LD_PRELOAD is not an keylogger. Its an LD_PRELOAD is an Equivalent of an DLL hijack. To be save from this /home and /tmp are mounted as noexec to prevent all of

LD_PRELOAD is not an keylogger. Its an LD_PRELOAD is an Equivalent of an DLL hijack. To be save from this /home and /tmp are mounted as noexec to prevent all of these attacks. Libraries that contain executable code (i haven't found one that doesn't have at least a byte) require the executable bit, which is disabled with noexec.