3 ms·
This feature is used since ages by sudo to implement the noexec option, to prevent dynamically linked executables from executing further programs. At some point
by ale42 3y ago
This feature is used since ages by sudo to implement the noexec option, to prevent dynamically linked executables from executing further programs. At some point I took advantage of this (sudo allows specifying a custom .so file for the noexec function) to implement other restrictions in programs run by sudo (of course, there are always ways to go around them).
- Denvercoder9 3y agoNowadays sudo uses seccomp filtering for its noexec option, which is enforced by the kernel and does not allow the workarounds that userspace-based solutions (including LD_PRELOAD) have.
- ale42 3y agoDidn't know this, thanks for the info!