Should I worry about this torify (torsocks) warning?

Question

WARNING torsocks[4382]: [syscall] Unsupported syscall number 319. Denying the call (in tsocks_syscall() at syscall.c:465)

I've seen other reports on different websites with different numbers. I was using torify with youtube-viewer, but I seem to have gotten frequent warnings with several other command-line applications after torifying. The apps do what I intended.

Answer 1

torsocks intercepts calls to the libc syscall() function (and various other libc calls) by hooking into them through the dynamic linkers LD_PRELOAD environment variable.

It creates a "shim" function around the calls that it knows it can properly torify, and runs a torified version of the function. Those that it cannot properly torify or does not know can be torified safely are denied, and warnings like those you've reported are generated.

So the warning means the application tried to use some function torsocks doesn't know if it can safely allow or handle and that on that basis, it denied it. Clearly this means certain applications simply will not work with torsocks but those that do work should be reliably torified.

There are a couple of exceptions.

1. LD_PRELOAD can be stripped for security reasons (setuid, capabilities, etc.), torsocks detects these cases as best it can but it's a difficult problem.
2. A syscall is issued directly from some assembly code, since this won't go through the libc wrapper function, this will not be intercepted and torified by torsocks.