Skip to content

Instantly share code, notes, and snippets.

@f0rki
Last active January 17, 2020 00:09
Show Gist options
  • Save f0rki/cc7e683f0c9c17f8b81347fb3e268c92 to your computer and use it in GitHub Desktop.
Save f0rki/cc7e683f0c9c17f8b81347fb3e268c92 to your computer and use it in GitHub Desktop.
Can you LD_PRELOAD from noexec mounted directory?
+ uname -a
Linux ~~~~~ 4.15.14-300.fc27.x86_64 #1 SMP Thu Mar 29 16:13:44 UTC 2018 x86_64 x86_64 x86_64 GNU/Linux
+ make test
cc test.c -o test
+ ./test
hello world
+ make preload.so
cc preload.c -o preload.so -shared -fPIC
+ LD_PRELOAD=./preload.so
+ ./test
LD_PRELOADed puts() called
+ mkdir -p mnt_noexec
+ sudo mount -t tmpfs -o nosuid,noexec tmpfs ./mnt_noexec
+ cp preload.so ./mnt_noexec/
+ pushd mnt_noexec
~/test/mnt_noexec ~/test
+ LD_PRELOAD=./preload.so
+ ../test
ERROR: ld.so: object './preload.so' from LD_PRELOAD cannot be preloaded (failed to map segment from shared object): ignored.
hello world
+ exit 0
all: test preload.so
clean:
-$(RM) test preload.so
%.so: %.c
$(CC) $^ -o $@ -shared -fPIC $(CFLAGS)
#include <unistd.h>
const char s[] = "LD_PRELOADed puts() called\n";
int puts(const char* x)
{
write(1, s, sizeof(s) - 1);
return 0;
}
#include <stdio.h>
int main() {
puts("hello world");
return 0;
}
#!/bin/bash -ex
uname -a
make test
./test
make preload.so
LD_PRELOAD=./preload.so ./test
mkdir -p mnt_noexec
sudo mount -t tmpfs -o nosuid,noexec tmpfs ./mnt_noexec || true
cp preload.so ./mnt_noexec/
pushd mnt_noexec
LD_PRELOAD=./preload.so ../test
exit $?
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment