the source code for <a href="https://opensource.apple.com/source/file_cmds/file_cmds-321.100.11/touch/touch.c" rel="nofollow noreferrer">touch.c</a>. It calls <code>open(2)</code>.</p>
  <p>I then disabled SIP and it worked fine. So, I concluded that it was SIP that was causing the problem. I don't want to disable SIP though.</p>
  <p>What should I do? I was thinking about just allowing dtrace: <code>csrutil enable --without dtrace</code>. Because I think dtrace can track syscalls but I'm not sure if that is a safe option.</p>