3 ms·
Very interesting. First time I heard about loading bash "builtins" from a shared library. How does this compare to LD_PRELOAD? Personally, I just run things in
by no_time 5y ago
Very interesting. First time I heard about loading bash "builtins" from a shared library. How does this compare to LD_PRELOAD?
Personally, I just run things in network namespaces with "ip netns exec offline|wireguard $COMMAND" to restrict net access.
- rkeene2 5y agoUsing LD_PRELOAD you only affect dynamically linked executables, where using kernel enforcement using syscall filtering, every process is affected. Also, things are allowed to unset LD_PRELOAD, but not remove filtering. I thought about using a network namespace, but that would make things more complicated since I would need to re-call my shell script to pick-up where I left off (because it requires creating a new process). I initially tried to implement this using network namespaces, but you cannot "unshare" the current process, you must spawn a new process. With dropnet I can do download() enable -f ./dropnet.so dropnet configure() build() install() With "unshare" I would need to do more work to get to "configure()" in a new process.