Re:OrBit: New Undetected Linux Threat Uses Unique Hijack of ...
by cstrahan on Friday July 08, 2022 @06:14PM
(#32028188)
LD_PRELOAD is also useful for working around hard-coded file paths inside of closed source (often commercial) software. This is how we make some closed source software work on NixOS, where we need a way to redirect file IO to corresponding paths in the NixOS file system (when those paths aren't the same as on typical distros).
Re:OrBit: New Undetected Linux Threat Uses Unique Hijack of ...
by egberts1 on Saturday July 09, 2022 @10:16AM
(#32035311)
That use of LD_PRELOAD by Nix is NOT a downside.
But it is not a good workaround for Nix thus making Nix a poor candidate for a reasonably secured production servers.
Re:OrBit: New Undetected Linux Threat Uses Unique Hijack of ...
by badrabbit on Friday July 08, 2022 @11:31PM
(#32031321)
There are several others mentioned so it shouldn't be a default but none of those use cases apply to normal users otr prod servers.
Re:OrBit: New Undetected Linux Threat Uses Unique Hijack of ...
by egberts1 on Saturday July 09, 2022 @10:08AM
(#32035222)
yeah, the following positive usages of LD_PRELOAD is enough to cobble together and hijack a system, from userland.
Re:OrBit: New Undetected Linux Threat Uses Unique Hijack of ...
by egberts1 on Friday July 08, 2022 @08:07AM
(#32026076)
Also LD_PRELOAD gets used by Debian `fakeroot` for building packages.
So no can do disabling LD_PRELOAD on Debian (much less be able to use libmusl on a Debian)
As far as I can gather, one cannot do GDB without recompiling with --gdb option if LD_PRELOAD were disabled at compile-time.