Last active
January 17, 2020 00:09
-
-
Save f0rki/cc7e683f0c9c17f8b81347fb3e268c92 to your computer and use it in GitHub Desktop.
Can you LD_PRELOAD from noexec mounted directory?
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
+ uname -a | |
Linux ~~~~~ 4.15.14-300.fc27.x86_64 #1 SMP Thu Mar 29 16:13:44 UTC 2018 x86_64 x86_64 x86_64 GNU/Linux | |
+ make test | |
cc test.c -o test | |
+ ./test | |
hello world | |
+ make preload.so | |
cc preload.c -o preload.so -shared -fPIC | |
+ LD_PRELOAD=./preload.so | |
+ ./test | |
LD_PRELOADed puts() called | |
+ mkdir -p mnt_noexec | |
+ sudo mount -t tmpfs -o nosuid,noexec tmpfs ./mnt_noexec | |
+ cp preload.so ./mnt_noexec/ | |
+ pushd mnt_noexec | |
~/test/mnt_noexec ~/test | |
+ LD_PRELOAD=./preload.so | |
+ ../test | |
ERROR: ld.so: object './preload.so' from LD_PRELOAD cannot be preloaded (failed to map segment from shared object): ignored. | |
hello world | |
+ exit 0 |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
all: test preload.so | |
clean: | |
-$(RM) test preload.so | |
%.so: %.c | |
$(CC) $^ -o $@ -shared -fPIC $(CFLAGS) |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
#include <unistd.h> | |
const char s[] = "LD_PRELOADed puts() called\n"; | |
int puts(const char* x) | |
{ | |
write(1, s, sizeof(s) - 1); | |
return 0; | |
} |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
#include <stdio.h> | |
int main() { | |
puts("hello world"); | |
return 0; | |
} |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
#!/bin/bash -ex | |
uname -a | |
make test | |
./test | |
make preload.so | |
LD_PRELOAD=./preload.so ./test | |
mkdir -p mnt_noexec | |
sudo mount -t tmpfs -o nosuid,noexec tmpfs ./mnt_noexec || true | |
cp preload.so ./mnt_noexec/ | |
pushd mnt_noexec | |
LD_PRELOAD=./preload.so ../test | |
exit $? |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment