4 ms·
Isn't LD_PRELOAD's hipness outweighed by the Pandora's box of security issues it gives rise to?
by hendry 8y ago
Isn't LD_PRELOAD's hipness outweighed by the Pandora's box of security issues it gives rise to?
- regecks 8y agoI know that the linker will ignore LD_PRELOAD for suid binaries, what other kinds of issues are there?
- FartyMcFarter 8y agoWhat security issues are those? Is there anything you can do with LD_PRELOAD that you cannot do in other ways such as modifying binaries before executing them?
- craftyguy 8y agoAs a regular ol' GNU/Linux user, you cannot modify binaries in /usr/bin (or /bin), but you can definitely influence their behavior by "LD_PRELOAD=blah /usr/bin/thing".
- yjftsjthsd-h 8y agoIf you can do that, you can (generally) do `cp /bin/foo ./ && modify foo && ./foo`
- peterwwillis 8y agoIt depends on assumptions in the way a system is hardened. For example, a home directory mounted noexec. In theory, LD_PRELOAD will not mmap a file in a noexec area. But if you can find an installed library with functions that mirror some other application you have, and you can LD_PRELOAD that library before executing the target application, you might be able to force the library to call unexpected routines. (That's a stretch, granted) Another would be possible RCE. Say you can get a server-side app to set environment variables, like via header injection. Then say you can upload a file. Can you make that server-side app set LD_PRELOAD to the file, and then wait for it to execute an arbitrary program?
- Godel_unicode 8y agoExcept you (non-root) can only do that for yourself, and thus you can only make them do things you could make them do anyway.