News for hackers. Stuff that matters.
Re:OrBit: New Undetected Linux Threat Uses Unique Hijack of ... by egberts1 on Friday July 08, 2022 @07:55AM (#32025955)
Yeah, I would love a list of “downsides” if one were to compile-out the LD_PRELOAD.

As far as I can gather, one cannot do GDB without recompiling with --gdb option if LD_PRELOAD were disabled at compile-time.

Re:OrBit: New Undetected Linux Threat Uses Unique Hijack of ... by cstrahan on Friday July 08, 2022 @06:14PM (#32028188)
LD_PRELOAD is also useful for working around hard-coded file paths inside of closed source (often commercial) software. This is how we make some closed source software work on NixOS, where we need a way to redirect file IO to corresponding paths in the NixOS file system (when those paths aren't the same as on typical distros).
Re:OrBit: New Undetected Linux Threat Uses Unique Hijack of ... by egberts1 on Saturday July 09, 2022 @10:16AM (#32035311)
That use of LD_PRELOAD by Nix is NOT a downside.

But it is not a good workaround for Nix thus making Nix a poor candidate for a reasonably secured production servers.

Re:OrBit: New Undetected Linux Threat Uses Unique Hijack of ... by badrabbit on Friday July 08, 2022 @11:31PM (#32031321)
There are several others mentioned so it shouldn't be a default but none of those use cases apply to normal users otr prod servers.
Re:OrBit: New Undetected Linux Threat Uses Unique Hijack of ... by egberts1 on Saturday July 09, 2022 @10:08AM (#32035222)
yeah, the following positive usages of LD_PRELOAD is enough to cobble together and hijack a system, from userland.

https://github.com/gaul/awesome-ld-preload

Re:OrBit: New Undetected Linux Threat Uses Unique Hijack of ... by egberts1 on Friday July 08, 2022 @08:07AM (#32026076)
Also LD_PRELOAD gets used by Debian `fakeroot` for building packages.

So no can do disabling LD_PRELOAD on Debian (much less be able to use libmusl on a Debian)

Re:OrBit: New Undetected Linux Threat Uses Unique Hijack of ... by tinus_hn on Friday July 08, 2022 @08:41PM (#32030077)
Most people though will not be building packages.
Re:OrBit: New Undetected Linux Threat Uses Unique Hijack of ... by egberts1 on Saturday July 09, 2022 @10:04AM (#32035182)
At least the Gentoo folks, not withstanding.