Rewriting Every Syscall in a Linux Binary at Load Time

A Hacker News discussion examines rewriting every syscall in a Linux binary at load time and running it in a KVM-based environment for tighter control and tracing.

Readers asked whether syscall trapping inside KVM could achieve the same result, how visible guest syscalls are to host tools, and whether the method could strengthen sandboxing.

The author said the binary runs in a lightweight KVM guest without a full OS, with a shim handling syscalls instead of the host kernel.

Because of that setup, host-side strace cannot observe guest calls directly, but the system records each syscall attempt with arguments, timestamps, and policy decisions.