From mboxrd@z Thu Jan  1 00:00:00 1970
Return-Path: <fweimer@redhat.com>
Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.133.124])
	by sourceware.org (Postfix) with ESMTPS id 9B4313858D37
	for <libc-help@sourceware.org>; Mon, 10 Oct 2022 08:43:39 +0000 (GMT)
DMARC-Filter: OpenDMARC Filter v1.4.1 sourceware.org 9B4313858D37
Authentication-Results: sourceware.org; dmarc=pass (p=none dis=none) header.from=redhat.com
Authentication-Results: sourceware.org; spf=pass smtp.mailfrom=redhat.com
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com;
	s=mimecast20190719; t=1665391419;
	h=from:from:reply-to:subject:subject:date:date:message-id:message-id:
	 to:to:cc:cc:mime-version:mime-version:content-type:content-type:
	 in-reply-to:in-reply-to:references:references;
	bh=izl4P6OHije4OhCPeU3JnNURC7xlScS5zt8NJQOoG0Y=;
	b=KQJ8Nu7u8w1c7kpe5X1rPJCWr0R19HBoFzWTixfuV+cUwQA5rkXzoNOi9/hRnzkuEdKdzN
	JK6IiUzND8sZgSq1y8JSJSMFrkhycJG/wW6GWTDeol1rwR0kh10wGknfPDYd74MpmZs4Nr
	qzfXDZMD44iDA3z95QJAnvIxmzSXB20=
Received: from mimecast-mx02.redhat.com (mimecast-mx02.redhat.com
 [66.187.233.88]) by relay.mimecast.com with ESMTP with STARTTLS
 (version=TLSv1.2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id
 us-mta-44-7XKJHPSxOti2xZbHV951yA-1; Mon, 10 Oct 2022 04:43:38 -0400
X-MC-Unique: 7XKJHPSxOti2xZbHV951yA-1
Received: from smtp.corp.redhat.com (int-mx02.intmail.prod.int.rdu2.redhat.com [10.11.54.2])
	(using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits))
	(No client certificate requested)
	by mimecast-mx02.redhat.com (Postfix) with ESMTPS id C5414185A792;
	Mon, 10 Oct 2022 08:43:37 +0000 (UTC)
Received: from oldenburg.str.redhat.com (unknown [10.39.192.124])
	by smtp.corp.redhat.com (Postfix) with ESMTPS id 31D4640C6EC2;
	Mon, 10 Oct 2022 08:43:36 +0000 (UTC)
From: Florian Weimer <fweimer@redhat.com>
To: Farid Zakaria via Libc-help <libc-help@sourceware.org>
Cc: Farid Zakaria <fmzakari@ucsc.edu>
Subject: Re: Can I use la_symbind to change the shared object file where
 it's binded?
References: <CAH4OOv62xN=WXUC8qCXDOwr_6Ejme9HS-rag0xjViqHzEhJYtQ@mail.gmail.com>
Date: Mon, 10 Oct 2022 10:43:35 +0200
In-Reply-To: <CAH4OOv62xN=WXUC8qCXDOwr_6Ejme9HS-rag0xjViqHzEhJYtQ@mail.gmail.com>
	(Farid Zakaria via Libc-help's message of "Thu, 6 Oct 2022 10:05:38
	-0700")
Message-ID: <87a6643w7c.fsf@oldenburg.str.redhat.com>
User-Agent: Gnus/5.13 (Gnus v5.13) Emacs/27.2 (gnu/linux)
MIME-Version: 1.0
X-Scanned-By: MIMEDefang 3.1 on 10.11.54.2
X-Mimecast-Spam-Score: 0
X-Mimecast-Originator: redhat.com
Content-Type: text/plain
X-Spam-Status: No, score=-4.7 required=5.0 tests=BAYES_00,DKIMWL_WL_HIGH,DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,RCVD_IN_DNSWL_NONE,SPF_HELO_NONE,SPF_NONE,TXREP autolearn=ham autolearn_force=no version=3.4.6
X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on server2.sourceware.org
List-Id: <libc-help.sourceware.org>

* Farid Zakaria via Libc-help:

> I am looking to see if I can replicate LD_PRELOAD using la_symbind in
> the rltd-audit API.
>
> I would like to provide the audit API a: symbol -> shared object file
> (perhaps with offset) and have the audit API override it.
>
> Is this possible?
> I am thinking perhaps I can dlopen the file in the audit method and
> then use dlsym as well.

It's possible to use la_symbind to alter some symbol bindings.  Where
the replacement symbol address comes from does not matter.

You may have to use dlmopen, to inject the shared object into the main
namespace, not the auditor namespace.  You probably have to open the
shared object before the la_symbind callback happens.

Be sure to use a recent glibc versions (2.34 and later) because many
bugs in auditor support have been fixed.

Thanks,
Florian