You could handle dlopen() by: - have parent isolate process monitor a dir in the chroot env. If it sees a file appear (with no .tmp suffix) it adds any .so fil

You could handle dlopen() by: - have parent isolate process monitor a dir in the chroot env. If it sees a file appear (with no .tmp suffix) it adds any .so files which are listed in the file (one per line) then removes the file - set a LD_PRELOAD shim in the child process to hook dlopen() to write the filename to a .tmp file in the monitored dir (and then flush/close/rename/loops until file gone, then loads the .so) Protecting data files is part of the point. You could try hooking some open/stat calls via LD_PRELOAD and make them available in the chroot if they are world-readable I guess.