torsocks intercepts calls to the libc
syscall() function (and various other libc calls) by hooking into them through the dynamic linkers
LD_PRELOAD environment variable.
It creates a "shim" function around the calls that it knows it can properly torify, and runs a torified version of the function. Those that it cannot properly torify or does not know can be torified safely are denied, and warnings like those you've reported are generated.
So the warning means the application tried to use some function torsocks doesn't know if it can safely allow or handle and that on that basis, it denied it. Clearly this means certain applications simply will not work with
torsocks but those that do work should be reliably torified.
There are a couple of exceptions.
LD_PRELOAD can be stripped for security reasons (setuid, capabilities, etc.), torsocks detects these cases as best it can but it's a difficult problem.
- A syscall is issued directly from some assembly code, since this won't go through the libc wrapper function, this will not be intercepted and torified by