Sorry for the laggy response! I was dealing with conference deadlines and then HITCON travel.

There are three ways that I can think to implement desock:

LD_PRELOAD all functions that do any sort of socket operations (reads, writes, sockopts, fdopen, etc). I didn't choose this because getting the full exhaustive list seemed like a pain and it seemed impossible to test.
(only for programs that dup() connections to stdin/stdout) Disable dup2. This is what desock_dup.so does.
Open a socketpair and synchronize input and output between the socketpair and stdin/stdout. There's no way that I can see to do it fully inline without tricks, though. I see a few ways to implement this:
1. Spin off a thread and synchronize the socketpair in that thread. This is the route that I chose, because I already had some easily-adaptable code laying around for it.
2. Use alarm(), and in the handler do the synchronization and set another alarm. This seems messy, as programs frequently use alarm for other stuff.
3. Use some other way to implement timers (http://www.2net.co.uk/tutorial/periodic_threads), many of which use threads or alarm in the backend.

I happened to implement options 2 and 3i. Of course, I'm totally open to PRs to add more methods!

Documentation request: why desock uses threads? #10

Description