3 ms·
Avoid using Glibc or patch-out LD_PRELOAD unless you need it. I don't mean as a response to this one threat but in general it seems to be the go to hooking mec
by _8j50 4y ago
Avoid using Glibc or patch-out LD_PRELOAD unless you need it. I don't mean as a response to this one threat but in general it seems to be the go to hooking mechanism. With this measure and signed kernel module loading enforcement with secureboot you can make it more hostile for untargeted malware to succeed in persisting or installing a rootkit.
- egberts1 4y agoYeah, I would love a list of “downsides” if one were to compile-out the LD_PRELOAD. As far as I can gather, one cannot do GDB without recompiling with --gdb option if LD_PRELOAD were disabled at compile-time.
- egberts1 4y agoAlso LD_PRELOAD gets used by Debian `fakeroot` for building packages. So no can do disabling LD_PRELOAD on Debian (much less be able to use libmusl on a Debian)
- cstrahan 4y agoLD_PRELOAD is also useful for working around hard-coded file paths inside of closed source (often commercial) software. This is how we make some closed source software work on NixOS, where we need a way to redirect file IO to corresponding paths in the NixOS file system (when those paths aren't the same as on typical distros).
- egberts1 4y agoThat use of LD_PRELOAD by Nix is NOT a downside. But it is not a good workaround for Nix thus making Nix a poor candidate for a reasonably secured production servers.
- _8j50 4y agoThere are several others mentioned so it shouldn't be a default but none of those use cases apply to normal users otr prod servers.
- egberts1 4y agoyeah, the following positive usages of LD_PRELOAD is enough to cobble together and hijack a system, from userland. https://github.com/gaul/awesome-ld-preload https://github.com/gaul/awesome-ld-preload