Re: Hooking execve for an LD_PRELOAD library

[Andreas Fink <finkandreas@web.de>]

On Mon, 18 Jan 2021 11:39:49 +0100
Florian Weimer <fweimer@redhat.com> wrote:

> * Andreas Fink via Libc-help:
>
> > Ok, if I understood you correctly this is the expected behaviour. I was
> > afraid of it, but ok I can live with it.
> > Assuming I want to hook the whole exec-family, it seems easy to just
> > add hooks for the execv* functions while forwarding all arguments to
> > the corresponding glibc implementation.
>
> You will also have to deal with system, popen, posix_spawn,
> posix_spawnp.
Yes, definitely for posix_spawn and posix_spawnp (I did not know about
these two).
I figured out, that I can ignore system(cmd) and popen(cmd, type) at the
moment, as the actual stuff in cmd would come in later by execve because
/bin/sh inherits the environment with LD_PRELOAD and calls itself
execve for everything that is in cmd.
I.e. I "miss" the call to /bin/sh, but this is ok for my use-case.

>
> > Forwarding the execl* functions seems a bit more involved, as I would
> > have to bend the va_list to an array, or is there some way to forward
> > the arguments to the glibc function without unwrapping the va_list?
>
> I don't think this is possible in general.  GCC has __builtin_apply and
> __builtin_apply_args, but I don't know if they work with variadic
> functions on all architectures.
I think I will skip it, if it is non-standard, wrap it into arrays
and forward to execv-family.

>
> > Kernel-based mechanism (in my case that's Linux) sounds also interesting
> > as it is one level lower I guess, but honestly speaking I have no idea
> > where to start to look at. Do you know of an example (not necesserily
> > execve, but any system call where this is done)?
>
> You can find examples for ptrace system call interception and emulation
> on the web.  Niels Provos' systrace also has a ptrace backend, which
> could serve as a source of inspiration.
Thanks for the pointers, I had a quick look at them, but for now I
think I can get away with overriding all exec-family functions and
posix_spawn(p).

Your help is highly appreciated, and was very helpful to get to a
working solution.
Thank you
Andreas