You can also attack it with an LD_PRELOAD overriding various functions
with versions that dump their arguments to a file before executing.
ie: (poor man's strace)
int close(int i) {
printf("close %d\n", i);
__close(i);
}
Replace printf with an appropriate fprintf and you can list all calls to
a given shared library.
cc -o test.o test.c ; ld -shared test.o -o test.so ; \
LD_PRELOAD=./test.so foobar
And see all the calls to close() [or, of course, any function you want].
Maybe LD_PRELOAD should also not be permitted if you have not got read
permission to the file you are executing? There could quite easily be
something more revealing that you can do with this -- eg, copy the entire
memory space of the program to a file.
David.
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.rutgers.edu
Please read the FAQ at http://www.tux.org/lkml/