torsocks
intercepts calls to the libc syscall()
function (and various other libc calls) by hooking into them through the dynamic linkers LD_PRELOAD
environment variable.
It creates a "shim" function around the calls that it knows it can properly torify, and runs a torified version of the function. Those that it cannot properly torify or does not know can be torified safely are denied, and warnings like those you've reported are generated.
So the warning means the application tried to use some function torsocks doesn't know if it can safely allow or handle and that on that basis, it denied it. Clearly this means certain applications simply will not work with torsocks
but those that do work should be reliably torified.
There are a couple of exceptions.
LD_PRELOAD
can be stripped for security reasons (setuid, capabilities, etc.), torsocks detects these cases as best it can but it's a difficult problem.
- A syscall is issued directly from some assembly code, since this won't go through the libc wrapper function, this will not be intercepted and torified by
torsocks
.