3 ms·
Nah, the readlink on exe looks like it's simply to query the real name of the executable, so that's pretty benign.
by gmueckl 5y ago
Nah, the readlink on exe looks like it's simply to query the real name of the executable, so that's pretty benign.
- nonameiguess 5y agoI believe they mean grab the absolute path to the real executable, run ldd against it, and parse that output to see if it links against libX11. That doesn't tell you a program is really using X11, though, as plenty have some sort of no-gui option to launch without a window. You can always cat /proc/{PID}/maps to see if libx11 is actually loaded into the process' address space, and just use readlink on exe to figure out the application name. That's a really stupid way to figure out if a program has a window, though, compared to just using the X11 API directly.
- gmueckl 5y agoDo you have evidence of old being executed or similar? The posted strace log section is fairly benign and shows no hints of what you insinuate.
- woodruffw 5y agoYou wouldn’t actually need to execute `ldd` to get this information: you could parse the ELF entirely in user space. That, in turn, wouldn’t show up in the `strace` logs, since there would be no syscalls. I think that’s extremely unlikely, but it’s certainly possible.
- IgorPartola 5y agoReading the file would show up as syscalls.
- woodruffw 5y agoSure, but you could minimize it to just two: the `open` that we already see here, and an `mmap` that maps the entire thing in. The rest could be in userspace (at least in terms of effects). We only have an excerpt of the syscall trace, so it's possible that happens. But again: extraordinarily unlikely.
- nonameiguess 5y agoNope, and I'm not going to run zoom to find out. To be perfectly clear, I'm not at all trying to say I have evidence that this is what zoom is actually doing. I'm trying to say I believe this is what the upper-level post was suggesting zoom is doing.