I would like a command-line-tool to fail if it opens a particular file for writing.
Is there a way I can modify the environment (maybe via cgroups) of the command-line tool, so that the command/process gets (for example) "permission denied"?
chmod a-w file does not work. The process seems to unlink() and then re-create the file.
I know that I can watch the syscalls of a process with strace. But is there a way to alter some calls, so that the process gets a different result?
strace has an option called -e inject or simply --inject which can be used to alter system calls of the tracee. (See manpage here)
In particular, in can be combined with the -P option to only trace syscalls accessing a specified path.
Since the calls are honored in the order they are loaded from shared libraries, you can use LD_PRELOAD to load a custom library prior to the system libraries and hijack their execution. This is used by many network card accelerators like OpenOnload from Solarflare/Xilinx.
https://sumit-ghosh.com/articles/hijacking-library-functions-code-injection-ld-preload/