19

I stumbled upon a file called ld.so.preload and can't find any real usage for it. Does it have something to do with the env variable LD_PRELOAD ?

1 Answer 1

19

Good question! Actually, /etc/ld.so.preload replaces, in a way, LD_PRELOAD.

LD_PRELOAD is subject to severe restrictions due to a security concern: it cannot execute arbitrary setuid binaries because, if it could, you could substitute library routines with your own malicious code, see for instance here for a nice discussion. In fact, you can read in ld.so'user manual:

LD_PRELOAD

A list of additional, user-specified, ELF shared libraries to be loaded before all others. The items of the list can be separated by spaces or colons. This can be used to selectively override functions in other shared libraries. The libraries are searched for using the rules given under DESCRIPTION. For set-user-ID/set-group-ID ELF binaries, preload pathnames containing slashes are ignored, and libraries in the standard search directories are loaded only if the set-user-ID permission bit is enabled on the library file.

Instead, the file /etc/ld.so.preload suffers from no such limitation, the idea being that, if you can read/write to the directory /etc, you already have root credentials. Hence its use. Just keep in mind that you may use /etc/ld.so.preload even though you do not seem to have one at first: it is nothing but a feature of glibc, hence of all Linux distros (but not, to the best of my knowledge, of Unix flavors), thus you can create it and put into it the name of whichever setuid library in any Linux distro, and it will work.

3
  • 3
    A significant difference is that LD_PRELOAD, being in the environment, affects only that process. /etc/ld.so.preload applies to every program that's loaded using /lib/ld-linux.so. Feb 27, 2017 at 13:41
  • @TobySpeight True, even though this is not specific to the LD_PRELOAD vs. /etc/ld.so.preload alternative. Feb 27, 2017 at 14:18
  • 1
    It's worth mentioning that libraries specified by LD_PRELOAD are loaded before those specified in /etc/ld.so.preload
    – Boban P.
    May 28, 2020 at 4:32

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .